Privacy Policy
Last updated: July 19, 2026
1. Who we are
Siftbox is a sole proprietorship registered in Ontario, Canada (“Siftbox”, “we”, “us”). This policy explains what personal information we collect, how we use it, and the choices you have. We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable privacy laws.
2. What we collect
Account information. Your name (optional), your personal email address, and your password (stored only in hashed form by our authentication provider).
Email you receive at your Siftbox address. This is the core of the service: message content, sender, subject, and delivery metadata for email sent to your dedicated @siftbox.ca address. We also store your per-brand preferences (forward, filter by topic, or hold) and a log of how each message was handled.
Billing information. If you subscribe to a paid plan, payment is handled by Stripe. We never see or store your full card details; we keep only your subscription status and billing history references.
Usage data. Product analytics such as pages visited and features used, collected through PostHog and associated with your account. We do not use third-party advertising trackers.
3. How we use your information
- To operate the service: receiving, classifying, holding, and forwarding your email according to your settings.
- To classify messages, which includes automated processing of message content by machine-learning models, including models run by Cloudflare and Anthropic. These providers process content to provide the classification service to us and are not permitted to use it for their own purposes.
- To manage your account, subscription, and support requests.
- To understand product usage and improve the service.
- To send service emails (such as a welcome email or important notices).
- To build aggregated, de-identified insights about brand sending patterns and usage trends across Siftbox accounts, which we may use ourselves or share or sell to brands or other partners. These insights are built from patterns across many users and never include your email content or information that identifies you.
We do not sell your personal information, and we do not use the content of your email for advertising.
4. Service providers
We share personal information only with the service providers we use to run Siftbox:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, and storage |
| Cloudflare | Hosting, email routing, and AI-based classification |
| Anthropic | AI classification of message content |
| Stripe | Payment processing for paid plans |
| PostHog | Product analytics (US-hosted) |
| Resend | Sending service emails (e.g. welcome emails) |
| Logo.dev | Fetching brand logos for display |
Some of these providers store or process data outside Canada, including in the United States. Where that happens, your information is subject to the laws of those jurisdictions. We may also disclose information where required by law.
5. Retention
We keep your account information for as long as your account is active. Held messages are retained for a limited period, as described in the product, after which they may expire and be deleted. When you close your account, we delete your personal information within a reasonable period, except where we must retain records to meet legal or accounting obligations.
6. Security
Data is encrypted in transit and at rest by our infrastructure providers, and access to production systems is restricted. No system is perfectly secure; if we become aware of a breach affecting your personal information, we will notify you as required by law.
7. Your rights
You may access, correct, or delete your personal information. Most of this is available directly in your account settings; for anything else, contact us and we will respond within the timelines required by applicable law. You may also withdraw consent to optional processing, subject to legal or contractual restrictions, and you may complain to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.
8. Children
Siftbox is not directed at children and we do not knowingly collect personal information from anyone under the age of majority without appropriate consent.
9. Changes and contact
We may update this policy from time to time; material changes will be announced by email or in the product before they take effect. Questions or requests can be sent to privacy@siftbox.ca.