Privacy Policy

Effective 2026-07-03 · Updated 2026-11-12

InboxPolicy is operated by Sorcerai LLC, a Texas limited liability company. In this policy, "we", "us" and "our" mean Sorcerai LLC.

What we process

• Email addresses you submit for verification. We act as a processor: addresses are used to run the verification, cached for up to 72 hours (so your re-verification is free), and retained in request logs for up to 90 days for billing and abuse prevention. They are never sold, shared with third parties for marketing, or used to build lists.
• Account data: your billing email, hashed API keys (we store only a hash, never the raw key), and a credit ledger. If you connect through OAuth, for example from Claude or ChatGPT, your client holds an access token that contains your key in encrypted form; our MCP server decrypts it in memory to serve each request and never stores or logs it. Payments are settled on-chain via the x402 protocol (USDC on Base) — we see only the public payer wallet address, never card numbers or bank details. Card checkout is processed by Stripe — we never see card numbers.
• Dashboard: your API key is stored in your own browser's localStorage only. We never transmit your API key to any analytics service.
• Analytics: we use Google Analytics 4 with IP anonymization to understand which pages and features people use, so we can improve the product. It sets a first-party _ga cookie. We do not send Google the email addresses you verify or your API key — only page views and product events (e.g. which call-to-action was clicked). You can block it with any tracker-blocking extension without affecting the API.
• Session replay: on our public pages we use Microsoft Clarity to see how visitors use the site: what is clicked, how far a page is scrolled, and a replay of the page as it was shown. We use it to find and fix confusing pages. We tell Clarity to set no cookies. It does not load on the dashboard, in a browser where you have saved an API key, or when your browser sends a Global Privacy Control or Do Not Track signal. Anything typed into a field is masked in your browser before it is sent. Microsoft receives this data, including your IP address, and may use it for its own purposes as described in the Microsoft Privacy Statement.
• Server logs: our servers and our network provider, Cloudflare, log each request: the time, your IP address, the path, the response status, the user agent, the name of the app you connected from (for example Claude or ChatGPT), and the first 12 characters of your API key. We use these logs to keep the service running, find errors and stop abuse. They are built to leave out full keys, access tokens and the addresses you check; the verification log keeps only an address's domain. Our own logs are overwritten automatically, usually within a few weeks.

Escalated verifications

When a verification result is unknown, the single address may be submitted to a wholesale verification provider to resolve it. The response evidence discloses when this happened.

Your rights

Request deletion of any address or your account data: hello@inboxpolicy.com. We answer within 30 days. EU/UK data subjects: we support access, rectification, and erasure requests under GDPR.

Infrastructure

Servers are located in the EU (Sweden). Transport is TLS end to end. See our security page for how we protect keys and connections.