Privacy

RavenMail keeps what it needs to deliver your mail. This page lists all of it.

What is stored

For your account: your email address, your forms and their settings. For each message someone sends you: their name, email, subject, message, the answers to your custom fields, the page it came from and any attachments.

Visitor IP addresses are never stored as they are. RavenMail keeps a salted hash of the address instead, which is enough to count how many messages one connection sends (5 per form every 10 minutes, 30 an hour in total) and how many different people reported a form.

If you report a form, RavenMail keeps the reason, your details, your email if you give one and the same kind of salted hash.

Attachments

Attachment files are deleted 30 days after the message arrives. The message itself stays in your dashboard until you delete it.

Who else sees what

• No outside service runs on the form. The spam check is a proof of work: after the visitor presses send, their browser solves a short calculation and RavenMail checks the answer. It runs on hosted forms, on embeds, and on the plain HTML form when its owner turns the check on. Nothing about the visitor leaves RavenMail for it. On hosted forms and embeds, a failed check drops the message and only the reason is logged. On the plain HTML form, a message that never passes the check is deleted after an hour.
• Resend sends the email. Each message passes through it on the way to your inbox, and it tells RavenMail when an address bounces.
• Webhooks send messages wherever a form owner points them, such as Discord, Slack or their own server. Nothing goes out by webhook unless the owner set one up.

Analytics and cookies

No analytics and no ad trackers. RavenMail sets a session cookie when you sign in, so you stay signed in. Pages with a RavenMail form, like the sign in page, also set a security cookie that stops other sites from submitting forms as you. RavenMail sets neither for the people filling in your form.

Backups

The database is copied continuously to a private bucket, so a dead server does not take everyone's forms with it. Attachments are left out of the backup on purpose: by then they have been delivered, by email or as a link in your dashboard, and they are deleted after 30 days anyway.

Deleting your account

Go to your account, scroll to "Delete account" and type your email to confirm. Your forms, messages and attachments are deleted right away. Copies inside the database backup go away as old backup snapshots expire.

If you sent a message through someone else's form, that message belongs to the form's owner. Ask them to delete it.

Last updated 21 October 2026.