Privacy policy

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is

Further details are in the legal notice.

Website fabulous-email.com

Hosting

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit it, Vercel processes technically necessary access data such as your IP address, the time of access and the page requested. The legal basis is our legitimate interest in providing the website securely and efficiently (Art. 6(1)(f) GDPR). Transfers to the USA are based on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

Server log files

The hosting provider automatically stores information your browser transmits: browser type and version, operating system, referrer URL, host name of the accessing computer, time of the request and IP address. This data is not combined with other data sources and is used for technical provision and security (Art. 6(1)(f) GDPR).

Fonts

The “Inter” font is loaded locally from our own server. No connections are made to third-party servers such as Google Fonts.

Cookies and local storage

The website sets no cookies. In your browser’s local storage (localStorage) we only store your choice in the privacy settings and, if you change it yourself, your preferred language, so we don’t ask you again on every visit. This is technically necessary (§ 25(2) no. 2 TDDDG).

Audience measurement with FABULOUS ANALYTICS (only with consent)

If you agree in the privacy settings, we use FABULOUS ANALYTICS (app.fabulous-analytics.com), a service of the FABULOUS group of companies, Conventstraße 15, 22089 Hamburg, Germany, to count anonymously how our website is used. Without your consent, the analytics script is not loaded.

The following is transmitted: the page visited, the referring page (referrer), campaign parameters in the address (e.g. utm_source), your browser’s time zone and language, the screen width, time on page and scroll depth, and a random identifier for the individual page view. Browser and device type are derived from your browser’s user agent; the user agent itself is not stored. FABULOUS ANALYTICS sets no cookies, stores nothing on your device, stores no IP addresses, uses no fingerprinting and does not recognise you across visits or websites. Your IP address is only processed briefly for the technical transmission.

The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future by opening “Privacy settings” at the bottom of the page and choosing “Decline”. The statistics collected contain no data that identifies you.

FABULOUS EMAIL service

FABULOUS EMAIL is an email client: you connect your existing mailboxes (e.g. at IONOS, Namecheap or Google Workspace) and read and write your emails through our interface. Unless stated otherwise, processing the following data is necessary to provide the service (Art. 6(1)(b) GDPR).

Hosting of the service

The web app and the interface for the apps run on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, which acts on our behalf (Art. 28 GDPR). Server log files are created on access as described above.

Your account

When you register, we store your name, your email address and your password. The password is only stored as a cryptographic hash, never in plain text. We also store your settings (e.g. language, design, swipe mode directions) as well as the time of registration and of your last sign-in. The service is intended for people aged 16 and over.

When you accept our terms, we store the version of the terms and the time of your acceptance so we can prove which version you agreed to (Art. 6(1)(b) and (f) GDPR).

If an account violates our terms or misuse is suspected, we may suspend it. For this we store a suspension note with time and reason (Art. 6(1)(f) GDPR, legitimate interest in secure and lawful operation).

Connected mailboxes

For each mailbox we store the server settings (IMAP and SMTP), the user name and the password. Passwords are stored encrypted and only decrypted to connect to your mail server. We also store your signature and sender name.

Your emails stay on your provider’s mail server. We load them directly from there when you view them and do not permanently store their content on our servers. Sent emails and drafts are saved to the corresponding folders of your mailbox.

To suggest recipients while you write, we store the addresses and names of people you have emailed through FABULOUS EMAIL.

Images and links in emails

We block images that emails load from external servers by default, because senders could use them to see when you open an email. If you load them with “Load images” or via the corresponding setting, your browser or app fetches them directly from the sender’s server, which receives your IP address and technical information about your device. The same applies when you open links in emails or unsubscribe from a newsletter. The respective sender is responsible for this processing.

Company logos

To show the logo of company senders, our server requests the icon of the sender’s domain (e.g. “company.com”) from Google LLC’s favicon service or directly from the respective website. Only the domain name is transmitted, no data about you and not your IP address. No request is made for addresses of large email providers such as Gmail or Outlook. Logos are cached for up to 30 days. The legal basis is our legitimate interest in a clear presentation (Art. 6(1)(f) GDPR).

Sign-in and security

For sign-in, the web app sets a session cookie and, to keep you signed in, a login cookie valid for 90 days. In the apps, a login token is stored in your device’s protected storage (Keychain or Keystore). These cookies and tokens are technically necessary (§ 25(2) no. 2 TDDDG). On our server we only store them as a hash. Beyond that, the web app and the apps set no cookies and use no analytics or tracking services, so no consent is required for them.

If you enable two-factor authentication, we store the secret key encrypted and your recovery codes as a hash.

To protect against attacks, we count failed sign-in attempts per IP address and email address. These entries are deleted after 24 hours at the latest. For security-relevant changes to your account (e.g. password changed) we send you an email containing the time and IP address of the change. The legal basis is our legitimate interest in the security of the service (Art. 6(1)(f) GDPR).

System emails

We send emails to confirm your address, reset your password and security notices via the Postmark service of ActiveCampaign, LLC, USA. Your email address, your name and the content of the respective message are transmitted. Transfers to the USA are based on the EU-US Data Privacy Framework or standard contractual clauses.

AI assistant (optional)

You only use the AI assistant if you add your own API key from OpenAI (OpenAI, L.L.C., USA) or Anthropic (Anthropic PBC, USA) in the settings. The key is stored encrypted. Only when you explicitly choose “Reply with AI” or “Write with AI” do we transmit the content of the email or your draft and your instruction to the chosen provider. Processing there takes place under your own agreement with that provider and its privacy policy. The legal basis is your consent through deliberate use (Art. 6(1)(a) GDPR), which you can withdraw at any time by removing the key.

Apps for iPhone and Android

The apps are distributed via Apple Inc.’s App Store and Google LLC’s Google Play. Their privacy policies apply to download and installation. The apps contain no advertising, analytics or tracking services.

So that improvements arrive without a new download, the app checks Expo (650 Industries, Inc., USA) for updates when it starts. Your IP address and technical information about the app version and platform are transmitted. The legal basis is our legitimate interest in an up-to-date and secure app (Art. 6(1)(f) GDPR). Transfers to the USA are based on standard contractual clauses.

Files such as attachments are only saved to or shared from your device when you choose to.

Recipients and third countries

We do not pass your data on to third parties and do not sell it. Recipients are only the service providers named above who act on our behalf, the mail servers of your own mailboxes and, if you use it, the AI provider you choose. For service providers in the USA (Vercel, Postmark, Expo and optionally OpenAI or Anthropic), transfers are based on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

Retention

We store your account data, mailbox credentials, contacts and settings for as long as your account exists. You can delete your account at any time in the settings under “Account & security”. All associated data is then deleted from our systems immediately. Your emails on your providers’ servers are not affected. Server log files are deleted automatically after a short time, entries used to limit sign-in attempts after 24 hours at the latest.

Obligation to provide data and automated decisions

We need the information you provide when registering and your mailbox credentials to provide the service. Without them, the service cannot be used. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Your rights

Under the GDPR you have the following rights:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR), e.g. for FABULOUS ANALYTICS via “Privacy settings”

An informal message to hello@fabulous-code.com is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.

SSL/TLS encryption

The website, web app and apps only transmit data encrypted. We connect to your mail servers encrypted by default (SSL/TLS or STARTTLS). If you choose an unencrypted connection in manual server settings, the transfer to your mail server is unencrypted.

Changes

We update this privacy policy when our service or the legal requirements change. The version published here applies.

Last updated: 6 November 2026