Privacy and Security Policy
Last updated: October 25, 2026. This English page describes the same service as the Turkish policy. If you have a privacy or security concern, contact us directly.
Data controller and contact
Data controller: Datakobi Bilişim Teknoloji. For privacy requests and data subject inquiries, email iletisim@gecici.email. We may need to verify that the requester is associated with the relevant inbox or data before responding.
1. Data we process
The service processes inbox addresses, access tokens, and the sender, subject, content, and extracted summaries of received emails. Email content may contain personal or sensitive information. We do not make an unverified “zero logs” guarantee about hosting, security, or access records.
2. Retention and deletion
The web API stores inboxes and messages in a server-side SQLite database. The default inbox lifetime is 60 minutes. An authorized user can extend the lifetime or delete the inbox. Expired records are logically deleted during API requests. We do not guarantee irreversible physical erasure from SQLite disk pages, server backups, or infrastructure logs.
3. HTML email safety
HTML in incoming email is untrusted content. Sandboxed display in the web interface offers protection, but you should not open unknown links or use temporary inboxes for sensitive accounts.
4. Receive-only inbox and access tokens
The service is intended to receive email; it does not provide a user-facing outbound email feature. Access to an inbox requires the token issued when that inbox was created. If you lose the token, you cannot reopen the inbox. Anyone you share the token with may read its contents. This is not an account system or end-to-end encryption.
5. Chrome extension
The Chrome extension uses the same gecici.email service. Before first use, it explains this data processing and asks you to create an inbox. The extension keeps the active inbox address, access token, expiry, and last-seen message count in browser session storage; the acknowledgement choice is stored locally. Session data is cleared when the browser restarts. The extension checks for new mail while its popup is open and can check in the background to show a new-message badge or notification. It does not place the message body or verification code in the notification. A user-triggered context-menu action may insert the temporary address into a form field on the current page. The extension does not use analytics or advertising trackers, but that does not mean the email service processes no personal data.
6. Contact
For product support, security reports, and privacy requests, email iletisim@gecici.email.
API and MCP operation counts
The server aggregates fixed operation and tool names, self-declared distribution channels, result categories and duration ranges by UTC day. These counters contain no IP addresses, inbox addresses, tokens, email content or verification codes. Success, empty results and timeouts are separate; inbox polling is excluded and test calls are separated. Daily totals are retained for 90 days and removed on a subsequent measurement write; backup retention is separate. Counts are not unique people or verified AI identities.
Website usage measurement
The website uses Google Analytics 4 to measure page visits and fixed inbox actions such as creation, copying an address, and extension requests. The analytics bootstrap excludes inbox addresses, access tokens, message content, verification codes, URL queries and fragments. Referrer URLs are reduced to their origin. Analytics may use browser cookies; advertising personalization and Google signals are disabled in this configuration. Automated API and MCP requests do not execute this browser tag and are measured separately from web visits.