Last updated: March 2026
PicaMail exists to protect your privacy. We built this service because we believe you should be able to give out an email address without worrying about spam, data breaches, or tracking. Our business model is simple: we charge for premium features, not for your data.
We do not sell your data. We do not show ads. We do not use analytics trackers. We collect the absolute minimum data needed to run the service.
Payment processing is handled entirely by Stripe. PicaMail never sees or stores your full credit card number. We receive only:
This is the most important section.
By default, if an email fails to forward (for example, because your inbox is full), PicaMail discards the email and increments a "failed" counter on the alias.
If you enable the Store Failed Deliveries option in your account settings, PicaMail will temporarily store the content of failed emails so you can retry delivery or view them in the dashboard. Failed delivery data is encrypted at rest and automatically deleted after 7 days. You can manually delete it at any time.
This feature is opt-in and disabled by default.
PicaMail uses only essential cookies:
| Cookie | Purpose | Duration |
|---|---|---|
| session | Keeps you logged in | Until you log out or 30 days |
| theme | Remembers your dark/light mode preference | 1 year |
We do not use advertising cookies, tracking cookies, or any third-party cookies. There is no cookie banner because there is nothing to consent to beyond essentials.
Your account data and alias metadata are stored on encrypted servers in the European Union. All data is encrypted at rest using AES-256 and in transit using TLS 1.3.
Access to production systems is restricted to a minimal number of authorized personnel with multi-factor authentication. We perform regular security audits and penetration testing.
PicaMail is fully committed to GDPR compliance. As a user, you have the following rights:
You can view all data PicaMail holds about you at any time through your account dashboard. You can also request a machine-readable export of your data.
You can export all your data (aliases, metadata, settings) as a JSON file from your account settings at any time, without needing to contact support.
You can delete your account at any time from your account settings. When you delete your account:
Account deletion is immediate and irreversible. There is no "soft delete" or recovery period.
You can update your email address and account details through the dashboard at any time.
You can deactivate all aliases at any time, which stops all email forwarding while preserving your account and alias configuration.
We do not share your data with any third party for marketing, advertising, analytics, or any other purpose.
The only third parties that interact with your data are:
We will disclose data only if legally compelled by a valid court order, and we will notify you unless legally prohibited from doing so.
PicaMail is not directed at children under 16. We do not knowingly collect data from children. If we learn that we have collected data from a child under 16, we will delete it immediately.
When we make changes to this privacy policy, we will notify you via the email address associated with your account at least 14 days before the changes take effect. We will also update the "Last updated" date at the top of this page.
Previous versions of this policy are available upon request.
If you have privacy-related questions or concerns, you can contact our Data Protection Officer:
We aim to respond to all privacy inquiries within 48 hours.
For general privacy questions or to exercise your rights, contact us at:
Effective date: March 2026