Edgepost privacy policy

Last updated: 14 October 2026

In short: Edgepost has no server, and its author collects no personal data. The app talks only to the Cloudflare^® API and to a mail Worker that runs in your own Cloudflare account. Your API token stays in your device's secure storage. Nothing is sold, shared, tracked or used for advertising.

Who is responsible

Edgepost is published by Mourad Ghafiri, a private individual. It is an independent app, not made by Cloudflare, Inc.: the Cloudflare services it connects you to are provided by Cloudflare, under your own agreement with it. Write to contact@edgepost.dev with any question about this policy.

The Edgepost app

What we collect

Nothing. The author runs no server for Edgepost and receives no data from the app: no account, no analytics, no crash reports, no advertising identifiers, no tracking of any kind.

What the app sends, and where

The Cloudflare API. To show and change your domains, DNS records, settings, traffic, Workers and Pages, the app sends requests to the Cloudflare API with the API token you added. Cloudflare handles them under your own agreement with Cloudflare and its privacy policy.
Your mail Worker. Mail you send, and changes you make to your mail (read, starred, archived, deleted), go to the mail Worker in your own Cloudflare account, which sends through Cloudflare Email Sending. See Your mail Worker.
Images in mail. Remote images in HTML mail are blocked, because they can tell the sender that you opened a message. If you tap Load images, the app fetches them from the servers that host them, which see your IP address like any website you visit.
Links. Links you tap, in mail or in the app, open in your browser or the matching app, after you see where they go.

Device features

Face ID, Touch ID and fingerprint. If you turn on app lock, your device checks your face or fingerprint; Edgepost only learns whether it matched. Nothing about them reaches the app.
Notifications. New-mail, budget and delivery alerts are made on your device, from the app's own checks of your Worker and of Cloudflare. There is no push service in between.
Files and photos. The app reads a file only when you pick it, to attach it to a message or to use it as a domain's logo.

Your mail Worker

When you set up mail, the app deploys a Worker named edgepost-mail into your Cloudflare account, with a D1 database and an R2 storage bucket, and connects it to Cloudflare Email Routing for the domains you choose. It is yours: it runs under your account and your agreement with Cloudflare, and the author has no access to it.

It keeps the mail your domains receive, the copies of mail you send (from which it suggests the addresses you have written to), their attachments, each domain's signature and logo, and counts of how many messages you have sent (to keep you within your sending limit). The app protects it with a key it makes on your device.

What stays on your device

Your Cloudflare API tokens and your mail Worker's key, in the system's secure storage (the Keychain on iPhone and iPad, the Android Keystore on Android).
A cache of your Cloudflare data and recent mail, so the app opens quickly and works for a while offline.
Drafts you have not sent, and your settings: appearance, alerts, pinned domains, app lock.

None of it leaves your device except as described above. Your device's own backup may include the app's data, under your backup provider's terms.

Deleting your data

An account: in Settings, open the account and choose Remove from Edgepost. Its token and its cached data are erased from your device. You can also delete the token itself in the Cloudflare dashboard.
Your mail: delete the edgepost-mail Worker, its D1 database and its R2 bucket in the Cloudflare dashboard.
Everything on the device: remove the accounts, then delete the app.

This website

No cookies, no tracking

This website sets no cookies, runs no analytics and loads nothing from other sites: its fonts and images are served with it.

Logs kept by our host

The site is hosted by GitHub Pages. GitHub states that when a GitHub Pages site is visited, the visitor's IP address is logged and stored for security purposes (GitHub's documentation). GitHub handles those logs under its privacy statement; the author does not receive them.

Links to other websites

This site links to other websites, such as GitHub, Cloudflare and the app stores, which have their own privacy policies.

When you contact us

If you email us, we use your address and your message only to answer you, and delete them when they are no longer needed for that. Issues you open on GitHub are public, under GitHub's terms.

The author holds no data about you from the app, so there is nothing to share, sell or transfer. The app connects you directly to Cloudflare, a provider you chose and contract with yourself.

Your rights

Wherever you live, you can ask what we hold about you, and ask us to correct or delete it. For the app, the answer is nothing: the data is on your device and in your own Cloudflare account, where you control it. For an email you sent us, write to contact@edgepost.dev.

In the European Union and the United Kingdom you also have the rights the GDPR gives you, including the right to lodge a complaint with a data protection authority, such as the CNIL in France. We do not sell or share personal information as California law defines those terms.

Children

Edgepost is a tool for people who run domains on Cloudflare. It is not directed at children, and it collects no data from anyone.

Changes to this policy

If this policy changes, the new version is published here with a new date. The app links to this page from Settings.