Bucktooth Mail is an email sending and deliverability service. This policy explains what personal information we handle, why we handle it, who we share it with, and how you can get out of any of it. It is written to be read, not to be survived.
1. Who we are
Bucktooth Mail is a service operated by Sentinel Holdings I LLC, a Wyoming limited liability company. In this policy, “we,” “us” and “our” mean Sentinel Holdings I LLC. “Bucktooth Mail,” the “Service” and the “Platform” mean the website at bucktoothmail.com and the sending application at send.bucktoothmail.com.
Sentinel Holdings I LLC is the party responsible for the personal information described in this policy. Our address and contact details are in section 16.
2. Who this policy covers
Three different groups of people encounter Bucktooth Mail, and they are treated differently:
- Website visitors — anyone who loads bucktoothmail.com. We collect almost nothing about you. There is no signup form and no advertising tracker on this site.
- Platform users — the authorized operators who log in to send.bucktoothmail.com to configure domains and send mail. Access is granted by us; the Platform is not open for public self-registration.
- Email recipients — people who receive a message sent through the Platform. Section 6 explains what is measured when you open or click, and section 12 explains how to stop receiving mail entirely.
3. Information we collect
From website visitors
Standard web server logs: IP address, browser user agent, the page requested, the referring page, and the date and time. These are generated automatically by our web server and are used to keep the site running and to investigate abuse. We do not run advertising or analytics trackers on bucktoothmail.com.
From platform users
Account name, email address, a salted password hash (never the password itself), two-factor authentication settings, and an audit log of significant actions taken in the Platform — who changed a setting, sent a campaign, or exported data, and when. Session cookies keep you logged in.
About email recipients
Contact records loaded into the Platform, which typically include:
- Email address, and where provided, first and last name
- Consent and source information — where the address came from, when it was collected, and the IP address and page URL recorded at the point of signup, where available
- Delivery and engagement events — sent, delivered, bounced, complained, opened, clicked, unsubscribed
- Technical detail captured with those events, described in section 6
We also maintain suppression lists: records of addresses that must never be mailed, because they unsubscribed, complained, hard bounced, or appear on a list we honor. A suppression record is deliberately kept after an address is otherwise deleted — keeping it is the only way to guarantee we do not mail you again. This is explained further in sections 10 and 12.
4. Google account data
The Platform can connect to Google Postmaster Tools using Google OAuth, so that an authorized operator can see the reputation and spam-complaint statistics that Google reports for our own sending domains. This connection is made by our own staff, using our own Google account, for our own domains.
What we access
With your permission we request two scopes, and no others:
- .../auth/postmaster.traffic.readonly — read-only. Returns aggregate statistics: domain reputation, IP reputation, spam complaint rate, authentication pass rates, encryption rates and delivery errors.
- .../auth/postmaster.domain — lets us register our own sending domains with Postmaster Tools and complete their DNS verification. This scope can write, so we state plainly what we do with it: we add, verify and read our own domains. Nothing else.
The data these return is aggregate and statistical. It describes domains, not people.
What we do not access
We do not request and cannot read your Gmail messages, contacts, calendar, files, or any other Google service. The scopes above are the only Google scopes the application requests, they are limited to Postmaster Tools, and neither is one of Google's restricted scopes. We do not request the broader .../auth/postmaster scope, nor the user-management scope, because we do not need them.
How we store and use it
The OAuth refresh token issued by Google is stored on our own server in a file readable only by the application account, and is used solely to obtain short-lived access tokens for the Postmaster Tools API. Statistics retrieved from Google are stored in our database and shown on our internal deliverability dashboard. They are not sold, not shared, and not used for advertising or profiling.
Google API Services Limited Use. Bucktooth Mail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer this data to third parties except as necessary to provide or improve the Service, to comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising; and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymized.
How to revoke it
Access can be withdrawn at any time from the Google Account permissions page at myaccount.google.com/permissions, which immediately invalidates our token, or by contacting us using the details in section 16. On revocation we stop retrieving new data and delete the stored token.
5. How we use information
We use the information described above to:
- Send the email messages our users have configured, to the recipients who are eligible to receive them
- Suppress addresses that must not be mailed, before every send
- Measure whether mail is reaching the inbox, and diagnose it when it is not
- Authenticate operators, keep accounts secure, and maintain an audit trail
- Detect, investigate and prevent abuse, fraud and security incidents
- Maintain and improve the Service
- Comply with legal obligations and to establish, exercise or defend legal claims
We do not use personal information to build advertising profiles, and we do not make decisions about you by automated means that produce legal or similarly significant effects.
6. Email tracking
Messages sent through the Platform may include open tracking and click tracking. This is standard for commercial email, but you are entitled to know exactly what it does.
Open tracking
A small, invisible image is included in the message. When your email client loads it, our server records that the message was opened, the date and time, your IP address and your user agent. If your email client blocks remote images — many do by default, and some providers load them through a proxy — no open is recorded, or the open is attributed to the proxy rather than to you.
Click tracking
Links in the message point at a tracking hostname we operate. When you click, our server records the click, the date and time, your IP address and your user agent, and then redirects you to the destination. We use these signals to distinguish real recipients from automated security scanners, which click every link in every message.
Turning it off
Blocking remote images in your email client prevents open tracking. To stop click tracking, and everything else, unsubscribe — see section 12. We do not use tracking pixels to identify you across other websites, and we do not combine this data with information purchased from data brokers.
9. Service providers
We use a small number of vendors to run the Service. Each processes data only on our instructions, for the purpose named:
- Amazon Web Services, Inc. — Amazon Simple Email Service, which transmits our outbound email
- DigitalOcean, LLC — the servers on which the Platform and its database run
- Cloudflare, Inc. — authoritative DNS for our sending and tracking domains, and routing of inbound mail sent to our unsubscribe and abuse addresses
- Google LLC — Google Postmaster Tools, which reports reputation statistics for our sending domains, as described in section 4
This list reflects the providers in use when this policy was last updated. We will update it when it changes.
10. How long we keep it
- Web server logs — rotated and deleted on a rolling basis, ordinarily within 90 days
- Contact records — kept while the address remains mailable, and deleted on request
- Delivery and engagement events — retained while they remain useful for deliverability analysis, ordinarily up to 24 months
- Consent records — retained for as long as we may need to evidence that consent, and for a reasonable period afterwards, because being unable to prove consent is itself a legal exposure
- Operator audit logs — retained for security and accountability
- Suppression records — retained indefinitely, by design
A suppression record is the smallest amount of data needed to remember “never mail this address.” If we deleted it, the address could be re-added by a later import and you would start hearing from us again. Deleting your data therefore leaves the suppression entry in place, and that is the outcome that actually protects you.
11. Security
We use reasonable administrative, technical and physical safeguards designed to protect personal information, including encryption in transit (TLS), encrypted credential storage, hashed passwords, two-factor authentication for operator accounts, role-based access limited to staff who need it, and audit logging.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.
12. Your choices and rights
Unsubscribing
Every commercial message we send contains all of the following:
- A visible unsubscribe link in the message footer
- A one-click unsubscribe header, so that the unsubscribe button built into Gmail, Apple Mail, Outlook and similar clients works without opening the message
- An unsubscribe email address you can simply reply to
Any of these routes works. Unsubscribes are processed automatically and immediately, and the address is added to our suppression list. You can also write to the unsubscribe address shown in that message at any time.
Access, correction and deletion
You may ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Write to privacy@bucktoothmail.com from the address concerned, or from another address if you can reasonably identify yourself. We will respond within the time required by applicable law, and in any event without undue delay. We may need to verify your identity first, and we may decline a request where the law permits or requires us to retain the information.
State privacy rights
Residents of California, Florida, Colorado, Connecticut, Virginia, Texas and other states with comprehensive privacy laws may have additional rights, including the right to know what personal information is collected, to obtain a copy of it, to correct or delete it, and to opt out of its sale or of targeted advertising. We do not sell personal information and we do not use it for targeted advertising, so there is nothing to opt out of on those two points — but you may exercise any of your other rights using the contact details above, and we will not discriminate against you for doing so. If we deny a request, you may appeal by replying to our response; we will inform you of the outcome and, where applicable, of your right to contact your state attorney general.
Reporting abuse
If you received a message you believe should never have been sent, tell us at abuse@bucktoothmail.com. We investigate every report, and we would rather hear from you than from your mail provider's complaint feed.
13. Children
The Service is intended for adults. It is not directed to children under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.
14. Where data is processed
The Service is operated from the United States, and personal information is stored and processed there. If you access the Service or receive mail from us elsewhere, you understand that your information will be transferred to and processed in the United States, where data protection law may differ from that of your own country. The Service is intended for recipients in the United States.
15. Changes
We may update this policy. When we do, we will revise the “Last updated” date at the top of this page. If a change materially affects how we use your personal information, we will provide more prominent notice — by email where we hold your address for that purpose, or by a notice on this site. Continuing to use the Service after a change takes effect means you accept the revised policy.
16. Contact us
Privacy questions, requests and complaints all go to the same place:
d/b/a Bucktooth Mail
1613 Evans Ave #530
Cheyenne, WY 82001
United States
Privacy: privacy@bucktoothmail.com
Abuse: abuse@bucktoothmail.com
Unsubscribe: the unsubscribe address shown in that message
Web: bucktoothmail.com
You can also reply directly to any message you received from us. Replies reach a monitored mailbox, not a void.