Privacy Policy
Effective date: 1 May 2026
This policy explains what data Conduit collects and why. It also explains how long Conduit keeps the data, and what rights you have over it.
Conduit is a free service that connects inbound SMTP email to outgoing HTTP webhooks. It is a personal project. There is no company behind it, the source code is not public, and there is no self-hosted version.
1. Who is the controller?
Conduit is operated by:
Christian Joergensen (sole operator) Email: christian@technobabble.dk
I am the data controller for the personal data that Conduit processes. Use the email address above for any privacy question, request, or complaint.
2. What data is collected?
Conduit collects only the data that it needs to run the service.
Account data
- Your email address, for sign-in, password reset, and service notices
- A hashed password, only if you sign in with an email address and a password. Conduit stores it as a bcrypt hash and never stores the plaintext
- An OAuth subject identifier and email address, only if you sign in with Google or GitHub
- A two-factor authentication secret, only if you turn on 2FA. Conduit encrypts it at rest
- Your timezone preference
Webhook settings
- The webhook names, the target URLs, and the secret of each webhook
- The SMTP authentication credentials that you enter, as bcrypt hashes
- The domain ownership verification records
- The SMTP security policy settings, such as the allowed source CIDR ranges
Delivery logs (kept for 30 days)
- The sender envelope address
- The recipient envelope address
- The subject line
- The SMTP response code that Conduit returned to the sending server
- The timestamp of the delivery attempt
- The HTTP status code from your webhook
- The source IP address of the SMTP connection
Audit log (kept for 180 days)
- The action identifier, for example "webhook.created" or "account.password_changed"
- The timestamp of the action
- The client IP address of the action
- Short metadata about the resource, for example the webhook ID and name. This metadata never holds a secret or any message content
Email content is NOT stored
When an email arrives, Conduit forwards the message body to your webhook URL and then discards it. The full message body and the headers exist in memory only, for the duration of the delivery call. Conduit writes no part of the message body to the database, to disk, or to the logs.
Cookies
- A session cookie (HTTP-only) that keeps you signed in
- A CSRF token cookie that protects form submissions
There are no marketing, advertising, or analytics cookies. Conduit does not use third-party analytics.
3. Why is this data collected?
| Data | Purpose | Lawful basis (GDPR) |
|---|---|---|
| Account email and credentials | Authenticate you to the service | Contract, Art. 6(1)(b) |
| Webhook settings | Operate the service that you signed up for | Contract |
| Delivery logs | Help you debug a failure, and meet operational and security needs | Contract and legitimate interest |
| Audit log | Record security and settings changes for your review and account protection | Contract and legitimate interest |
| Cookies (session, CSRF) | Keep you signed in and prevent CSRF attacks | Strictly necessary |
| OAuth identifiers | Let you sign in with Google or GitHub | Contract |
4. How long is data kept?
| Data | Retention |
|---|---|
| Email content (message body and headers) | Not stored, held in memory during the delivery only |
| Delivery logs | 30 days, then deleted automatically |
| Audit log | 180 days, then deleted automatically |
| Account and settings data | Until you delete your account |
| Backups | Encrypted backups are kept for up to 1 year for disaster recovery (see Section 7) |
You can delete your account at any time on the account settings page. The deletion immediately removes all of your account data, your webhooks, and your delivery logs from the live database.
5. Third-party processors
These providers process data for Conduit:
| Provider | Purpose | Data shared |
|---|---|---|
| HostHatch | Server hosting (New York, United States) | Everything stored by Conduit (database files, application memory) |
| Cloudflare | DNS hosting and Turnstile (anti-bot challenge on auth forms) | Your IP address and a Turnstile token at sign-up and sign-in |
| Resend | Transactional email (sign-up confirmation, password reset, service notices) | Your email address and the message content |
| OAuth sign-in, only if you choose to sign in with Google | Your Google profile email and subject ID | |
| GitHub | OAuth sign-in, only if you choose to sign in with GitHub | Your GitHub profile email and subject ID |
These providers act as data processors. Their own terms require them to handle the data only for the purposes in the table.
6. Your rights
The major privacy frameworks give you almost the same set of rights. They include GDPR, UK GDPR, Swiss FADP, and CCPA. These rights apply wherever you live. You can:
- Access the personal data that Conduit holds about you
- Correct information that is wrong (you can edit most fields on the account settings page)
- Delete your account and all of its live data (self-service on the account settings page)
- Export your data in a machine-readable format
- Object to the processing, or restrict how Conduit uses your data
- Withdraw consent for any processing that depends on consent
- Lodge a complaint with your local data protection authority
To exercise any of these rights, email christian@technobabble.dk. This includes an export of your data, or the deletion of your data from the backups. I answer requests within 30 days.
7. Backups
Conduit keeps encrypted backups of the live database for disaster recovery, for up to 1 year. A rolling schedule then deletes them. If you delete your account, copies of your data can stay in the backups until those backups expire.
To also remove your data from the backups, for example for a GDPR erasure request, email christian@technobabble.dk. The request then includes the removal from backup storage.
8. International transfers
The Conduit servers are in New York, United States. Some jurisdictions have data-export rules, for example the European Economic Area, the United Kingdom, and Switzerland. If you use Conduit from one of them, your personal data is transferred to the United States to operate the service.
The legal basis for this transfer is the Standard Contractual Clauses (SCCs) that the European Commission approved. Section 9 lists the additional safeguards: encryption at rest, TLS in transit, and no storage of email content. Some sub-processors operate globally and can also transfer data outside the EEA. They are Cloudflare, Google, GitHub, and Resend. Each one relies on the SCCs, or on the EU-US Data Privacy Framework when it applies.
To request a copy of the current SCCs, or more detail about the safeguards, email christian@technobabble.dk.
9. Security
Conduit takes reasonable technical measures to protect your data:
- Conduit hashes passwords and SMTP authentication credentials with bcrypt
- Conduit encrypts two-factor authentication secrets at rest
- Inbound SMTP supports STARTTLS. Outbound webhook calls use TLS with certificate validation
- Sessions use HTTP-only cookies and CSRF tokens
- Conduit never writes email content to disk or to the database
No service is perfectly secure. If you find a security problem, email christian@technobabble.dk.
10. Children
Conduit is not for children under 16, and it does not knowingly collect data from them. If a child signed up, email christian@technobabble.dk. I will remove the account.
11. Changes to this policy
If this policy changes in a material way, the new version appears at this URL with a new effective date. Signed-in users also get an email. I can make minor edits, such as typos, clarifications and formatting, without notice.
12. Contact
For any privacy question or request:
Christian Joergensen christian@technobabble.dk