Privacy Policy

Who this covers

Dravox is a desktop email client for Linux and a license server running at dravox.tech. This policy covers both, plus the website you're reading. All three are run by Dravox from Nova Scotia, Canada, and that's the party responsible for the personal information described here.

It does not cover Microsoft Outlook or Microsoft 365. Those are Microsoft's services, governed by Microsoft's own terms and privacy statement, and your relationship with Microsoft is your own.

What the app sends

Dravox makes exactly one kind of request to our servers: a license check, asking whether the account you're signed into is entitled to run the app. Your email address itself never leaves your machine. What travels is a one-way hash of it, which we can match against a license but can't read back as an address.

The check carries no device ID, no machine fingerprint, no app version, no operating system details, and no usage analytics. It runs about once an hour while you're signed in, more often in the week before a renewal date, and not at all when no account is signed in. As with any request over the internet, your IP address is visible to the server that answers it.

What the license server stores

• The email hash, and the license status, plan, and expiry date attached to it.
• When the record was created and last updated, when it was last checked, and a running count of checks. That's how we tell an active install from an abandoned one.
• A short event log for each hash, recording things like a trial being granted, a license being renewed, or a record being revoked.
• Your plaintext email address, and an internal note, but only on records created by an actual purchase. We need those to invoice you and to answer support mail. The check the running app makes never creates or reads them.
• Rate-limit counters keyed by IP address and by email hash. Each counter expires within an hour and is overwritten by the next one.

A hash can't be turned back into an address. It can still be matched by anyone who already knows the address to test, so we treat it as personal information rather than as anonymous data.

This website

The marketing pages are static files. We set no cookies, run no analytics, embed no advertising or social widgets, and do no device fingerprinting. There's nothing to opt out of because there's nothing collecting.

Two things sit between you and the pages, and both see your IP address. The site runs behind Cloudflare, which serves and protects it and keeps its own request logs. Pages also load a web font from Google Fonts, so your browser fetches that file from Google and Google sees the request. Our own server keeps ordinary web server logs of requests it answers.

Email you send us

Mail to [email protected], [email protected], or [email protected] reaches a mailbox we host with an email provider. We keep those messages for as long as we need them to handle the request and to keep a record of purchases and support history. Please don't send us passwords or account credentials. We'll never ask for them.

Remote images and tracking pixels

Most email tracking works through a remote image: a pixel that loads silently the moment you open a message and tells the sender you read it. Dravox blocks remote images by default for anyone you haven't engaged with. Senders you've actually corresponded with load images normally. Everyone else stays blocked until you decide they've earned it. Your read receipts stay yours until you hand them out on purpose.

This is a defense, not a guarantee. Senders invent new tracking methods, and blocking happens in the app on your machine, so what it catches depends on the version you're running.

Your mail and your Microsoft account

Your mail lives with Microsoft. Dravox is a client, not a middleman: messages, contacts, calendars, and attachments move between your machine and Microsoft's servers, never through ours. We have no copy, no access, and no way to read, recover, or restore any of it.

Your synced mail and your Outlook credentials are stored on your own device. That data is in your custody. If your machine is lost, stolen, wiped, or compromised, that's between you, Microsoft, and your backups.

Why we hold any of it

The hash and the license record exist so the app can answer one question: is this address entitled to run. The counters exist to stop someone hammering the check endpoint. Purchase records exist because we have to invoice you and keep books. If you're in a place with a law that asks us to name a legal basis, those are, in order: performing our contract with you, our legitimate interest in keeping the service up, and complying with tax and accounting obligations.

How long we keep it

• Rate-limit counters: under an hour.
• License records and their event log: while the license or trial exists, and afterwards while the record is still useful for support or abuse prevention.
• Purchase and invoice records: as long as tax and accounting law requires us to keep them, which is usually several years and is not something we can shorten on request.
• Support email: while it's useful, then deleted in the ordinary course.
• Cloudflare and web server logs: short-lived, and rolled over automatically.

Who else touches it

We don't sell your information, rent it, trade it, or hand it to advertisers. There are no ad networks and no data brokers involved in any part of this.

A handful of suppliers process data on our behalf because they run the infrastructure: the hosting provider for the server, Cloudflare for delivery and protection, our email provider, and a payment provider once self-serve checkout exists. They're processed in Canada and in whatever countries those providers operate in. Beyond that, we'd disclose information only if a valid legal order required it, or to protect our rights, or to a buyer as part of a sale or transfer of the business, in which case this policy follows the data.

Your choices and rights

Depending on where you live, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. Email [email protected] and we'll deal with it within a reasonable time and at no cost.

One practical note. License records are keyed by hash, so we can't look you up from a name or from a different address. Write from the address you use with Dravox, or tell us what it is, and we can hash it and find the record. Without that, there's nothing we can match you to.

If you think we've handled your information badly, tell us first and we'll try to fix it. You can also complain to your local privacy regulator, which in Canada is the Office of the Privacy Commissioner.

Security

We keep the surface small on purpose: one endpoint, hash-only lookups, no plaintext addresses on records the app can reach, admin operations behind a separate token, and TLS in front of all of it.

No system is perfectly secure, and we don't claim ours is. We can't guarantee that data transmitted to or stored by us will never be intercepted, lost, or accessed without authorization, and we give no warranty to that effect. Securing your own machine, your disk encryption, and your Microsoft credentials is your responsibility, not ours.

Children

Dravox isn't built for or directed at children under 16, and we don't knowingly collect anything from them. If you believe a child has given us information, email us and we'll delete it.

Changes to this policy

We'll update this page when what we do changes, and the date at the top will tell you when. If a change is significant, we'll say so here rather than quietly editing a sentence. Using Dravox after a change means you accept the current version.

Contact

Privacy questions go to [email protected]. Anything about billing or the software itself is better sent to [email protected]. See also our Terms of Service.