Privacy Policy
Last updated 28 October 2026. Applies to ECOMHUTSY Webmail at mail.ecomhutsy.com and to the ECOMHUTSY Webmail apps for Windows and Android.
The short version
- Your email stays on your own mail server. We do not copy your mailbox into a database of ours.
- On the web, we keep the details needed to connect to your mailboxes, with every password encrypted. In the Windows and Android apps, those details stay on your device.
- We do not show ads, sell data, build profiles or use your email to train AI.
- You can delete everything we keep with one button, at any time: Settings, then Delete my webmail data.
How ECOMHUTSY Webmail works
ECOMHUTSY Webmail is an email client: it shows the email that already sits in your mailbox at your email provider (for example cPanel or CyberPanel hosting, Zoho Mail, Gmail or Yahoo Mail) and sends your email through that provider. It is offered free of charge by ECOMHUTSY ("we", "us").
There are two ways it connects to your mailbox:
- On the web (mail.ecomhutsy.com in a browser): our server connects to your mail server on your behalf, using the mailbox details you entered, and shows the result in your browser.
- In the Windows and Android apps (direct mode): the screens load from mail.ecomhutsy.com, but every mail request is handled inside the app on your device. Your device connects straight to your mail server with your own internet connection; your mailbox details and passwords are saved on that device only.
What we keep and where
When you use the web version (kept on ECOMHUTSY servers)
| Information | Why |
|---|---|
| Each connected mailbox: email address, login name, password (encrypted with AES-256-GCM), incoming and outgoing server names and ports | To connect to your mailbox each time you open it |
| Your name on sent emails, signature, mailbox colour and order | Your own settings |
| Time of the last successful connection and the last connection error | To tell you when a mailbox needs attention |
| Your profile: the email you signed in with, when it was created and your last sign-in | To keep your mailboxes together and to sign you in |
| Scheduled emails: the email until it is sent; after sending, only recipients, subject, time and status | To send it at the time you chose and show it under Scheduled |
| Snoozed emails: the email's Message-ID, subject and wake-up time | To return it to your Inbox on time |
| A sign-in cookie (signed, not readable by scripts): 12 hours, or 30 days with "Keep me signed in" | To keep you signed in |
| Technical logs: network address, time, the request and any error | Security, preventing abuse and fixing problems |
When you use the Windows or Android app
Mailbox details, passwords, scheduled and snoozed emails are saved on your device only, protected by Windows data protection or the Android Keystore. We do not receive them. Our server still serves the app's screens, so it sees ordinary web requests (network address, time, app and browser version) in its logs, like any website.
When you contact support
If you use Help & support, we receive what you write, the mailbox address you give us for the reply and the time. Support requests are kept in our support system so our team can answer and follow up.
Your email itself
Your emails, attachments and folders stay on your mail server. When you open the list or an email on the web, our server reads it from your mail server and passes it to your browser. To make reopening faster it may keep recently opened emails briefly in its working memory; that memory is not a database or a backup, it is not used for anything else, and it is cleared as it fills up and whenever the server restarts. In the apps, this happens on your device instead.
Our staff do not read your email. Because your email is not stored by us and passwords are encrypted, they cannot browse your mailbox.
How we use information
- To connect to your mailboxes, show your email, send what you write, and run scheduled send, snooze, labels and notifications.
- To keep the service secure: limit repeated sign-in attempts, block abuse and investigate problems.
- To answer support requests you send us.
We do not use your information for advertising, we do not sell or rent it, and we do not use the content of your email for profiling or to train artificial intelligence.
Sending email
Email you send goes out through your own mail server, under your own address and your provider's rules. One exception: for mailboxes hosted by ECOMHUTSY itself (ecomhutsy.com and ecomhutsy.org addresses), messages to outside addresses may be delivered through our email delivery provider, Brevo, to keep delivery reliable; messages between ECOMHUTSY addresses stay on our own server.
Pictures inside emails
Many emails load pictures from the sender's servers. Loading them can tell the sender that the email was opened, from which network address and with which kind of device. ECOMHUTSY Webmail shows these pictures automatically by default, as most email apps do. You can turn this off under Settings, Reading, Always display images; pictures then load only when you choose to show them for an email.
Gmail and Yahoo Mail
Gmail and Yahoo Mail mailboxes connect over the standard IMAP and SMTP mail protocols with an App Password that you create in your Google or Yahoo account. We do not use Google or Yahoo programming interfaces and get no access to any other part of your Google or Yahoo account. You can revoke the App Password in your Google or Yahoo account at any time, which immediately stops ECOMHUTSY Webmail from connecting.
On your device
- Your notification, sound and picture settings are saved in your browser or app storage.
- The web version may install a small offline page and use notifications only after you allow them.
- The Android app asks for permission to show notifications and uses the internet; it does not access your contacts, photos, location, microphone or camera. Files you attach are read only when you choose them.
Who we share with
We do not sell or share your information with third parties for their own use. We use a small number of service providers who process it for us under contract: our hosting provider (OVHcloud), and, for ECOMHUTSY-hosted mailboxes only, our email delivery provider (Brevo). We may disclose information when the law requires it, to protect people from harm or to protect the service, or as part of a merger or sale of the business, in which case this policy continues to apply.
Security
- All connections between your browser or app and our servers use encryption (HTTPS). Connections to mail servers use TLS whenever the mail server offers it.
- Saved mailbox passwords are encrypted with AES-256-GCM; in the apps they are protected by the operating system on your device.
- Emails are shown in a protected frame where scripts inside an email never run.
- Sign-in attempts and support requests are rate-limited, and you can sign out of every browser at once.
No online service can promise perfect security. Please use a strong password for your mailbox and keep your devices up to date.
How long we keep it
- Mailbox details and passwords: until you remove the mailbox or delete your webmail data.
- Scheduled emails: the content is deleted as soon as the email is sent; the short record (recipients, subject, time, status) stays until you delete your data.
- Your profile and snoozed-email records: until you delete your webmail data.
- Technical logs: for a limited time for security and troubleshooting, after which they are deleted in normal log rotation.
- Support requests: as long as needed to help you and keep a record of our answer.
Your choices and rights
- Remove a mailbox: Settings, Mailbox settings, Remove mailbox. Its saved password and settings are deleted at once.
- Delete everything: Settings, Delete my webmail data. This deletes every mailbox, password, scheduled and snoozed record and your profile, and signs you out everywhere. See Delete your data.
- Apps: uninstalling the Windows app, or clearing the Android app's storage, deletes everything it saved on that device.
- Requests: you can ask us for a copy of, a correction to, or the deletion of information we hold about you, or object to its use, by writing to support@ecomhutsy.com. We answer within 30 days. Depending on where you live you may also complain to your data protection authority.
Android app data summary
| Question | Answer |
|---|---|
| Data collected by ECOMHUTSY through the app | Support requests you choose to send (message and reply address). Mailbox details and email stay on the phone. |
| Data shared with third parties | None |
| Encrypted in transit | Yes |
| Ads or tracking | None |
| Can you delete your data? | Yes: Delete my webmail data in Settings, or clear the app's storage, or uninstall the app |
Children
ECOMHUTSY Webmail is meant for business and personal email of adults. It is not directed at children under 13 (or under 16 where local law sets that age), and we do not knowingly keep information about them. If you believe a child has used it, contact us and we will delete the information.
International processing
Our servers are run by OVHcloud, and our support team works from our offices in Pakistan, the United Arab Emirates and the United States. Your information may therefore be processed outside your own country. We apply the protections described in this policy wherever it is processed.
Changes to this policy
If we change this policy we will update the date at the top of this page; for important changes we will also show a notice in ECOMHUTSY Webmail before they take effect.
Contact
ECOMHUTSY, Building #3, Street 9, Shalimar Colony, Multan 60000, Pakistan. Email support@ecomhutsy.com, or use Help & support inside ECOMHUTSY Webmail.