Privacy
What this site collects
This page is about inbuxa.org, the website. It isn't about inbuxa the mail server, which runs on whatever machine its operator installed it on and never reports anything back here.
Last updated October 6, 2026
The short version
- Analytics runs only if you press Accept. Decline, or ignore the banner, and Google is never contacted from this site.
- You can change your mind at any time from Cookie settings in the footer. Turning it off deletes the cookies it set.
- Everything else on the page (stylesheet, scripts, fonts, images) is served from this domain. With analytics declined, the site loads nothing from a third party at all.
- There's no advertising, no profiling, no account to create, and nothing sold to anyone.
- No AI reads anything of yours. See AI below.
Who is responsible
The controller for this site is Coffey Labs LLC, an Arizona limited liability company, which publishes inbuxa. For anything on this page, including the rights below, write to privacy@coffeylabs.org.
Analytics, with consent
If you press Accept, this site loads Google Analytics, which sets cookies in your browser and sends Google your IP address, the pages you view, roughly where you came from, and general details about your device and browser. Google acts as our processor for this, and processes it on servers in the United States as well as the EU — a transfer that relies on the EU–US Data Privacy Framework and Google's standard contractual clauses.
The lawful basis is your consent, under GDPR Article 6(1)(a) and the ePrivacy Directive Article 5(3). That is why nothing loads before you answer: consent has to come first to be worth anything.
What your browser keeps
| Stored | What it is | How long |
|---|---|---|
inbuxa-consent | Your answer to the banner, kept in local storage so we stop asking. Set whichever way you answer. | Until you clear your browser storage |
inbuxa-theme | Light or dark, if you used the toggle. Kept in your browser's local storage, and never sent anywhere. | Until you clear your browser storage |
_ga, _ga_… | Google Analytics. Only ever set after you press Accept. | Up to 2 years, or until you decline |
The first two are how the site remembers a preference you expressed, so they are set without asking — refusing to remember that you refused would be its own kind of absurd.
Server logs
The web server records each request: IP address, time, the path asked for, the referrer and the browser's user-agent string. This happens for every visitor. It's what makes it possible to keep the site up, see that a deploy worked, and notice someone probing for a way in. The lawful basis is legitimate interests under GDPR Article 6(1)(f): running a service securely. Logs are kept short-term for operational purposes and aren't used to build a profile of anyone.
Cloudflare
This domain is served through Cloudflare, which sits between you and the origin server, terminates TLS, and caches static files. Cloudflare necessarily sees the requests it passes through and acts as our processor for that. It is how the site stays reachable, and it applies whether or not you accept analytics.
AI
Nothing you do here is sent to an AI service. This site has no AI feature of any kind: no assistant, no chat, no scoring or profiling of visitors.
In the mail server, AI is something an operator can choose to turn on: the spam filter can ask a language model the operator hosts for its opinion on a message. It's off by default, and it never calls an outside AI service unless the operator points it at one.
AI tools were used in writing the project: parts of its code, its specifications and this website were drafted with their help, and every contribution is reviewed, tested and maintained by a person. That's a fact about how the software was built, not about your data.
Your rights
If the GDPR applies to you, you have the right to:
- ask what personal data we hold about you, and get a copy;
- have it corrected, or erased;
- restrict or object to how it is processed;
- receive it in a portable form;
- complain to your data protection authority if you think we've got this wrong.
Links out
This site links to coffeylabs.org, ihasmail.org, the Stalwart project and the GNU license text. Following a link puts you on someone else's site under someone else's privacy notice; nothing here follows you there.
Changes
If this notice changes in a way that affects what you agreed to — a new processor, a new purpose — the banner asks again rather than quietly carrying your old answer forward onto something new.