Privacy Policy

What We Collect

CoBox collects only the minimum information required to operate the platform:

• Account credentials - Your username and Google account email. If you sign up with a referral code, a username is stored. No plaintext passwords are ever stored.
• Contact information - Your mobile number (optional, encrypted at rest with AES-256-GCM) and stated purpose for using CoBox (encrypted at rest).
• Usage statistics - Counts of emails generated, OTPs retrieved, and API requests made. Used exclusively to enforce plan limits and track usage fairly.
• Account metadata - Your current plan (free/pro/max), plan expiry date, account status, and registration date.
• Session token - A signed JWT stored in a secure HttpOnly cookie to keep you logged in. Expires automatically after 30 days or on logout.
• Google OAuth subject ID - A unique identifier from Google used to associate your Google account with your CoBox profile. We do not receive or store your Google password.

What We Do NOT Collect

• No email body content is persisted to our database.
• No IP address logging for regular usage activity.
• No selling, sharing, or renting of your data to any third party.
• No behavioural advertising or third-party advertising SDKs.
• No tracking cookies beyond our own session cookie.
• No fingerprinting or cross-site tracking.
• No reading or storing the passwords of accounts you save in the Vault - these are encrypted client-to-database with no intermediate plaintext exposure.

How We Use Your Data

The data we collect is used solely to:

• Authenticate you and maintain your session securely
• Enforce your plan limits (account creation caps, polling frequency)
• Process your subscription payment via Razorpay
• Respond to support requests
• Detect and prevent abuse of the platform

We do not use your data for profiling, advertising targeting, or any purpose beyond operating the service.

Data Security

Security is implemented at every layer of the CoBox stack:

• Encrypted connections - All communication is encrypted via HTTPS/TLS. HTTP requests are automatically redirected to HTTPS in production.
• Encrypted sensitive fields - Mobile numbers, purposes, and vault passwords are encrypted with AES-256-GCM before being written to the database. The encryption key lives only in the server environment, never in source code.
• HttpOnly session cookies - Your session token is stored in an HttpOnly, Secure, SameSite=Lax cookie - completely inaccessible to JavaScript, which eliminates XSS-based session theft.
• Server-side Google verification - Google sign-in tokens are verified cryptographically using Google's official google-auth-library. The client-supplied email is never trusted without this verification step.
• Rate limiting - Auth routes are limited to 10 requests per 15 minutes, payment routes to 5 per hour, and OTP routes to 30 per minute, per IP.
• XSS protection - All user-sourced content rendered in the browser is sanitized through DOMPurify before injection into the DOM.
• Security headers - Helmet.js is used to set HSTS, X-Frame-Options, X-Content-Type-Options, and other security headers on every response.
• Payment integrity - Razorpay payment signatures are verified server-side using HMAC-SHA256 with timing-safe comparison. Prices are locked server-side - the frontend cannot alter the amount charged.

Temporary Email Addresses

Disposable email addresses you generate through CoBox are associated with your account and stored in the Vault. Only you can query the inbox for addresses you created - inbox access is gated by an ownership check against your authenticated session.

CoBox does not archive, index, or make searchable any email message content. The generated addresses themselves are stored as vault entries so you can manage them, but the emails received by those addresses are never persisted.

Third-Party Services

CoBox uses the following third-party services, each of which has its own privacy policy:

• Google OAuth - For user authentication. Google processes your sign-in and returns a verified identity token to our server.
• Razorpay - For payment processing. CoBox never receives or stores your card details. Payment data is handled entirely by Razorpay.
• MongoDB Atlas - For database storage of account data. Data is hosted in a secured, access-controlled cluster.
• Google Analytics & Microsoft Clarity - For aggregate usage analytics. These services may collect anonymised page interaction data. No personal account data is shared with them.

Your Rights

You have the following rights over your data:

• Access - You can view all data stored against your account by logging in and visiting your profile.
• Correction - You may update your username, mobile number, and other profile fields at any time.
• Deletion - You may request permanent deletion of your CoBox account and all associated data by emailing support@aiplex.app. All data will be permanently removed within 10 business days of a verified request.
• Portability - Upon request, we will provide an export of your account data in a machine-readable format.

Cookies

CoBox uses exactly one first-party cookie: cobox_token. This is a secure, HttpOnly session cookie used solely to authenticate your requests. It is not a tracking cookie and is not shared with any third party. It expires after 30 days or when you log out.

Third-party analytics scripts (Google Analytics, Microsoft Clarity) may set their own cookies in accordance with their respective privacy policies.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. Continued use of CoBox after changes constitutes your acceptance of the updated policy. For significant changes, we will make reasonable efforts to notify users.

Contact

For privacy-related questions, data requests, or concerns, contact us at support@aiplex.app. We respond to all privacy inquiries within 5 business days.