Privacy
What happens to an address you send us — and what doesn't.
The short version
- Addresses and domains are processed in memory to produce a response, then discarded.
- Nothing is written to a database, a disk, or a log.
- We never connect to anyone's mail server, so no third party learns you asked.
- We do not sell, share, or transfer anything you send us.
What we actually do with an address
A request to /v1/verify is handled entirely in memory. We parse the address,
extract the domain, and make DNS queries about the domain only — never about the
individual mailbox. The local part (the bit before the @) is compared against a list of
role-account names and never leaves the process. When the response is written, the request
is gone. There is no database in this system to store it in.
Logging
Request logging is switched off at the platform level. Cloudflare's Workers Logs would
otherwise record the full request URL — which for a GET request contains the
address — and retain it for three days. We disabled it for exactly that reason, and there is
no way to redact a single field, so this was the only way to make the guarantee real.
We keep no analytics, no request history, and no per-customer records. Usage metering for billing is done by the marketplace, not by us; we never see who you are.
One thing worth knowing: URLs are not private
If you call GET /v1/verify?email=…, the address sits in the URL. We do not log
it — but URLs are routinely visible to proxies, corporate network monitoring, and anything
else between you and us. That is true of every API that takes a query parameter, and it is
not something we can fix from our side.
If that matters to you, use the POST form instead, which carries the address in the request body where it is covered by TLS and does not appear in any URL:
curl -X POST https://www.mailgrade.dev/v1/verify \
-H 'content-type: application/json' \
-d '{"email":"jane@example.com"}'
Sub-processors
| Cloudflare | Runs the service and terminates TLS. Request logging disabled. |
|---|---|
| Cloudflare / Google public DNS | Answer our DNS queries. They see the domain being looked up, never the full address. |
| RapidAPI | Handles subscriptions, metering and billing. Their privacy terms govern your account with them. |
Free report pages
The public pages on this site audit domains, not people. Domain DNS records are public information. These pages set no cookies and run no analytics or tracking scripts — you can verify that by viewing source.
What this means for your compliance
Because we neither store nor transfer personal data, integrating MailGrade does not normally require a data-processing agreement with us, and there is nothing held here to be the subject of an access or erasure request. We are not lawyers and this is not legal advice — but there is no data on our side for such a request to reach.