Privacy notice

How 320px handles your data

Reviewed 12 October 2026. This notice describes what 320px does today. When processing changes, this page changes with it.

Who is responsible

Reach Out Labs GmbH, c/o Impact Hub Zürich, Sihlquai 131, CH-8005 Zürich, Switzerland, operates 320px. Questions about this notice go to hello@reachoutlabs.ch.

What we process

• Account data. Your name, username, 320px address and a password hash held by the sign-in service. When you request a recovery or forwarding address, the sign-in service stores the pending address and a verification proof. The address is used for recovery or forwarding only after you verify it.
• Messages. Email received at your address, including the original message and attachments, drafts you save, and messages you send.
• Generated context. Areas, topics, summaries, change records, search data and numeric representations of message text used to find related messages. Originals stay available next to all of it.
• Technical data. Connection details such as your IP address are used for sign-in protection and rate limiting. Reach Out analytics runs on public, sign-in and workspace pages, with screen-view, outgoing-link and page-attribute tracking enabled.

Why we process it

To receive, show, group and summarise your email, to answer questions you ask about it, to send messages you choose to send, to keep your account secure, and to meet legal obligations.

Services involved

• Mail transport. Our own mail service receives and sends email. It keeps separate message and delivery records, described on the data and retention page.
• Language models. To group and summarise messages and to answer questions, message text is sent to language models through OpenRouter and the model providers it routes to. Message content leaves our servers for that processing. Outputs are shown with links to their sources and never act on your behalf.
• Backups. Encrypted backups are stored with Hetzner Object Storage in Falkenstein, Germany, under the retention policy on the data and retention page.
• Availability and deletion records. A service hosted on Cloudflare checks that 320px is reachable and alerts us when it is not. It also stores deletion records containing a workspace identifier or a hash of a sign-in profile identifier, so deleted data can be removed after a backup is restored. It receives no message content.
• Usage analytics. Reach Out analytics loads a script from assets.usereachout.com and sends usage data to api.usereachout.com. Before sending an event, 320px removes URL queries and fragments, replaces workspace and message identifiers and long tokens in URL paths, and removes page titles and link text. It runs on the application pages around an email; it is not added to the isolated original-email view.

Cookies and local storage

320px uses a sign-in session cookie, a cookie that remembers which workspace you selected, and browser storage for layout preferences such as a collapsed sidebar. Reach Out analytics also stores a device identifier in local browser storage.

How long we keep data

Data is kept while your workspace exists. The data and retention page describes archiving, deletion, exports and backup snapshots in detail.

Your choices and rights

• Export the messages you can access from Data settings in the app.
• Delete a workspace, or your whole sign-in profile, from Data settings. Deletion is confirmed before it runs and cannot be cancelled afterwards.
• Contact us by email to request access, correction or deletion of your data, or to ask about how it is processed.

Changes

We update this notice when 320px changes how it handles data and show the review date at the top.