1. Who we are
MyShield is a private email alias service operated from South Africa. We help you protect your real email address by forwarding messages through generated alias addresses. Our contact email is [email protected].
2. What we collect
We collect only what is necessary to provide the service:
- Account data: your email address, name, and a hashed password (or a Google OAuth token if you sign in with Google).
- Alias metadata: the alias addresses you create, optional labels, and a forward count per alias. We do not store the content of forwarded emails.
- Payment data: if you upgrade to Pro, billing is handled entirely by PayFast. We never see or store your card details. Only a subscription token from PayFast to manage renewals and cancellations.
- Technical data: IP addresses are logged briefly in our audit log for security purposes (failed logins, account creation). Log entries older than 90 days are purged.
3. How we use your data
- To forward emails received at your aliases to your real inbox.
- To send account-related emails (welcome, password reset, subscription receipts).
- To enforce plan limits and prevent abuse.
- To respond to your support requests.
We do not sell your data. We do not use your data for advertising. We do not read the content of forwarded emails.
4. Email forwarding
When an email arrives at one of your aliases, MyShield receives it, looks up the destination address (your real email), and forwards the message. The forwarded email includes the original sender's address in the Reply-To header so you can reply normally.
We do not retain the content of forwarded emails. The message passes through our system in memory and is delivered immediately. Only the forward count (a number) is stored against your alias.
5. Data sharing
We share data with the following third parties only as required to operate the service:
- PayFast (payfast.co.za), payment processing for Pro subscriptions. Their privacy policy applies to data shared during checkout.
- Google: if you use "Sign in with Google", your name and email are shared with us via the Google Identity platform.
- SMTP provider (e.g. Resend), used to send and forward emails. Your alias address and the forwarded email content pass through their infrastructure in transit.
6. Data retention
Your account data is retained for as long as your account exists. If you delete your account, your user record, aliases, and payment history are permanently deleted. Audit log entries are retained for 90 days. We do not make backups of forwarded email content.
7. Your rights (POPIA)
As a South African service, we comply with the Protection of Personal Information Act (POPIA). You have the right to:
- Access a copy of the personal information we hold about you.
- Request correction of inaccurate data.
- Request deletion of your account and all associated data.
- Object to the processing of your data.
To exercise any of these rights, email [email protected].
8. Security
Passwords are hashed using bcrypt and never stored in plain text. All connections use HTTPS. Our database is stored on a private server. We apply rate limiting and CSRF protections to all authenticated endpoints.
9. Cookies
MyShield does not use tracking cookies or analytics. Authentication sessions are managed using secure HttpOnly cookies to protect against unauthorized access. We do not use third-party analytics or advertising trackers.
10. Changes to this policy
We may update this policy as the service evolves. Material changes will be communicated by email to registered users. The "last updated" date at the top of this page reflects the most recent revision.
11. Contact
For any privacy concerns or data requests, contact us at [email protected] or visit our contact page.