Overview
MailDrop is a web application that lets you compose an email, choose recipients, add attachments, preview the result, and submit it for delivery through Resend. You do not create an account, connect a personal inbox, or provide your own email address to use the composer.
This deployment sends from the fixed address MailDrop <no-reply@maildrops.online>. The sender address is configured on the server and cannot be changed by visitors in the browser.
This notice describes the default behavior of the MailDrop application. The person or organization operating this deployment (the “site operator”) is responsible for the deployment and for any additional policies they publish.
What we process
When you submit the composer, the application processes:
- Recipient addresses that you enter, so that a separate copy can be requested for each person.
- Subject, message, and formatting so the email can be rendered into responsive HTML and a plain-text alternative.
- Attachments that you choose, so they can be attached to the email you submit.
- Delivery and technical metadata, such as the fixed sender address, provider message identifiers, submission outcome, timestamps, IP address, and browser information. The email provider and its infrastructure providers may process this metadata to deliver and secure the message.
- Abuse-prevention signals, including short-lived rate-limit counters, daily recipient quota counters, and a one-way hash of your IP address used for monitoring and rate limiting.
MailDrop does not ask for your name, phone number, personal email address, or mailbox credentials. Please do not include personal information in your message or attachments unless it is necessary for the recipients you chose.
Attachments
Attachments are validated in the browser and again on the server. Files are uploaded directly from your browser to a private Vercel Blob store, held only long enough to build and submit the email, and deleted after the send attempt completes. Any upload abandoned before sending is removed by a scheduled cleanup once it is more than one hour old. MailDrop does not write uploaded files to a database or the application filesystem, and it does not create public attachment links.
The email provider processes the attachment content in order to deliver the message. The provider's own retention settings apply to its delivery records and email logs. Only approved image and document formats are accepted; executable and script file types are blocked.
How we use it
- To render and preview the email you are composing at your request.
- To submit individual copies to the email provider for your recipients.
- To enforce rate, quota, and recipient limits.
- To detect abuse, protect the sending domain, and diagnose operational failures.
- To comply with legal obligations and enforce the acceptable-use policy.
MailDrop does not sell personal information, build advertising profiles, or use message content for marketing. There is no analytics or advertising tracker in the application.
Service providers
A production deployment may rely on the following infrastructure providers. Each provider processes only the data necessary for its role:
- Resend — delivery of the email, attachment processing, and delivery event records. Resend may retain email metadata and content according to its account configuration and policies.
- Upstash Redis — short-lived rate-limit counters and a global daily recipient quota. Stored keys use hashed identifiers, not raw email addresses or message content.
- Vercel — application hosting, serverless execution, private Blob storage for temporary attachment uploads, and operational logs. Application logs deliberately omit message content, recipient addresses, filenames, and attachment contents.
These providers may process data in countries other than yours. Their own privacy terms and data-processing agreements apply in addition to this notice.
Retention
- Message content, recipient lists, and attachments: message content and recipient lists are not retained by the MailDrop application after the request completes. Temporary attachment blobs are deleted after the send attempt, or by scheduled cleanup once an abandoned upload is more than one hour old. Content may be visible in the email provider's delivery records subject to the provider's settings.
- Rate-limit and quota counters: short windows of 10 minutes to 24 hours, plus a daily global recipient counter retained for up to 48 hours.
- Application logs: operational events without message content, recipient addresses, filenames, or attachment contents, retained according to the hosting provider's log retention.
- Hashed IP identifiers: used in security logs and rate limiting, not reversible through the application.
Cookies and local storage
MailDrop does not use advertising cookies, cross-site tracking pixels, or account session cookies. The composer keeps your draft in browser memory only; it is not saved to local storage by MailDrop.
Security
Sending happens exclusively on the server. The Resend API key is never exposed to the browser, and the From address is fixed by the site operator. The application uses server-side validation, HTML escaping, header-injection protection, attachment type and signature checks, rate limiting, and a daily recipient quota. Attachment uploads use short-lived, path-scoped tokens for a private Blob store; the store credentials are never sent to the browser. Transport between your browser and the application is encrypted when served over HTTPS.
No system is completely secure. Do not send sensitive information such as passwords, financial account numbers, government identifiers, or health records unless you are comfortable with the email provider processing it.
Your choices and rights
Because MailDrop does not maintain a mailbox or a contact database, there is usually no stored message or recipient list to access or delete. You can choose not to include personal details in a message. If you need to exercise a privacy right or ask about a specific deployment, contact the site operator through the contact channel they publish for this site. You may also contact the relevant infrastructure provider directly.
MailDrop is not directed to children under 13, and the service should not be used to send content that is unlawful, abusive, or unsolicited.
Changes to this notice
This notice may be updated when the application, its providers, or legal requirements change. The “last updated” date at the top of the page reflects the current version. Material changes should be communicated by the site operator where appropriate.
For the rules that apply to using the service, see the acceptable-use policy. This notice describes an application's default configuration and is not a substitute for legal advice; the site operator should review it for their specific deployment and jurisdiction.