How We Handle Email

When you submit your email on /join, three things happen in sequence.

First, your email address is saved temporarily to our database alongside a SHA-256 hash of your email. The raw email is stored only so we can send you a verification code and, if you are invited, your invite link. It is used for no other purpose.

Second, within seconds, your email is passed to our Ghost email proxy. This is a small service that runs on our own server. The proxy receives your email, calls Postmark (our email delivery provider) to send the verification code, and immediately discards your email from memory. It is never written to disk by the proxy.

Third, you receive a 6-digit verification code. Once you enter it, your submission is marked verified. The raw email remains in our database only until you receive and use your invite, or until the retention period expires.

Retention periods: unverified submissions where the code is not entered within 30 days have their raw email deleted automatically by a scheduled job. The email hash is retained for duplicate detection. Verified submissions that are never acted on within 180 days have their raw email deleted automatically. The email hash is retained. Submissions marked declined or spam have their raw email deleted immediately. The email hash is retained.

This retention schedule complies with the Digital Personal Data Protection Act, 2023 (India).

When an admin reviews your application, one of three things happens. If accepted, you receive a welcome email and your raw email is deleted in the same step that activates your account. If declined, your application is marked rejected and your raw email is deleted in the same step. If suspended pending more information, the email stays only while the status remains pending; once it resolves, the same rule applies.

The same operation that grants you access also removes your email from our systems. The two are part of one act, not two separate ones.

The 6-digit code sent to your email is a one-time code that expires in 15 minutes. It is generated using a cryptographically secure random number generator. A hash of the code, not the code itself, is stored in our database. When you enter the code, we hash your input and compare hashes. We never store or compare plain codes.

The code confirms that you control the email address you submitted. It does not create an account. It does not grant access to the platform. It only moves your submission from unverified to verified.

If your submission is accepted, an admin sends you an invite from the admin panel. At that point, your raw email is retrieved from the submissions table. This is the only moment after your initial submission where the raw email is accessed. It is passed to the Ghost proxy, which sends the invite email via Postmark and immediately discards the email from memory. Your raw email is then deleted from the submissions table. The email hash is retained.

The invite contains a unique invite code. When you use it to register, your account is created and your submission record is closed.

The only thing Saroir keeps about your email after acceptance is a SHA-256 hash combined with a per-platform salt. This hash lets us send you magic-link sign-in messages and detect duplicate registrations from the same address. The hash is not reversible by anyone, including us.

When you sign in, your email passes through our Ghost mail proxy in memory only. It is forwarded to Postmark for delivery and immediately discarded from RAM. It is not written to any database at any point during sign-in. Postmark retains its own delivery logs under its policy, linked at the bottom of this page.

If you lose access to the email address you signed up with, there is no recovery flow. We cannot send a "forgot email" link because we cannot look up your email from your account. You would need to sign up again with a new address, after which a Saroir admin would have to accept the new application.

We use Postmark (postmarkapp.com) to deliver emails. When we send you an email, your email address is transmitted to Postmark's infrastructure. Postmark retains delivery records according to their own data retention policies, which you can review at postmarkapp.com/privacy-policy.

Saroir does not control Postmark's retention. If you want your data removed from Postmark's systems, you will need to contact them directly. We can provide the approximate date and message ID of emails sent to you on request. Write to [email protected].

These are not policy promises that a future operator could reverse. They are constraints baked into the system at the database and code layers. Reversing any of them would require shipping a migration plus an architectural decision record documenting why we changed our mind, and that record would be visible in our public wiki.

We cannot look up your email address from your account. Only the hash is stored.

We cannot share your email address with any third party after registration. It does not exist in our systems.

We cannot send you marketing email. We have no marketing email infrastructure. The only emails Saroir sends are magic links, verification codes, and invite links. All are transactional and triggered by your own actions.

We cannot recover your email if you lose access. There is no forgot email flow. If you lose access to your email address, you would need to create a new account with a new invite.

Our way of notifying you is the Saroir app (currently in planned development). Saroir broadcasts platform updates as in-app notifications when you next open the platform. There is no email-based newsletter, no opt-out token, no unsubscribe page, because there is no email infrastructure to support any of these things.

The welcome email is a one-shot event triggered by an admin acceptance. After that moment, your email is gone from our systems, so it cannot be re-used to send you another welcome email or any other follow-up.

We cannot sell your email or share it with marketers, because after acceptance we no longer have it. The architectural commitment in this section is the basis for the operational reality, not the other way round.

Under the Digital Personal Data Protection Act, 2023 (India), you have the right to know what personal data we hold about you, to correct inaccurate data, to request erasure of your data, and to nominate someone to exercise these rights on your behalf.

To exercise any of these rights, write to [email protected]. We will respond within 30 days. For pre-registration submissions, erasure means deletion of your raw email and all associated data. For registered accounts, erasure is handled through our account anonymisation process, which permanently replaces all identifiable data with randomised values.

If anything on this page is unclear or you believe it is inaccurate, write to [email protected]. We will respond and, if necessary, correct this page.

The Saroir Knowledge Foundation (Section 8, India) is responsible for this platform and its data practices.