Cookies
Summary. One strictly necessary session cookie when you are logged in. No tracking, analytics or advertising cookies. No third-party cookies. Because none of it is optional and none of it tracks you, there is no cookie banner.
1. Cookies we set
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
mp_session | Keeps you logged in to the web app. Contains a random token that maps to a session held in server memory. It carries no personal data and is not usable for tracking. | Strictly necessary, first-party, HttpOnly, Secure, SameSite=Strict | Session; expires after 12 hours of inactivity or when you log out. Server sessions vanish on restart. |
2. Browser storage
The web app stores your theme preference (light or dark) in your browser's local storage. Nothing else is stored in the browser: no keys, no password, no cached mail. Closing the tab removes all decrypted material from memory.
3. What we do not use
- No analytics (no Google Analytics, Matomo, Plausible or similar).
- No advertising or social-media pixels.
- No third-party fonts, scripts, or content delivery networks. Every asset is served from envelt.com.
- No fingerprinting.
4. Mail-app access
IMAP and SMTP connections do not use cookies. They authenticate with your password on each connection.
5. Managing cookies
You can delete the session cookie in your browser at any time; you will simply be logged out. Blocking it makes the web app unusable, as there is no other way to hold a login.