Draft for attorney review

Privacy Policy

DRAFT — for attorney review. Not legal advice. Do not publish until counsel for the operator of SpamEnder has revised it.

Last updated: October 27, 2026.

This draft describes how SpamEnder handles personal information for the marketing site https://spammerblock.com, the portal https://app.mailpal.co, and the connector https://mcp.mailpal.co. The legal entity is "the operator" until counsel names it.

Information we collect

The mobile number you verify (it is your account), your account email if you add one, and your name if you give one.
Your mobile carrier's name and type, looked up once from your number so we can show the right forwarding code.
Trial dates, plan status, this month's usage as a percentage, and your auto-add choice with the time you agreed to it.
Invite information: your invite code, who invited you (if anyone), and whether each friend you invited has counted toward a reward. We do not collect your contacts and we never send invites for you.
The screening number we buy for you, carrier-test results, and whether forwarded calls arrive with a usable caller ID.
Call metadata: time, direction, the number presented as the caller, verdict (spam, passed, or message), a short reason, and a short summary.
A transcript and any fields the assistant collected, for long enough to email the report.
Billing status from Stripe: customer id, subscription id, and whether the subscription is active, past due, or canceled. We do not receive or store your full card number.
Sign-in codes and connector tokens, stored only as hashes.
If you email support, whatever you send to support@mailpal.co.

While SpamEnder is at capacity, you can join a waitlist instead of signing up. For each waitlist entry we keep:

The mobile number you enter, in standard international format. It is not verified at this stage.
The time you joined, whether you joined from a phone or a computer, the invite code that brought you (if any), and your own waitlist invite code.
How many people joined with your invite code, which moves you up the line.
Your text-message consent, if you give it: that you ticked the box, the exact wording you agreed to ("Text me when my spot opens. Msg & data rates may apply. Reply STOP to opt out."), and when. The box is never ticked for you.
Whether your spot has been released, when we invited you, and when you signed up.

We use waitlist data to hold your place, to let you in when a spot opens, and, only if you consented, to send a text when your spot opens. Marketing texts are sent only to people who also ticked the separate, optional box described under Updates about new security products. We do not sell or share waitlist numbers, and we do not text anyone who did not tick the box. Reply STOP to any text to opt out. No waitlist texts are sent until text messaging is registered and enabled. Your waitlist page shows only the last four digits of your number. To leave the waitlist and have your number deleted, email support@mailpal.co. Entries are deleted when you ask, and counsel should set a retention period for entries that never sign up.

Updates about new security products

SpamEnder may contact customers by email, text message, or phone call about new SpamEnder security products and features. These updates are separate from service messages, such as sign-in codes, call reports, and plan, billing, and account notices.

What we keep. Whether you agreed to marketing texts, the exact wording you agreed to ("Text me about new SpamEnder security apps, up to 4 msgs/month. Optional, not required to sign up. Msg & data rates may apply. Reply STOP to opt out, HELP for help."), when you agreed, and where (the sign-up form, the waitlist form, or Settings). If you turn it off, we keep when you did, so we don't contact you again. We also keep whether product email is on or off for your account. This record is kept apart from the required waitlist text consent described above.
Marketing texts need your separate OK. The box is optional, never ticked for you, and not a condition of service. A tick on the waitlist form carries over to your account when you sign up, unless you've already made a choice.
Email. Product email can go to your account email and always includes an unsubscribe link. You can turn it off in Settings.
Opting out. Reply STOP to any text, use the unsubscribe link, turn the options off in Settings under Updates from SpamEnder, or email support@mailpal.co.

We don't sell or share your number or email for anyone else's marketing. No marketing texts are sent today, and none will be sent until text messaging is registered and enabled.

Sample calls

The sample calls on the home page are dramatized with AI voices. The names in them are fictional. They are not recordings of real customers or callers.

Information we try not to keep

The assistant is instructed not to ask for payment card numbers, Social Security numbers, or one-time passcodes. If a caller dictates a code, the service is built to drop that audio from the transcript, not to log the digits, and not to put the digits in the report email. Detected verification calls are bridged straight through by default, or announced as a code call when that customer chose a spoken notice. Either way the code digits are not stored. If a direct verification bridge is not answered, the notice is spoken instead, still without the code. Do not rely on this as a promise that every spoken digit is caught. Redaction looks for obvious digit strings and code phrases. Counsel and the operator should keep reviewing it.

How we use information

We use it to screen calls, place callbacks only to your verified cell, email reports, run the portal and the connector, bill the subscription, stop screening when the subscription is not in good standing, release a number after the grace period, detect loops and call floods, and email the operator if an account nears its minute cap. The cap alert goes to support@mailpal.co unless the operator changes OWNER_ALERT_EMAIL. It does not include the transcript.

Reports and email

Reports come from reports@mailpal.co through Twilio SendGrid. The return-path domain is mail.mailpal.co, and rewritten links use links.mailpal.co. The report can include the caller number, the time in your timezone, the verdict, why it was flagged, collected fields, a summary, and the redacted transcript. Spam calls are reported too. A signed SendGrid event marks a bounced, blocked, dropped, or spam-reported address invalid, and the portal and the connector say so. We then stop sending to that address, which is how we honor SendGrid's suppression lists.

Retention

After the report email is accepted for sending, the stored transcript and collected fields are deleted.
If sending fails, that content can remain until the retry window ends. The default window is 24 hours. Then it is deleted and the email is marked failed.
The short summary can remain for the summary retention period. The default is 90 days. The portal and the connector show metadata and that summary, not a long-term transcript.
Call metadata (time, numbers, verdict, email status) can remain after the summary is cleared so you can see that a call happened.
A released line's phone number is released at Twilio. Account records can remain until you ask us to delete the account, except where we must keep a billing record.

Counsel should confirm these periods against the operator's actual backups and logs.

Who else processes it

Twilio, for numbers, call control, recordings on the outage fallback, and the verification text.
xAI, for the voice model that hears the caller and decides which tool to call. Audio is streamed for screening. The bridged conversation with you, whether you pressed 1 on a screened call or the caller was connected directly, is not transcribed by SpamEnder.
Stripe, for Checkout, the customer portal, and subscription webhooks.
Google Cloud, for Cloud Run, Cloud SQL for PostgreSQL, Secret Manager, Cloud Logging, and the scheduled jobs. The reference deployment keeps the database on a private IP.
Twilio SendGrid, for report mail, sign-in codes, and bounce or spam-report notices. DNS for mailpal.co, the return path mail.mailpal.co, and link branding links.mailpal.co is part of making that mail deliverable.
Your carrier, which already has the forwarding relationship.
A Grok Bot or other client you authorize at mcp.mailpal.co. Its tools can read and change only your account.

We do not sell personal information. This draft does not grant a marketing list. Counsel should add any state privacy rights (access, delete, correct, appeal) and the request address.

The portal sets an httpOnly session cookie after you enter a sign-in code sent to your phone or email. If you open an invite link, a cookie remembers the invite code for up to 30 days so the right friend gets credit. The connector uses an OAuth authorization code and a bearer token. We do not use the cookie for third-party advertising.

Security

Subaccount tokens are encrypted when TOKEN_ENCRYPTION_KEY is set. Production refuses to start without it. Webhooks are checked with Twilio signatures, Stripe signatures, and the SendGrid signed event webhook. Scheduled jobs accept a Google identity token for the portal origin. Logs are written as JSON with phone numbers and email addresses removed. No method is perfect.

Children

SpamEnder is not directed at children, and the account holder must be able to contract. Do not use it to screen a child's phone unless counsel says that arrangement is lawful.

International

SpamEnder runs on Google Cloud in the United States (us-central1, Iowa). Calls and phone numbers are handled by Twilio, the call assistant runs on xAI, and email is sent through SendGrid, each under its own terms. Audio streams through the voice provider while a call is live; SpamEnder keeps the transcript and summary, not the audio, except a voice message a caller leaves when the assistant is unavailable, which stays with Twilio and is linked from your report.

Changes

Counsel should describe how policy changes will be announced. Until this draft is replaced, the copy served at https://app.mailpal.co/legal/privacy is the working text.

Contact

Privacy and support: support@mailpal.co. Marketplace listing contact: hello@mailpal.co.

Public comments

If you post a comment, we store the text, the optional name and place you entered, when you posted, and a scrambled marker made from your network address so we can limit spam and keep votes to one per person. We never ask for your phone number or email to comment. Approved comments are public. Comments we decline are deleted within 30 days. Ask support@mailpal.co to remove a comment you posted.

Outside the US

If you ask to hear when SpamEnder reaches your country, we keep the country and, only if you give it and tick the consent box, your email. We use it once to tell you SpamEnder is available there, and you can ask support@mailpal.co to delete it at any time.

Check my spammer and Spammer of the Week

When SpamEnder blocks a spam call, we keep a small record for up to 180 days: a scrambled (keyed hash) form of the caller's number, the robocall campaign it matched, and a short excerpt of what the caller said with names, numbers, addresses, amounts and codes removed. It never includes your name or your number. Check my spammer shows only combined counts, and only once at least 5 different members had the same number or script blocked. What you type into Check my spammer is not saved. Reports you send with "Report a spam number" are kept for review and are not counted as verified.

A spam call is only used on the Spammer of the Week wall with words from many members' calls, or when you tick "Share this spam call" on that call. An owner reviews every post first. By default we post the redacted words, read aloud by an AI voice in your browser, not the caller's real voice. You can untick the box to withdraw a call you shared.