Privacy policy
Effective date: October 3, 2026.
This policy describes how Mike Garrett, doing business as MailKey ("MailKey", "we") handles personal data in the MailKey service at mkey.ai and app.mkey.ai. Questions go to [email protected].
What we hold
- Your name, exactly as you typed it, and your mailing address, standardized against USPS data.
- Your sign-in details. Sign-in uses passkeys or email codes through WorkOS, so MailKey never stores a password.
- Records of activity on your key: every lookup, every claim, every read of your address, and the date each address was last confirmed.
- For households, the people an account manages, including children and other dependents, with a flag that marks a person as a minor.
MailKey does not ask for a date of birth or a government ID.
Who receives your address
Only people and businesses you have given your key to, and only after they claim your record, and AI assistants that you, or a person you shared with, have connected (see AI assistants). A lookup shows a masked preview (first name, last initial, city and state) until the claim. Depending on your settings, a claim may wait for your approval. Nobody can look you up without your key.
MailKey never sells data. We share your address with a business or another MailKey user only by your consent, and you can revoke that access at any time.
AI assistants
You can connect an AI assistant, such as a chatbot app, to MailKey. A connected assistant receives your name and standardized address, and it receives the current one after you move. If you turn it on separately, it can also read the addresses in your address book. The company that runs the assistant then holds those copies under its own terms, not ours. You can see each assistant in Address Leases and disconnect it at any time. An assistant never receives a child's address.
A person you shared your address with may connect their own assistant and allow it to read their address book, which includes your address. Such a read appears to you as a read by that person.
Address requests and invites
When a host invites you to an address request, MailKey emails you on the host's behalf: one invitation, and at most two reminders that the host chooses to send. We keep the label the host gave you and your email address only while the request needs them, and delete them when the request closes or 90 days after the invitation, whichever comes first. Every invitation has a one-click unsubscribe link; after you unsubscribe, MailKey never sends you another invitation, from any host. Answering is up to you, and the host receives your address only if you share it.
Children
An adult manages a child's key. Businesses cannot reach a child's record: a lookup of a child's key looks the same as a key that does not exist. Another MailKey user can claim a child's address only when a managing adult approves. A child's address is never available to an AI assistant.
What you can see
You can see every business and person that holds your address, every lookup of your key, and every read of your address. A business that released your address is labeled as one that may still have a copy. Our business terms require it to delete that copy.
How it is protected
- Names and addresses are encrypted in the database with keys held outside it, on top of the database provider's own encryption at rest.
- Logs never contain names, addresses or keys.
- Every disclosure is written to an audit trail that you can see.
Service providers
MailKey runs on Cloudflare and stores data in a Postgres database hosted by Supabase. WorkOS handles sign-in, and USPS address services standardize addresses. Cloudflare sends our transactional email, with SMTP2GO as a backup sender, and WorkOS sends sign-in codes. If you add your key to Apple Wallet or Google Wallet, Apple or Google stores that pass. These providers handle data only to run MailKey.
Keeping and deleting your data
You can export everything as JSON at any time. You can delete a person or your whole account. Deletion revokes every grant, notifies the businesses and people who held your address, and removes your personal data within 30 days.
A business that received your address before you deleted it may still hold a copy. Our business terms require it to delete the address when it releases it or when you revoke it.
Changes to this policy
If we change this policy we will update the effective date above. For a material change we email account holders at least 30 days before it takes effect.
Contact
Mike Garrett, doing business as MailKey. Email [email protected].