1. The service
boldmail.io is a programmable hosted mailbox. We give you an address on @boldmail.io and a way to read, search, thread and send through HTTP, hosted MCP, and IMAP/SMTP. V1 does not host customer domains.
These terms are issued by the operator of boldmail.io, hosted in Frankfurt, Germany. Contact: hello@boldmail.io. We have not published an Impressum. When the legal entity is confirmed, we will name it here.
If you use the service on behalf of an organization, you confirm you can bind that organization. “You” then means both you and that organization.
2. Open beta
The product is in open beta. Features, limits, hostnames and APIs can change. There is no uptime SLA, no message-quota promise, and no credits for downtime. We may pause sending, tighten caps, or refuse a username without owing you a reason beyond abuse or capacity.
You can create an account and a mailbox without a card. That is not a perpetual free tier. Paid plans, if we offer them, will be described separately before we charge.
3. Accounts and claiming
An agent may create a mailbox with POST /v0/agent/sign-up. Until a human claims that organization by proving their email:
- public internet mail is off in both directions;
- extra inboxes are off;
- the API key is a secret — if it leaks, rotate it.
A console sign-up creates a first inbox. Public internet mail stays off until the owner’s email is proved, unless Google has already verified that address.
You are responsible for every action taken with your passwords, sessions, API keys, MCP tokens and mail-app passwords. Keep secrets out of git, URLs, MCP config files and chat logs.
Reserved local-parts (for example privacy, legal, admin) are not available as customer usernames.
4. Addresses
An @boldmail.io address is a licence to use that mailbox on our domain. You do not own the domain, the reputation of the domain, or the right to keep a username after the account ends. We may reclaim names that impersonate us, collide with reserved terms, or were obtained to squat.
Custom domains are not in V1. Do not publish DNS that pretends otherwise.
5. Acceptable use
You and your agents must not:
- send unsolicited bulk mail, phishing, malware, or anything a reasonable recipient would treat as spam;
- use the service for unlawful content or to violate another person’s rights;
- probe, overload or bypass the service, other tenants, or our providers;
- impersonate boldmail.io, a payment brand, a government, or a person without authority;
- share an inbox across unrelated customers in a way that breaks tenant isolation;
- mine, scrape or harvest third-party inboxes through us as a cut-out.
You are responsible for what your agents send. “The model did it” is not a defence. If a recipient complains, we may pause sending for the organization while we look.
6. Your content
You keep whatever rights you have in mailbox content. You grant us a limited licence to store, index, transmit, display and back up that content solely to provide the service — including handing outbound copies to our transport provider and posting events to webhook URLs you configure.
Mail is untrusted. Treat inbound messages, attachments and links as hostile until your own software has checked them. We do not promise antivirus, legal hold, e-discovery, or a documented backup/restore SLA.
If you leave, take your mail over IMAP (or the API) first. After we close an account we are not obliged to keep a copy for you.
7. Sending and deliverability
A successful API or SMTP submission means we accepted the message into the mailbox pipeline. It does not mean the remote provider delivered it, or that it landed in the inbox rather than spam.
Launch sending is capped and may be off until an administrator enables it for the platform or for your organization. Caps can change. Dedicated IPs are not in V1. We send from @boldmail.io; your deliverability is tied to that domain’s reputation as well as your own behaviour.
Outbound internet mail is transported through Amazon SES in the EU. Bounce and complaint feedback may cause us to stop further sends to an address or to pause the organization.
8. Privacy
The privacy policy is part of these terms. You must not use the service to process other people’s data unless you have a lawful basis. If GDPR (or a similar law) makes you the controller of mailbox content, you instruct us to process it only to provide this service.
9. Intellectual property
The service, APIs, console, skill, wordmark and documentation are ours (and our licensors’). You may use them only as needed to use the service. You may not copy the product, scrape the site for a competing dataset, or imply a partnership we have not agreed in writing.
10. Availability, support, changes
We will try to keep the service running. We do not warrant that we will. Maintenance, failures, provider outages (including SES) and force majeure can interrupt mail.
We may change the API, raise or lower limits, add or remove protocol hostnames, or discontinue a feature. For a breaking API change we will prefer a versioned path under /v0 rather than silently redefining a live route — but beta does not freeze the contract.
We may update these terms by publishing a new version on this page. The date at the top is the effective date. If you continue to use the service after that date, the new terms apply. If you do not agree, stop using the service and export your mail.
11. Suspension and termination
You may stop using the service at any time and delete inboxes or the account through the supported interfaces.
We may suspend or close an account immediately if we reasonably believe these terms are broken, if sending threatens the domain’s reputation, if required by law, or if the beta ends. We may also close idle unclaimed agent organizations.
On closure, licences to @boldmail.io addresses end. We may delete mailbox content from the live store. Export first if you still need it.
12. Warranty and liability
The service is provided “as is” during open beta. We do not warrant merchantability, fitness for a particular purpose, non-infringement, or that mail will be delivered, retained, or recoverable after a host failure.
Nothing in these terms limits liability for intent, gross negligence, injury to life, body or health, or liability that cannot be limited under German law (including the Product Liability Act).
Otherwise, we are not liable for lost profits, lost mail, lost reputation, substitute procurement, or indirect damage. For simple negligence we are liable only for breaching a duty that is essential to the contract, and only for typical, foreseeable damage. If you use the service as a consumer, your mandatory statutory rights stay intact.
13. Governing law
These terms are governed by the law of the Federal Republic of Germany, excluding conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods.
If you are a business, the courts of Frankfurt am Main have exclusive jurisdiction. If you are a consumer in the EU, you may also sue in the courts of your place of residence, and you keep the protections of the law of that country that cannot be derogated from by agreement.
If a clause is invalid, the rest remains. These terms are the whole agreement for use of the service, unless we sign something else with you (for example a DPA).
14. Contact
hello@boldmail.io · Frankfurt, Germany