Cookie Policy
Last updated: 8 November 2026
Polpo Mail uses only a few strictly necessary first-party cookies. We don't use advertising or third-party cookies. On our public pages, and only when you're not signed in, a privacy-friendly analytics script counts visits without using cookies; it's described below.
Cookies we set
| Name | Purpose | Duration |
|---|---|---|
pmail_session | Keeps you signed in and protects forms against cross-site request forgery. | Until you sign out, at most 14 days |
pmail_device | Remembers a browser you marked as trusted so you aren't asked for a two-step verification code every time, and lets us warn you about sign-ins from new browsers. | 30 days for trusted browsers, otherwise 1 year |
pmail_mfa | Holds a sign-in that is waiting for two-step verification. | 10 minutes |
pmail_flash | Shows a one-time confirmation message after an action, such as "User created". | 1 minute |
All of these cookies are marked HttpOnly and SameSite, and Secure when the site is served over HTTPS. They contain random identifiers only, never your password or personal details.
Website analytics (public pages only)
When you visit our public pages (home, pricing, legal pages, sign-in and sign-up) without being signed in, our own analytics service at analytics.polpo-8.com records which page you viewed, the page you came from, campaign tags in the link (utm_source, utm_medium, utm_campaign) and how long the page was visible. It sets no cookies. To count unique visitors it keeps two random identifiers in your browser:
| Name | Where | Purpose | Duration |
|---|---|---|---|
_pa_v | Local storage | Random visitor ID, to count returning visitors | Until you clear your browser data |
_pa_z | Session storage | Random visit ID, to group page views in one visit | Until you close the tab |
Analytics never runs inside webmail, settings or the admin console, and never on the two-step verification page. You can block it with any content blocker, or clear the identifiers in your browser settings at any time.
Local storage
Inside the web app we keep only small interface preferences in your browser (for example, whether you write in rich text). They are never sent anywhere.
Managing cookies
You can delete or block cookies in your browser settings. If you block the cookies above you won't be able to sign in, because they're needed for the Service to work.
Questions
Email [email protected].