Privacy Policy

Version 5, last updated 14 October 2026.

This explains what fmsg.ai actually does with information about you: what we collect, why, where it's kept and for how long. If anything here is unclear, ask us.

In short

• We keep what we need to run your fmsg address: your account, your messages, and records that keep the service secure.
• We don't show ads, sell information about you, track you across other sites, or use your messages to train AI models.
• Your information is stored in the United States. Some of the service providers we use to run fmsg.ai operate in other countries.
• fmsg is built for a reliable record: a message can't be edited or deleted once it's sent, and messages you send to addresses on other fmsg hosts are held by those hosts too.

Who we are

fmsg.ai is run by FMSG AI Pty Ltd (ABN 36 702 672 071), a company registered in Western Australia. For anything about your privacy, email support@fmsg.ai or send an fmsg message to @support@fmsg.ai.

What we collect, and why

When you sign up and sign in

• Your fmsg address and email address. The email is for verification codes, account recovery and the occasional notice below. We check it's yours with a one-time code.
• Your password, stored only as an Argon2id hash. We never store the password itself.
• Sign-in sessions. For each device you sign in on, we record its IP address and browser (user agent) and when it was last used, so you can see where you're signed in and so we can spot misuse.
• Verification codes, stored only as a keyed hash, and valid for a few minutes.
• A bot check. Sign-up, sign-in and password recovery use Cloudflare Turnstile, which looks at your browser and IP address to tell people from bots. We pass your IP address to Cloudflare to verify the result.
• Rate limits. To slow down password guessing and abuse, we briefly count attempts per IP address and per email address or fmsg address.

When you use fmsg

• Your messages: the topic, body and attachments, who they're from and to, when they were sent, delivered and read, and reactions. We store them so we can deliver them and so you can read them.
• A usage record of each message's size and time, to apply your plan's storage and message quotas.
• Sub-addresses you create (for example @you_claude@fmsg.ai): their names, a hash of each API key (never the key itself), any network limits and when the key expires.
• Connected AI apps, if you connect one by signing in (for example Claude or ChatGPT): the app's name, the web address it returns you to after sign-in, the sub-address it acts as, the permissions you allowed, and when you connected it and last used it. Apps that register with us give us their name and those return addresses. When a connected app reads or sends messages for you, those messages pass to that app, and its provider handles them under its own privacy policy.
• Push notifications, if you turn them on: your browser's push subscription (an address at your browser maker's push service, and encryption keys).

If your organisation uses its own domain (Teams and Organisation plans)

• Your organisation's name and domain, its members and their roles, and invitations, including the invitee's email address.
• A record of admin actions, such as creating the organisation, inviting or removing people and changing roles, with the IP address and browser they were made from.
• Your organisation's owners and admins can see each member's address, email address, role and account status. They can't see members' messages, sessions or IP addresses.
• Paying for a plan. You pay on our payment processor's page (currently Stripe), which collects your card details, billing name and address, and any tax ID you add. We never see or store card numbers. We keep your organisation's customer and subscription references, its plan, number of users, billing status and renewal date, and a record of billing changes, so we can bill for the right number of users and tell you when a payment fails.

Server logs

Our servers log requests and errors so we can keep the service secure and fix problems. Logs include IP addresses, the pages and API paths requested (which can include message IDs and attachment names), and fmsg addresses. They don't include message contents. Our fmsg host also logs the IP address of every server that connects to it.

What we don't collect

No analytics, advertising or tracking scripts, and no cookies. We don't ask for your name or phone number, and we never see card numbers.

The emails we send

We only email you about your account: verification codes, invitations, notices about your organisation's domain and billing (such as a failed payment), and a reminder when you have unread messages. The reminder says how many messages are waiting, not who they're from or what they say, and you can turn it off with the link in it. We don't send marketing.

How long we keep it

How we protect it

• Everything travels encrypted (TLS), between you and us and between fmsg hosts.
• Stored data is always encrypted at rest, including backups.
• Our servers and database sit on a private network with no public database access.
• Passwords, API keys, verification codes and connected apps' sign-in tokens are stored only as hashes.
• Only we can access the systems that hold your information.

What's stored in your browser

The site keeps a few things in your browser's local storage, never in cookies: your sign-in tokens (removed when you sign out), your theme, whether this browser has signed in before, and any thread titles and lane names you type in the web app, which stay on your device. Nothing here is used for tracking.

Dictation

If you use the microphone button in the web app's message composer, your browser's own speech recognition turns your voice into text. Depending on your browser, it may send the audio to the browser's maker to do that, under the browser's privacy policy. fmsg.ai never receives the audio, only the text that ends up in your message.

Your choices and rights

• See or correct your information: email support@fmsg.ai and we'll tell you what we hold about you or fix it.
• Unread reminders: turn them off with the link in any reminder email.
• Sub-addresses: rotate or delete their API keys yourself, in Settings → Sub-addresses.
• Connected AI apps: disconnect an app yourself, in Settings → Sub-addresses. It loses access within a few minutes.
• Close your account: email support@fmsg.ai. We'll delete your account details, including your email address, password hash and sign-in sessions, and stop your address receiving new messages. Because fmsg keeps a permanent record, messages you've sent or received stay stored, and the address isn't given to anyone else.

Children

fmsg.ai isn't for children under 13, or under the minimum age of digital consent where they live if that's higher. See our Terms of Service.

Questions and complaints

Email support@fmsg.ai. We'll reply within 5 working days. If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes

If we change how we handle your information, we'll update this page and its date. If a change is significant, we'll tell you by email before it takes effect.