Privacy Policy — FCMailX

This Privacy Policy describes how FCMailX ("FCMailX", "we", "us") handles information when you use the FCMailX platform hosted at your configured domain (for example https://fcmailx.com and mail.fcmailx.com).

Who operates the service

FCMailX is a self-hosted application deployed on infrastructure you control (typically a VPS managed through Coolify or similar). We provide the software; your instance stores operational data in the database attached to that deployment.

Information we process

Account data: Email addresses allowed to sign in (FOUNDER_EMAILS), password hashes, and session tokens for admin access.
Domain and connection data: Sending domains you add, verification status, DNS record instructions, SaaS connection names, and metadata for generated SMTP users and API keys.
Send logs: Recipient addresses, subjects, delivery status, timestamps, and related message metadata required to troubleshoot delivery.
Billing data: If you subscribe, payment processing is handled by Stripe. We store subscription identifiers and plan status, not full card numbers.

Third-party processors

Outbound email delivery uses Resend when you configure a Resend API key. Message content and recipient addresses needed for delivery are transmitted to Resend according to their privacy policy. Optional inbound mailbox features may use Mailcow when enabled on your instance.

How we use information

Operate the platform, verify domains, route transactional email, and display send logs.
Authenticate founders and protect admin endpoints.
Process subscriptions and communicate about billing when applicable.
Improve reliability and security of the service.

Data retention

Send logs and connection metadata are retained in your instance database until you delete them or remove the deployment. You can export or delete data by managing your database and application directly on your server.

Security

Credentials are stored using industry-standard hashing and encryption practices within the application. Secrets such as API keys for connected SaaS apps should remain in environment variables on each application, not in source control.

Your choices

You control which domains and applications connect to your instance. You may stop using the service by disconnecting apps and decommissioning the deployment. For privacy questions, contact support@fcmailx.com.

Changes

We may update this policy as the product evolves. The effective date at the top of this page will change when we do.