Privacy policy

In short

• The website sets no cookies, loads nothing from other companies and writes no visitor addresses (IP addresses) to its logs.
• An account needs your name, your email address and a password.
• A mailbox you connect is accessed in full. The service sends and receives warmup emails in it and keeps a copy of the messages in its main folders, including emails that have nothing to do with warmup.
• Your data is not sold and not used for advertising.
• Disconnecting a mailbox or deleting your account removes that data from our systems.

Who is responsible

Reto Odoni
Weststrasse 133
8003 Zürich
Switzerland
Email: info@warmupbay.com

This policy describes how WarmupBay handles personal data. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

Visiting the website

The website runs on a server in Helsinki, Finland. To send you a page, the server has to know the address your request comes from (your IP address). It uses that address to answer and does not write it to its logs.

What the log records for each request: the time, the page asked for, whether it was delivered, the page you came from if your browser tells us, and the name of your browser or program. We keep this log for 12 months and use it to see which pages are read and which search engines call.

• Cookies: the website sets none. The app sets one after you sign in (see below).
• Other companies: the pages load no fonts, scripts, statistics or advertising from anyone else.
• Language: the language you choose is remembered in your browser's own storage. It stays on your device.
• Protection against misuse: to limit repeated sign-in and sign-up attempts, the server keeps the addresses of such attempts in its working memory for up to an hour. They are not saved.

Your account

When you create an account we store your name, your email address, the date, and your password in a form from which it cannot be read back (a salted hash). We use these to sign you in and to write to you about your account, for example with the link for a new password. That link works for 60 minutes.

After you sign in, the app sets one cookie named __Host-wb_session. It keeps you signed in and does nothing else. It expires 30 days after you last used the app, and when you sign out.

A mailbox you connect

This is the part to read before you connect a mailbox. Warmup only works from inside the mailbox, so the access is wide.

What we store

• the address of the mailbox, the sender name and the names of its mail servers
• the app password or mailbox password you enter, in encrypted form
• your settings: daily target, sending hours and where warmup emails are kept
• the numbers of the warmup: emails sent, received and replied to, and where they landed (inbox, tab or spam)

What the service does in the mailbox

• It sends short warmup emails to other participating mailboxes and receives theirs.
• It looks for warmup emails in the inbox and the spam folder, marks them as read, replies to some of them and files them where you chose.

The copy of your messages

To find warmup emails, the service keeps the mailbox in sync with our server. It stores a copy of the messages in the main folders (inbox, sent, spam, trash): sender, recipients, subject, date and text. This covers emails that have nothing to do with warmup, and with them personal data of the people you write with.

These copies are processed automatically and only to run the service. We do not evaluate them, we do not use them for advertising and we do not pass them on. The operator looks at stored data only as far as running the service or clearing a fault requires.

For the content of your mailbox you remain the responsible party. We process it on your behalf. The terms that apply are in the terms of use.

What other participants see

The mailboxes that receive your warmup emails see your email address, your sender name and those emails. So do their email providers, for example Google or Microsoft. Participants and their providers can be anywhere in the world.

Your domain

We look up the public DNS records of your mailbox's domain (SPF, DKIM and DMARC) and show you the result.

Ending the access

When you disconnect a mailbox, its access data, the copies of its messages and its numbers are deleted from our systems. The folder with warmup emails stays in your mailbox until you remove it. To be certain that access has ended, delete the app password at your provider or change the mailbox password.

The badge on your website

If you ask for a badge check, our server fetches the page you name and looks for the badge. We store the address of the page, the result and the time. Your web server sees the address of our server, as with any visitor.

Who else is involved

• Hetzner Online GmbH, Gunzenhausen, Germany, runs the server in its data centre in Helsinki, Finland. All data described here is stored there.
• Cloudflare, Inc., USA, answers the question of which server belongs to warmupbay.com (DNS). The pages themselves and your data do not pass through Cloudflare.
• Email providers: warmup emails travel between your provider and the providers of other participants.

We do not sell data and give it to nobody else, unless a law obliges us to.

Countries

We store data in Finland, a member of the European Union. Switzerland treats the level of data protection there as adequate. Warmup emails can reach providers in other countries, depending on where the other participants have their mailboxes.

How long we keep data

Security

The connection to the website and the app is encrypted. Your account password is stored as a hash, mailbox passwords are stored encrypted, and access to the server is limited to the operator. No system is safe against every attack. If data of yours is affected by an incident, we tell you.

Your rights

You can ask what data we hold about you, have it corrected or deleted, receive it in a common format, and object to how it is used. Write to info@warmupbay.com. Your account and everything attached to it you can delete yourself in the app under “Account”.

You can also complain to a data protection authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of your country.

Legal grounds

Where the GDPR applies, we process account and mailbox data to perform our contract with you (Art. 6(1)(b) GDPR). The log of page requests and the protection against misuse rest on our legitimate interest in running the website securely and knowing which pages are read (Art. 6(1)(f) GDPR).

Changes

When the service changes, this policy changes with it. The date at the top shows the current version. Changes that matter for a connected mailbox we announce in the app or by email before they take effect.