Privacy

In short

• We keep your mail to show it to you, and for nothing else.
• No ads, no selling, no training models on your mail.
• A model at OpenAI reads new mail to sort it and to catch scams. You can turn that off in Settings.
• Trackers in mail are removed, and images come through our server only when you ask.
• You can have all your mail exported, and your account deleted, on any plan.

Who we are

Corvo is run by CODENAV LTD, a company registered in England and Wales (number 16998604), at 71–75 Shelton Street, London WC2H 9JQ, England. We are the controller of the personal data described here, and we are registered with the Information Commissioner's Office (reference ZC156578). Write to us at support@codenav.dev about anything on this page.

What we keep

• Your account: your account email, display name, a hash of your password (never the password), your second-step methods and passkeys.
• Your mail: every message you receive and send, exactly as it arrived, and what we derive from it to show it: the text, threads, a verification code if there is one. The people you write to and who write to you are part of it.
• Your addresses and rules: the addresses, tags and notes you create, and where you asked their mail to go.
• Sessions: for each browser or app you sign in on, its name, the IP address and when it was last used, so you can see and end them.
• Delivery records: whether mail you sent was delivered, bounced or marked as spam, to protect delivery for everyone.
• Signing up: the address you signed up with, the name you asked for, the site's language, the one word naming where our link to you was posted if it carried one (such as x in ?utm_source=x, or the ?ref= word a site such as Product Hunt adds), and a one-way hash of your IP address to limit abuse. If you sign up with CodeNav, CodeNav Account tells us your CodeNav user id and email, which become your account email and the link between the two. People who joined the waitlist before sign-up opened, and asked for letters when something ships, still get them; every letter has a link to stop them.
• Payments, once payment opens: your plan, when it renews or ends, and the record of each payment. Card details go to Stripe and never reach us.

What we do with it

We use your data to run your mailbox: to receive, store, show, search and send your mail, to recognise codes and remove trackers, to keep your account secure and to tell you when something changes on it. Automated checks on arriving mail (spam, sender verification) run for that purpose only. We do not sell your data or use it for advertising.

Sorting with a model. When a message arrives in your inbox, a model run by OpenAI reads it to decide which view it belongs in (People, Updates or Promotions) and whether it is a scam, phishing or spam. It is sent the sender's name and address, the subject, the first 6,000 characters of the text, the names of attachments and the addresses its links lead to; never images, attachments themselves or your other mail. OpenAI does not use what it is sent to train its models and does not keep it for its own purposes; it may hold it for up to 30 days to detect abuse of its service, then deletes it. The first time any sender's domain is seen, its name alone (such as example.com) is also sent, to learn what kind of organization it is. The same reading may notice a booking or a plan with a day and a time, which then waits on your calendar until you keep or dismiss it; nothing more is sent for it, and Suggest events from mail turns it off on its own. You can turn sorting with a model off in Settings → Privacy; from then on rules alone sort your new mail and none of it is sent to OpenAI.

Why we may

• To provide the service you asked for (a contract with you): your account, your mail, your addresses, sessions and payments.
• Our legitimate interests in keeping the service safe and mail deliverable: spam and sender checks, sorting and scam detection by a model, delivery records, limits on sending, the sign-up form's IP hash and the check that a form is used by a person.
• The law: keeping payment records for tax, and answering lawful requests.

Who can read your mail

Mail is encrypted when it is stored and on its way between our servers, but it is not end-to-end encrypted: the operator of Corvo could technically read stored mail, as with most providers. We do not look at anyone's mail except when you ask us to (for example, to find out why a message went missing), or when the law requires it, and we will tell you unless the law forbids it. Agents you connect can read only what their grant allows, and every action they take is recorded where you can see it.

Who else is involved

These companies process data for us, only to provide their service to us:

• Oracle Cloud hosts our servers and database.
• Cloudflare stores the original copies of messages and attachments, carries traffic to this site, and checks that the sign-up form is used by a person.
• Amazon Web Services (Simple Email Service) carries the mail you send to its recipients.
• Alibaba Cloud (Direct Mail) delivers the mail we send you ourselves: sign-in links, invitations and notices. It sees your account email and that message, never your mail.
• OpenAI runs the model that sorts new mail and catches scams, unless you turn it off (see above).
• Apple delivers notifications to the iPhone app. A notification carries no sender or subject through Apple; the app fetches them itself.
• Stripe takes card payments, once payment opens. If you pay from your CodeNav Wallet instead, the payment is made in CodeNav Account, which we also run.

We may also disclose data when the law requires it, or to protect people from fraud or harm.

Where it is kept

Mail and account data are kept on our servers at Oracle Cloud in Japan, and the original copy of each message in Cloudflare R2. Mail you send leaves through Amazon's service in Singapore; the mail we send you ourselves leaves through Alibaba Cloud's service in mainland China. Mail read by the sorting model is processed by OpenAI in the United States. Both storage providers encrypt what they store. Where data leaves the United Kingdom, it goes to a country the UK recognises as protecting it adequately (Japan is one), or under the UK's approved contract terms for international transfers.

Cookies

One cookie keeps you signed in. While a tab is open, it remembers the word naming where the link you followed was posted, so the sign-up form can send it; nothing else reads it, and it is gone when you close the tab. There are no analytics, advertising or tracking cookies, and this site loads nothing from other companies, except Cloudflare's check on the sign-up form, which looks at signals from your browser to tell people from automated tools.

How long we keep it

• Mail stays until you delete it.
• Mail in the Trash is deleted for good 30 days after it was moved there, with its attachments; until then you can restore it.
• A sign-up whose link was never used is deleted when the link expires, after 14 days; a sign-up with CodeNav that was not finished, after 30 minutes.
• When you close your account in Settings, your mail and account data are deleted 30 days later; until then you can download them or change your mind. Your addresses refuse mail from the moment you close it, and nobody else can take them until 30 days after the deletion.
• Database backups are kept for up to 8 weeks, so deleted data leaves them within that time.
• The record of security events on your account is kept for 400 days, and payment records for as long as UK tax law requires (currently six years).
• Server logs never contain mail; they are kept only as long as running the service needs.

Your rights

You can ask to see, correct, export or delete your data, to restrict how we use it, or object to a use based on our legitimate interests, and to have your mail exported or your account closed. Much of it you can do yourself in Settings: change your details, end sessions, download everything and close your account. For anything else, write to support@codenav.dev from your account email, and we will do it within one month. If you think we have handled your data wrongly, you can complain to the Information Commissioner's Office at ico.org.uk, though we would like the chance to put it right first.

Children

Corvo is not for children under 13, and we do not knowingly keep their data.

Changes

When this page changes in a way that matters, we tell you by email. A change you can turn off may take effect the day we write, and the email says where to turn it off; a change you cannot turn off, we tell you about before it takes effect. The date at the top says when it last changed.