Your privacy is not a feature — it's the foundation.

Purlre is a secure email service that provides @purlre.com addresses for Discord server communities and privacy-conscious individuals. I am a solo founder based in Canada — there is no team, no investors, and no corporate parent. If you have questions about this policy, contact me directly at rexedge@purlre.store.

I collect the minimum data necessary to operate the service. This includes: your personal (real-world) email address used to verify your account; your chosen @purlre.com username and address; a hashed password and hashed security question answer (I never store these in plain text); your Discord user ID if you sign in via Discord OAuth; inbound emails sent to your @purlre.com address, stored encrypted in my database using your PGP public key; your Stripe customer ID and subscription status if you subscribe to a paid plan; and basic server logs (IP address, user agent, timestamps) retained for up to 30 days for abuse prevention.

I use your data solely to provide and improve the Purlre service. Specifically: your personal email is used to send account verification, password reset, and security alert emails; your @purlre.com address is your inbox identifier; inbound emails are encrypted with your PGP public key before storage; Stripe data is used to manage your subscription; and server logs are used to detect and prevent abuse, spam, and unauthorized access. I do not sell, rent, or share your personal data with third parties for marketing purposes — ever.

Inbound emails are encrypted with your PGP public key before they are stored in my database. Your private key is generated in your browser and stored only on your device in IndexedDB; it is never transmitted to my servers. Because Purlre does not receive or store your private PGP key, I cannot decrypt stored messages. This protection applies to messages after they are stored by Purlre; it does not mean that every sender encrypts email end-to-end before it reaches Purlre. If you lose your private key by clearing browser data or switching devices without exporting it, previously received encrypted emails cannot be recovered.

Your account data is retained for as long as your account is active. If you delete your account, your personal email, @purlre.com address, and stored emails are removed from active systems within 30 days. Copies that remain in encrypted backups may persist until those backups are rotated out. Server logs are retained for up to 30 days. Stripe billing records are retained as required by applicable financial regulations.

I use the following third-party services to operate Purlre: GoDaddy Airo for website design; GitHub and Visual Studio Code for source-code collaboration, debugging, and additional development; Stripe for payment processing; Resend for transactional email delivery; CloudMailin for inbound email routing; and Discord for optional OAuth sign-in. Stripe processes payment-card information directly; Purlre receives subscription-related information such as your Stripe customer ID, subscription status, and billing records needed to manage your plan, but does not store your full payment-card number. Each provider has its own privacy policy, and I share only the minimum data necessary to operate the service.

Depending on where you live and the circumstances, you may have rights to request access to, correction of, deletion of, or information about the use and disclosure of your personal information; to withdraw consent where processing is based on consent; and to complain to the relevant privacy regulator. Canadian users may contact the Office of the Privacy Commissioner of Canada or an applicable provincial privacy regulator. Users in the EEA or UK may also have rights to restriction, objection, portability, and to complain to their local supervisory authority. To make a request, contact rexedge@purlre.store. I may need to verify your identity before responding, and I will respond within the timeframe required by applicable law.

Purlre is operated from Canada. To provide the service, limited personal information may be processed by service providers in Canada, the United States, or other countries where they operate, including Stripe, Resend, CloudMailin, Discord, and GoDaddy Signals. Privacy laws in those locations may differ from the laws where you live. I use providers that are expected to apply appropriate safeguards and limit processing to the services they provide. Where applicable law requires additional transfer safeguards, Purlre will use measures appropriate to the transfer.

Purlre processes personal information to provide the service you request, manage accounts and subscriptions, maintain security, comply with legal obligations, and pursue legitimate interests such as preventing fraud and abuse. Where required, Purlre relies on your consent for optional analytics and other optional processing. You may withdraw consent at any time; this does not affect processing that occurred before withdrawal or processing that is otherwise permitted by law.

Cookies are small text files that a website saves in your browser. They are not programs — they cannot run code, access your files, or harm your device. Purlre uses two categories of cookies:

Session cookies (essential): Required for the service to function. These keep you logged in while you use your inbox and expire when you close your browser or log out. You cannot opt out of session cookies without losing access to your account.

Analytics cookies (optional): Used to measure how visitors interact with the site — for example, which pages are visited and how long. Purlre uses GoDaddy Signals analytics for this purpose. It receives consented site-usage information such as page views, navigation activity, approximate session duration, and device type; it does not receive your email content or account data. A consent banner appears on every page load asking whether you accept analytics cookies. You can decline without affecting any app functionality.

I do not use advertising cookies, retargeting cookies, or any cookies that share your data with third-party ad networks. Your cookie preference is stored for the duration of your browser session and the banner reappears the next time you open the site.

Before optional analytics cookies are activated in your browser, I ask for your explicit consent. This section explains what that means and what choices you have.

What informed consent means: Consent is informed when you receive clear, plain-language information about what cookies may be set, what data they collect, who processes that data, and how long the preference lasts before you make a choice. I do not pre-tick consent boxes, bundle cookie consent with account registration, or treat continued browsing as consent.

How consent is obtained: A cookie consent banner is displayed on every page load. The banner explains essential and analytics cookies, describes what each category does, and gives you a clear Accept or Decline option. No optional analytics collection is activated until you click Accept.

Freely given: Declining analytics cookies has no effect on your ability to use Purlre. You will not be denied access to any feature, shown a degraded experience, or prompted repeatedly within the same session.

Withdrawing consent: Because your preference is session-scoped, it resets automatically when you close the browser or open a new tab. You can also decline at any time by refreshing the page and choosing Decline on the banner. There is no penalty for withdrawing consent.

What happens when you consent: If you click Accept, GoDaddy Signals analytics may record consented site-usage data such as pages visited, navigation activity, approximate session duration, and device type. This data does not include your email address or inbox content.

What happens when you decline: No optional analytics cookies are set. The site functions identically. Your choice is respected for the remainder of your browser session.

Privacy-law information: Privacy rights and legal requirements can vary by location and circumstances. Where consent is required for optional analytics, Purlre relies on the choice you make through the consent banner. Essential session cookies are used to provide the service you request. This policy is intended to explain Purlre's practices and is not legal advice.

I may update this Privacy Policy when reasonably necessary to reflect changes to the service, legal requirements, or privacy practices. When I do, I will update the 'Last updated' date at the top of this page and, for material changes, provide notice by email to your personal address on file or through the service where appropriate. Where applicable law requires a different form of notice or consent, Purlre will follow that requirement.

For privacy-related questions or requests, email me at rexedge@purlre.store. For general support, use the contact form at purlre.store/contact.