Privacy Policy

What this covers

This policy covers CheckMX’s website, dashboard, email-verification API, background jobs hosted MCP connections, and outreach mailbox connections.

What we process

• Submitted email addresses and verification signals. We use these to check address syntax, DNS mail records, SMTP recipient responses and catch-all behavior. Verification does not send an email message.
• Sign-in information. Google supplies your account identifier, email, name and profile-picture URL for sign-in. A signed session cookie holds your session. We derive a hashed account identifier to associate your jobs, keys and assistant connections with your account.
• Jobs and access records. We store submitted job addresses, progress and results; key names, token hashes, expiry and last-use times; and OAuth client registrations, grants and connection records. We do not store plaintext API keys or OAuth tokens in the access database.
• Connected mailboxes. Separately from sign-in, you can authorize Google or Microsoft mailbox access. We encrypt access and refresh tokens on the server and store the mailbox address, provider identity hash and connection status. Google mailbox access is described below.
• Operational metadata. IP addresses and request metadata may be processed by hosting infrastructure and rate limits. OAuth registration limits use a hashed transport IP. We keep aggregate verification counts and timing measurements to operate the service.

Google user data

When you connect Google, openid and email identify your account and email address. gmail.readonly accesses Gmail messages, including reply content, headers and mailbox metadata, to read replies in your inbox and smart inbox. When sending is enabled, gmail.send sends your campaigns; when warmup is enabled, gmail.modify reads and updates messages and labels for warmup. We use this data only to provide these user-facing features.

We do not sell Google user data, use it for advertising, or use it to train generalized AI models. Humans do not read it except with your consent, for security purposes, or as required by law. When you request an AI reply draft, the relevant email content is sent to an AI provider with zero data retention only to produce your draft.

CheckMX's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

OAuth tokens are encrypted and deleted when you disconnect or delete a mailbox. You can also revoke access at Google Account permissions. For support or data deletion, contact hello@checkmx.dev; we handle deletion requests within 30 days.

Where requests go

Requests pass through CheckMX’s website gateway to our verification service. We use Vercel for the website and API gateway, Hetzner for verification and persistent outreach storage, Google for sign-in and authorized Gmail mailbox features, Microsoft for authorized Microsoft mailbox checks, and, only if you accept analytics in the signed-in app, PostHog Inc. (PostHog Cloud US) for product analytics and session recordings. DNS resolution and SMTP recipient checks contact the destination domain’s DNS and mail infrastructure, which receives the information needed for those checks.

When you use an assistant connector, the assistant sends the tool arguments to CheckMX and receives the tool’s verification result. Your use of that assistant is also governed by its own privacy policy. Connecting CheckMX does not give us independent access to your conversation history.

Delivery outcomes

When you send outreach through CheckMX, we send each send’s delivery outcome (delivered, bounced, replied, or complaint) to our own verification service. It stores only a one-way hash of the address, the outcome and the date, and uses them to improve email checks. We don’t store names or build contact lists from your sends. These records are retained up to 365 days.

Retention and browser storage

• Background jobs: addresses and results remain while a job is active, then are eligible for cleanup seven days after completion or cancellation.
• Outreach drafts and setup: campaign content, recipient lists, imported contact fields, suppression lists, domain settings, and warmup settings are kept in your private workspace until removed through a support request. Connected-mailbox conversations are kept until deleted or the mailbox is deleted.
• Check history: the addresses you verify, their results, and your CSV jobs are shown in your dashboard for up to 90 days, then deleted automatically. Older history recorded under the previous seven-day policy keeps its original expiry. History is stored encrypted and tied to your account; you can delete individual checks or clear your history at any time.
• Verification caches: address results and domain behavior are retained for seven days. Expired entries are removed during cache activity. Temporary-failure addresses remain in the retry queue until the check completes or retries are exhausted.
• Mailbox connections: encrypted credentials remain until disconnected, deleted, or removed through support. Disconnect deletes active credentials and cancels pending connection requests. Delete also revokes a Google refresh token when the connection is Google, pauses campaigns that used the mailbox, and removes CheckMX’s copied conversations for that mailbox. Inbox conversation delete removes only CheckMX’s copy and keeps a tombstone so later sync does not reimport it. Neither action deletes mail in your real inbox. Provider authorization may remain until you revoke it in your Google or Microsoft account. Consent requests expire after ten minutes and are eligible for cleanup after fifteen minutes during connection activity. Daily database snapshots retain seven local copies; backup copies can outlive active credentials.
• API keys and assistant connections: API keys expire after one year; OAuth access tokens after one hour; rotating refresh tokens after 30 days. Expired or revoked credential records become eligible for cleanup after a further 30 days. OAuth client registration metadata remains to support registered connections. Authorization codes expire after five minutes.
• Rate limits: registration counters are removed during later activity after their retained hourly windows; their cleanup horizon is 24 hours. Per-credential request limits use minute windows, with older counters cleaned up during later requests.
• Your browser: the dashboard saves timestamps and verdict categories, a background-job reference, and display preferences in local storage. Submitted addresses in the Recent Checks display are held in the tab’s memory. Newly created API keys are shown once and are not saved by CheckMX to browser local storage.

Expiry prevents further use of a record; cleanup is activity-driven and is not a guarantee of immediate physical erasure from database files or backups. Hosting logs and backup copies are separate from active records. Contact us for the applicable retention details; deletion requests are handled within 30 days.

Cookies and your choices

The checkmx_session cookie keeps you signed in for up to seven days. Signing out clears the browser’s session cookie. CheckMX does not set advertising cookies or run visitor ad pixels. Google and connected assistant services operate their own sign-in systems.

Product analytics and session recordings

Inside the signed-in dashboard only, and only after you choose Accept on the analytics notice, we use PostHog (PostHog Inc., PostHog Cloud US) to see how the app is used so we can improve it. PostHog is never loaded on this website’s public pages or the sign-in page, and nothing is sent to PostHog before you accept or if you decline.

• What is collected: pages viewed (paths without query strings), clicks, session recordings, device and browser information, and an internal account or workspace identifier. We do not send your email address or name to PostHog.
• What is hidden: session recordings mask all form inputs and all on-screen text, and areas that show email addresses, contacts or message content are blocked from recording and click capture. Recordings therefore show layout and interaction, not your contacts or messages. We also drop any analytics value that looks like an email address.
• Your choice: your choice is saved in this browser’s local storage under checkmx_analytics_consent. Change it any time from Analytics & recordings in the account menu at the bottom of the dashboard sidebar; choosing Decline stops capture and clears PostHog’s identifiers in this browser. If your browser sends Do Not Track, PostHog capture stays off.
• Retention: PostHog retains the data for the default period of our PostHog plan, after which it is deleted automatically. Ask us at hello@checkmx.dev to delete data tied to your workspace identifier.

• Revoke a key or disconnect an assistant from API Keys. Disconnection invalidates that connection’s access and refresh credentials.
• Delete a connected mailbox or a copied inbox conversation from Outreach. That removes CheckMX’s stored tokens and copies only. Mail in your provider inbox stays unless you delete it there.
• Cancel a submitted background job from the dashboard. An already-running SMTP check may finish, but it cannot append results to a cancelled job.
• Change or withdraw the analytics choice from Analytics & recordings in the dashboard account menu.
• Clear this site’s browser storage to remove saved dashboard history, preferences and job references. This does not delete server-side jobs.
• Contact hello@checkmx.dev about access, correction, deletion or retention of your data.

What we do not do

We do not sell submitted email lists, share them with advertisers, use them to build a marketing list, or send messages to the people behind the addresses as part of verification.

Changes

We update the date on this page when our handling of data changes. Questions can be sent to hello@checkmx.dev.