Maskbox Privacy Policy
Effective July 20, 2026
Maskbox has no account and never asks who you are. It does, however, receive the email sent to the masked addresses you create and stores it on our servers so you can read it in the app. That mail is kept for 30 days and then deleted. Apple processes purchases; if ads are shown to free users, ad partners process limited device and usage data — never for PRO subscribers.
This Privacy Policy describes how Polari Group LLC, a New Mexico limited liability company (“Polari Group,” “we,” “us,” or “our”), handles information in connection with Maskbox, our masked-email app for iOS (the “App”). It covers only the App; our website at polarigroup.com and our other products are governed by their own policies.
Maskbox is designed to work without an account. There is no sign-up, no name, and no password. Unlike a note-taking app, though, Maskbox is an email service: its whole purpose is to receive the mail sent to the masked addresses you create, which means we do receive and store that mail so you can read it. This policy explains what that involves and how little else we hold.
No Account, No Identity
Maskbox does not ask for your name, email address, phone number, or a password. When you first open the App it creates an anonymous session on our infrastructure and stores a token for it on your device. That session is what ties your masks to you; it is not linked to your real-world identity, and we make no attempt to determine who you are.
Masks You Create
A “mask” is a masked email address you generate in the App to hand out in place of your real one. We store the masks associated with your session, the domain each uses, when each was created, and whether it is active, paused, or burned, so the App can show your masks and route incoming mail to the right one.
Mail Sent to Your Masks
When someone sends email to one of your masks, we receive it and store it on our servers so you can read it in the App. What we store includes the sender, subject, the message body, any attachments, and any verification code we detect in the message. Because this mail is composed by third parties and sent to addresses you chose to give out, it may contain personal information; we process it for one purpose only — to deliver it to you in the App.
We keep the mail sent to your masks for 30 days, then delete it automatically, including the original raw message. Deleting a mask, deleting the App, or choosing “Delete everything” removes your data sooner. Because there is no account, we cannot restore mail or masks once they are gone.
Our servers that store this mail are operated for us in Canada. Do not use Maskbox as permanent or sole storage for anything important — it is a burner inbox, and it is built to forget.
Verification Codes
Maskbox detects one-time verification codes in incoming mail and surfaces them so you can copy them quickly. A detected code is part of the message it came from, is stored and deleted on the same 30-day schedule as that message, and is never used for any purpose other than showing it to you.
Tracking-Pixel Blocking
By default, Maskbox does not load remote images in the mail you receive, which prevents senders from using an invisible “tracking pixel” to confirm you opened their message or record when and where. You can choose to load images for a given message; until you do, they stay blocked. This happens as part of displaying the message and is a privacy feature, not a form of data collection.
Purchases
Maskbox PRO is processed and verified by Apple through StoreKit, with subscription state managed on our behalf by RevenueCat. We receive the product and transaction status needed to unlock PRO and an anonymous identifier to associate the subscription with your session. We never receive your payment-card number or Apple Account password. Apple’s and RevenueCat’s handling of purchase data is described in their own privacy policies.
Advertising and Consent
Free Maskbox is supported by advertising; a PRO subscription removes all ads. When ads are shown, Google Mobile Ads and mediated partners — Meta Audience Network, Unity Ads, ironSource, and Liftoff (Vungle) — may process advertising identifiers, coarse location, ad and product interactions, advertising data, and diagnostic or performance data for advertising, fraud prevention, and measurement. The content of the mail you receive is never shared with ad partners.
- Where regional privacy law requires it, a consent form is presented before any ad is loaded, and your choice is honored.
- You may be asked for tracking permission through Apple’s App Tracking Transparency prompt; declining never limits the App.
- Maskbox PRO disables Maskbox’s ad requests entirely.
We require service providers that receive data to protect it consistently with this policy and applicable law. You can change tracking permission in iOS Settings at any time.
Age Eligibility
Maskbox is intended for adults age 18 and older. The App is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
Data Retention
Mail sent to your masks, including the original raw message, is retained for 30 days and then deleted. Masks are retained until you burn them, delete the App, or choose “Delete everything.” Apple and RevenueCat retain purchase records under their own policies, and advertising partners apply their own retention rules to the data they process.
Your Privacy Rights
Depending on where you live, you may have rights over your personal information, including the rights to access, correct, or delete it. Because Maskbox has no account and holds no real-world identity for you, the most effective controls are in your hands: burn a mask to delete it, and choose “Delete everything” to erase your session, your masks, and all mail we hold for you.
Residents of California have the rights provided by the California Consumer Privacy Act, as amended, including the right to know, delete, and correct. We do not sell personal information. Residents of the European Economic Area and the United Kingdom have the rights provided by the EU and UK General Data Protection Regulations, including access, erasure, and objection, and the right to lodge a complaint with a data protection authority.
To exercise any of these rights, email legal@polarigroup.com. Because we hold no identifying information, we may be unable to locate data about you beyond what a request made from within the App can identify, and we may need additional information to act on a request.
International Use
Polari Group is based in the United States, and the servers that store the mail your masks receive are located in Canada. If you use the App from elsewhere, information processed in connection with the App, purchases, or advertising may be handled in the United States, Canada, or other countries where our service providers operate, where data-protection laws may differ from those of your own.
Law Enforcement and Legal Requests
We may access, preserve, or disclose information where we believe in good faith that it is required by law or legal process, or is necessary to protect the rights, safety, or property of our users, the public, or Polari Group. We hold no real-world identity for users, so what we can provide is limited to the mask and message data described above, and only for as long as we retain it.
Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the effective date shown at the top of this page. Material changes will be reflected here before they take effect.
Contact Us
If you have questions about this Privacy Policy or Maskbox’s privacy practices, contact us at legal@polarigroup.com or write to us by mail:
Polari Group LLC
6300 Riverside Plaza Ln NW, Ste 118
PMB 418129
Albuquerque, New Mexico 87120-2617
United States