Last updated: August 7, 2026
Last Updated: August 7, 2026
By accessing or using NOVA Mail ("the Service"), you agree to be bound by these Terms of Service ("Terms"). If you do not agree to all of these Terms, you may not access or use the Service. These Terms constitute a legally binding agreement between you ("User," "you," or "your") and NOVA Mail ("we," "us," or "our").
"Account" means the user account created to access the Service. "Content" means any email messages, attachments, files, data, or information transmitted, stored, or processed through the Service. "Disposable Account" means a temporary Account that expires and is automatically deleted after ten (10) days. "Kid Account" means an Account created by a parent or legal guardian for a minor child. "Parent" means the parent or legal guardian who creates and manages a Kid Account. "Service" means the NOVA Mail email hosting service operating under the nova-email.com domain.
You must be at least 13 years of age to use the Service. Users under 18 must have parental or legal guardian consent. Kid Accounts require a Parent to create and manage the Account.
To register, you must provide a valid email address and create a password. You agree to provide accurate, current, and complete information. You are solely responsible for maintaining the confidentiality of your login credentials.
A maximum of five (5) Accounts may be registered per verified email address. Disposable Accounts are limited to three (3) active Accounts per IP address. Kid Accounts require a verified Parent Account.
All Accounts require email verification via a one-time code sent to the provided email address. Verification codes expire ten (10) minutes after issuance.
Standard Accounts provide full access to all Service features, including email sending and receiving, external account synchronization, and all customization options. Storage is generous and always free; your current storage limit is shown in Account settings.
Disposable Accounts are temporary Accounts that expire and are automatically deleted ten (10) days after creation. A maximum of three (3) Disposable Accounts may be active per IP address simultaneously. Disposable Accounts may be manually deleted by the user at any time. Disposable Accounts cannot be recovered after expiration or deletion. Disposable Accounts do not require an external email address for verification.
Kid Accounts are created by a Parent for a minor child. Kid Accounts are subject to additional parental controls including but not limited to: approved contacts list only, restricted external sending, and content filtering. The Parent retains full control over the Kid Account, including the ability to view activity, modify settings, and delete the Account. By creating a Kid Account, the Parent represents that they have legal authority to consent on behalf of the minor child.
For a comprehensive overview of our security practices, encryption architecture, and vulnerability disclosure program, see our [Security Policy](SECURITY.md).
All email message bodies are encrypted at rest using AES-256-GCM (Advanced Encryption Standard with 256-bit keys in Galois/Counter Mode). Key details:
NOVA Mail employs a single-tenant encryption model. A single encryption key encrypts all message bodies at rest. This key is:
Attachments use envelope encryption: each attachment is encrypted with its own random AES-256-GCM data key, and that data key is wrapped by a separate key-encryption key stored in Cloudflare Secrets. Only the wrapped data key is stored with the attachment.
Future iterations will introduce per-user encryption keys for enhanced isolation.
All passwords are hashed using Argon2id (m=64 MiB, t=3, p=1 — the OWASP-recommended configuration) with a unique per-user salt. Accounts created before the Argon2id migration authenticate with PBKDF2-HMAC-SHA-512 (100,000 iterations) and are automatically upgraded to Argon2id on their next successful login. This makes brute-force and dictionary attacks computationally infeasible.
The following rate limits apply to protect the Service and its users:
| Limit | Threshold |
|---|---|
| Outbound messages | 20 per 60 seconds per user |
| Login attempts | 5 per 5 minutes per IP address |
Exceeding these limits will result in a temporary 429 (Too Many Requests) response. Repeated violations may result in Account suspension.
Accounts are temporarily locked after five (5) failed login attempts within a five (5) minute window from a single IP address. Lockout duration increases exponentially with repeated attempts.
Session tokens expire twenty-four (24) hours after issuance. All sessions are logged with IP address and user agent information. Users may view and revoke active sessions from Account settings.
You are responsible for maintaining the security of your password and for all activities that occur under your Account. You must notify us immediately of any unauthorized use of your Account.
The Service is intended for lawful personal and business email communication.
The Service supports sending and receiving email messages in HTML format. All HTML content rendered by the Service passes through a server-side sanitizer that strips:
<script>, <iframe>, <object>, <embed>, <applet> tagsonclick, onerror, onload, onmouseover, etc.)javascript: URLs and other pseudo-protocols<base> tags and other document-manipulating elementsYou agree not to attempt to bypass the HTML sanitizer or send malicious HTML content through the Service.
You agree NOT to:
a) Send spam, unsolicited bulk messages, or commercial advertisements without proper consent; b) Transmit malware, viruses, ransomware, or any malicious code; c) Engage in phishing, pharming, social engineering, or identity theft; d) Use the Service for any illegal activity under applicable local, state, federal, or international law; e) Harass, threaten, abuse, or intimidate other users or individuals; f) Impersonate any person or entity, or falsely state or misrepresent your affiliation; g) Attempt to gain unauthorized access to any user Accounts, systems, or networks; h) Interfere with or disrupt the integrity or performance of the Service; i) Reverse engineer, decompile, or disassemble any aspect of the Service; j) Use automated scripts, bots, or scrapers to access or interact with the Service without express written permission; k) Create Accounts for the purpose of circumventing Account restrictions, bans, or limitations; l) Use the Service to store or transmit child sexual abuse material or any illegal content; m) Use the Service to store or transmit content that violates the intellectual property rights of others.
We reserve the right, but have no obligation, to investigate and take appropriate action regarding violations of these Terms, including suspending or terminating Accounts, removing Content, and reporting violations to law enforcement authorities.
NOVA Mail complies with the CAN-SPAM Act of 2003. By using the Service to send email, you agree to:
X-Postal-Address header (548 Market St, PMB 92696, San Francisco, CA 94104).NOVA Mail is an email service provider. While we do not monitor or control the content of your communications, we reserve the right to take action against accounts that violate these Terms or applicable law, including CAN-SPAM.
We collect only the minimum data necessary to provide the Service: a) Email address (for identification and communication); b) Account preferences and settings; c) Email metadata (sender, recipient, subject, timestamp); d) Connection data (IP address, user agent, session information).
We expressly do NOT: a) Read, scan, or analyze email message content for any purpose; b) Train artificial intelligence or machine learning models on user data; c) Sell, rent, or license user data to third parties; d) Track user activity outside the Service; e) Share user data with advertisers or marketing platforms; f) Use any form of AI-driven features including smart replies, auto-classification, content suggestions, or predictive text.
All data is stored on Cloudflare's global infrastructure. Message bodies are encrypted at rest using AES-256-GCM. Data is replicated across multiple geographic regions for redundancy and availability.
Your data is retained for the duration of your Account's active status. Upon Account deletion, all associated data is permanently and irreversibly deleted within thirty (30) days. Disposable Accounts are automatically purged upon expiration or manual deletion.
You may export your data at any time through Account settings. Export includes all messages, contacts, and settings in a portable format.
NOVA Mail does not automatically scan, classify, or filter the content of your messages. There is no AI and no rule-based content analysis of message bodies. You control your inbox: you can move messages to your Spam folder, move them out, or delete them, and you can report a message as spam.
Inbound mail is verified with SPF, DKIM, and DMARC authentication, and .exe/.msi attachments are rejected at send time. Messages you mark as spam are moved to your Spam folder; messages you report are used for deliverability tuning only — never content analysis.
You control what happens to your mail. You can move messages to your Spam folder, delete them, and report spam — no message is filtered without your action. Filter rules (automatic actions such as moving, starring, or archiving messages from specific senders) are under development and will be available to all users.
For Kid Accounts, parental control settings (contacts-only mode, external sending, and content filter level) are created at registration and managed by the parent through the parental-controls interface.
The Service, including its code, design, branding, and infrastructure, is owned by NOVA Mail. You may not reproduce, distribute, or create derivative works without express permission.
You retain all ownership rights to your email messages and data. We claim no intellectual property rights over your Content.
The Service lets you link external email accounts via IMAP (credentials stored encrypted at rest with AES-256-GCM). We are not responsible for the privacy practices or security of third-party services.
The Service complies with the Children's Online Privacy Protection Act (COPPA). Kid Accounts require verifiable parental consent. Parents have the right to review, modify, or delete their child's data at any time.
Parents may: a) Review the parental control settings created for the Kid Account (contacts-only mode, external sending, content filter level); b) Adjust these settings through the parental-controls interface; c) Delete the Kid Account at any time.
THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE.
NO DIRECTOR, OFFICER, EMPLOYEE, OR AGENT OF NOVA MAIL MAKES ANY REPRESENTATION OR WARRANTY OF ANY KIND REGARDING THE SERVICE.
TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL NOVA MAIL, ITS DIRECTORS, OFFICERS, EMPLOYEES, OR AGENTS BE LIABLE FOR ANY INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR EXEMPLARY DAMAGES ARISING OUT OF OR IN CONNECTION WITH THE USE OF THE SERVICE, INCLUDING BUT NOT LIMITED TO:
a) Data loss or corruption; b) Service interruptions or downtime; c) Unauthorized access to or alteration of transmissions or data; d) Damages for loss of profits, goodwill, use, or data; e) Third-party email delivery failures; f) Statements or conduct of any third party on the Service.
OUR TOTAL LIABILITY TO YOU FOR ALL CLAIMS ARISING FROM OR RELATING TO THE SERVICE SHALL NOT EXCEED THE GREATER OF (i) THE AMOUNT YOU HAVE PAID US FOR THE SERVICE (IF ANY) OR (ii) ONE HUNDRED DOLLARS ($100.00).
You agree to defend, indemnify, and hold harmless NOVA Mail, its directors, officers, employees, and agents from and against any and all claims, damages, obligations, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising from:
a) Your use of and access to the Service; b) Your violation of any term of these Terms; c) Your violation of any third-party right, including privacy or intellectual property rights; d) Your violation of any applicable law or regulation; e) Any Content you submit, post, transmit, or make available through the Service.
You may delete your Account at any time through Account settings. Deletion is irreversible. All data associated with the Account will be permanently deleted within thirty (30) days.
We may suspend or terminate your Account at any time, without prior notice or liability, for any reason, including but not limited to:
a) Breach of these Terms; b) Violation of applicable laws or regulations; c) Conduct that we determine in our sole discretion is harmful to the Service or other users; d) Extended periods of inactivity; e) Upon request by law enforcement or government agency.
Upon termination, your right to use the Service immediately ceases. Sections 14 (Disclaimer of Warranties), 15 (Limitation of Liability), 16 (Indemnification), and 18 (Dispute Resolution) shall survive termination.
Before filing any claim, you agree to attempt to resolve the dispute informally by contacting us at [email protected]. We will attempt to resolve the dispute within thirty (30) days.
These Terms shall be governed by and construed in accordance with the laws of the State of Delaware, United States, without regard to its conflict of law provisions.
Any dispute arising from or relating to these Terms or the Service that cannot be resolved informally shall be resolved by binding arbitration in accordance with the American Arbitration Association's rules. The arbitration shall be conducted in Delaware.
You agree to resolve disputes on an individual basis and waive any right to participate in a class action, class arbitration, or representative proceeding.
We reserve the right to modify these Terms at any time. Material changes will be communicated via email to the address associated with your Account. Continued use of the Service after changes constitute acceptance of the modified Terms. If you do not agree to the modified Terms, you must delete your Account.
If any provision of these Terms is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect. The invalid provision shall be reformed to the minimum extent necessary to make it valid and enforceable.
These Terms, together with the Privacy Policy, Cookie Policy, Data Processing Agreement, Security Policy, and DMCA Policy, constitute the entire agreement between you and NOVA Mail regarding the Service and supersede all prior agreements and understandings.
NOVA Mail
Legal Inquiries: [email protected] Support: [email protected] Privacy: [email protected] Development: [email protected]
Documentation: https://nova-email.com/docs Report Issues: https://nova-email.com/report
---
© 2026 NOVA Mail. All rights reserved.
Questions? Contact email us
© 2026 NOVA Mail. All rights reserved.