Privacy policy

Last updated 10 October 2026

PhantomShield exists to keep your real address private, so it keeps as little as it can. This page says what that is, why, and for how long. PhantomShield is run by PhantomShield LLC, a limited liability company registered in Maryland, United States, which decides how the data described here is used. In this policy "we" means that company.

What we keep

About your account

• Your email address. You sign in with it, and it is the inbox your aliases forward to.
• Your password, only as a one-way scramble that cannot be turned back into the password.
• When the account was created, when you accepted the terms, and your settings.
• If you set a device up for quick create, or connect the browser extension: a name for it taken from how its browser describes itself (such as "iPhone, Safari"), when it was set up and when it was last used, and a fingerprint of the key it holds. The key itself is only on the device.
• Where your plan stands: when your free trial ends and, if you subscribe, which plan you are on, how long it is paid for, and the reference Stripe uses for you. Never your card details: those go straight to Stripe, and we do not see them.
• How many messages were forwarded, replies sent and aliases created on each day, so that the daily limits can be applied. Kept for about a month.

About your aliases

• Each alias: its address, the label and site you gave it, whether it is on, off or locked, and running totals of the mail it has forwarded and refused.
• For each message that arrives: the alias it was for, the time, the sender's domain (the part after the @) and what was done with it. Kept for 180 days.
• For each alias: the domains that have written to it, when each first and last did, whether each is expected or flagged, and the leak flags that were raised.
• The full address of everyone who has written to an alias, so that your reply can be sent to them.
• If you add a domain of your own: its name, the code that shows it is yours, and when its records were last looked up. Looking them up means asking the domain's name servers for them.
• For early warnings: which sites have had aliases flagged in several accounts within 30 days of each other. That is worked out from the flags above every few minutes. And which sites your account has been warned about, kept for 90 days.

Deleting an alias erases its records and the addresses that wrote to it. The alias address itself stays on a list of retired addresses, so that it is never given to anyone else.

What other accounts are told

When aliases that at least 3 accounts made for the same site are flagged within 30 days, the other accounts with an alias for that site get an early warning. It gives the number of accounts and, if at least 3 of them heard from the same sender, that sender's domain. It never says whose aliases they were. Nothing else about your account, your addresses or your mail is shown to another account.

What we do not keep

Subjects, message text and attachments. A message is passed on to your inbox and is then gone from our server. If your inbox cannot be reached, the message waits here for up to 5 days while we keep trying, and is then deleted. Mail that a locked alias turns away is discarded.

The browser extension

The extension for Chrome and Firefox is optional. It keeps a few things in your browser, and only there: a key that lets it make aliases for your account, a list of the aliases it has made and the sites they were for, so that it can offer them to you again, and the domains your account can make aliases at, with the one you chose. Disconnecting it erases them. It sends us its key with every request and, at the moment you ask it for an alias, the name of the site you are on (such as netflix.com) or whatever you typed in its place, which becomes that alias's label and site. It reads the address of the page you are on only when you click it, and looks at the page itself only to find the box to fill in. The one page it reads on its own is ours: the page that confirms it is connected. It contacts us only when you open it, connect or disconnect it, or ask it for an alias, and it contacts nobody else. What it handles is used only to make and fill in your aliases, in line with the Chrome Web Store's User Data Policy, including its Limited Use requirements.

How your mail is checked

Before a message is forwarded, software checks it for signs of junk and forgery. Nobody reads it.

• The sending server's address, and the domains, links and email addresses that appear in the message, are looked up in public blocklists. A lookup shows the blocklist's operator what was asked about, not who the message was for.
• Fingerprints of the message's content are compared with a public database of known junk run by the Rspamd project. A fingerprint is a short code worked out from the content, from which the content cannot be rebuilt.
• The sender's own published rules (SPF, DKIM and DMARC) are checked, which catches many forged senders.

When a message is passed on to your inbox, the connection is encrypted whenever your mailbox provider supports that, and nearly all do.

Logs

• Mail log: for every message, the sender's and recipient's addresses, the sending server's address, the time, the message's ID and what was done with it. Never subjects or contents. Kept for up to six weeks.
• Spam filter log: the same details, and which checks the message set off. Kept for up to five days.
• Web server log: your IP address, the page asked for, the time and how your browser describes itself. Kept for up to 15 days.
• Notes of failed sign-ins and of requests for sign-up or password emails: the address typed and the IP address. They slow down guessing and flooding. Kept for a day or two.

Cookies

One cookie. It is set when you open a page that has a form, such as the sign-in page. It keeps you signed in until you sign out, or for 12 hours after your last visit, and it lets the site check that a form really was sent from its own pages. A second cookie is set only if you set a device up for quick create. It holds the key that lets that device make aliases without signing in, it is sent to the quick-create page and to no other, and it lasts for a year after the device last used it. There are no analytics and no advertising, and no page here loads anything from another site. Stripe's payment pages are Stripe's own and set their own cookies.

Who else is involved

• NFOservers (Nuclearfallout Enterprises, Inc.) rents us the server, in Los Angeles, California. Everything described on this page is stored on that one server.
• Stripe takes the payments and, under the name Link, is the seller of record for them. When you subscribe, we give Stripe your email address and the number of your account. On its payment page you give Stripe your payment details yourself, and your name and billing address, which it needs to work out tax. We can see that name and address in our Stripe account, and we do not copy them to our server. Stripe emails you your receipts. You can ask Stripe, through Link, to delete what it holds about your purchases, which also ends your subscription. What Stripe holds is covered by Stripe's privacy policy.
• Your own mailbox provider receives the mail we forward to you.
• The blocklist operators and the Rspamd project answer the lookups described under "How your mail is checked".

We do not sell personal data, share it for advertising, or use it to build profiles of people.

Where your data is, and on what grounds

Your data is kept in the United States. If you live somewhere else, that means it leaves your country, and the privacy law that protects it may differ from yours.

For readers in the EU and the UK: we use your data to carry out our agreement with you (running your account and your aliases, taking payment), on the ground of our legitimate interest in keeping the service secure and free of abuse (the checks, the logs and the limits), and to meet legal duties (records of payments).

Backups

The database is copied once a day, and each copy is kept for 14 days. Whatever you delete is therefore gone from the copies 14 days later.

Your choices

• In the dashboard you can see your aliases, who has written to each and what was done with their mail. You can change how each alias behaves, and delete any alias.
• You can delete your whole account on the Account page. Your address, your password, and your aliases' labels, records and correspondents are erased at once. The retired alias addresses stay, with nothing attached that points to you. Records of payments stay with Stripe, and in our bookkeeping, for as long as tax and accounting rules require.
• For anything else, such as a copy of what we hold about you, a correction, or moving your account to another inbox, write to support@phantomshield.com from the address you signed up with. We answer within 30 days.

We do this for everyone, wherever you live. If you live in the EU or the UK and think we have handled your data wrongly, you can also complain to your data protection authority.

Requests from authorities

We hand data to an authority only when the law requires it, and then only what we hold, which does not include the contents of your mail. Where the law allows, we tell the account's owner.

Children

PhantomShield is for adults. We do not knowingly open accounts for anyone under 18.

If something goes wrong

If we learn that someone has got at your data without permission, we tell you by email without undue delay: what happened, what it affects, and what we are doing about it.

Changes to this policy

When this policy changes, the date at the top changes. If a change matters to you, we email you at least 30 days before it takes effect.

Contact

PhantomShield LLC. Questions about your data: support@phantomshield.com.