Security

What this site holds, what it never keeps, and how to tell us about a problem.

One key to the hub

The warm-up network runs on the operator's hub. This site holds one secret: its own key to the hub. It holds no database password, no email-sending key and no Google account.

Your app password

Your mailbox's app password passes through one request, from your browser to the hub. This site never logs it, never stores it, never shows it back to you, and does not keep it after that request.

On the hub the password is sealed (encrypted) at rest, and used only to sign in to your mailbox for the network's letters. When you disconnect a mailbox, the hub erases its app password. You can also revoke the app password at your mail provider at any time.

This site has no password of its own. To sign in, you ask for a 6-digit code at your work address.

A code works for 10 minutes and for 5 tries.
One address can ask for 5 codes an hour, and one internet address for 20.
After 20 wrong codes in one day, the address is refused until the next day (UTC).
We store only a one-way hash of each code, never the code itself.
Your session is a signed cookie that lasts 30 days. Signing out ends your sessions on every device within a minute.

What we log, and what we do not

Our logs record sign-ins, refused requests and errors. An email address in a log line is shortened to its first letter and its domain, for example j***@example.com.

Our logs never record your full email address, an app password, a sign-in code, or what you type into a form.

Our hosting provider keeps basic request logs, which include IP addresses. When the security screen blocks a request, it reports the IP address, the page and the time to the operator's hub.

In your browser

Pages load scripts only from this site and from the operator's hub. Every form checks that it was sent from a page on this site.

Report a security problem