Personal inboxes
A personal inbox is readable only by its owner. Workspace admins and Nebula platform staff cannot read it. They can see nothing except counts (for example how many emails were sent).
Shared inboxes
A shared inbox is readable by the people added to it. Drafts inside it are still private to their author.
Discord and notifications
Nothing is sent to Discord unless you turned the Discord DM on for that inbox. Even then it never includes attachments.
Stored emails
Emails stay until someone deletes them. Moving to the trash is not permanent for 30 days.
Mail is stored in Rosterr's own database. Emails are removed from the mail server once Rosterr has stored them, so Rosterr's database is the one place they live.
Each mailbox has a random password that Rosterr keeps encrypted and never shows. Nobody signs in to the mail server directly.
Contacts
Your contacts are private to your inbox (and shared with a shared inbox's readers). Nobody else can see them.
Deleting accounts and workspaces
Mail is not linked to user or workspace records in the database in a way that blocks deletion, so deleting an account or workspace is never held up by mail. (Old mailboxes can be cleaned up afterwards.)
Safe viewing
Emails are shown so that nothing in them can run. Remote pictures are not loaded unless you choose to show them (newer Mail).
Related articles
Mail: what it is and how email addresses work
Mail attachments: sizes, blocked files and virus checks
Privacy: what Rosterr collects, who sees it, and how to ask for a copy