Skip to content
Sign inStart my free trial

mailfloss Developer Terms

Last updated: October 20, 2026

These Developer Terms are an agreement between you and 1992379 Ontario Inc., the company that operates mailfloss ("mailfloss", "we", "us"). They apply when you build an app that connects to mailfloss with OAuth or calls the mailfloss API on behalf of other mailfloss users ("your app"), whether or not your app is verified. They add to the mailfloss Terms of Use (https://mailfloss.com/terms/), which still apply to your use of mailfloss.

You agree to these terms by creating an app in Your apps, by using your app's client credentials, or by accepting them when we ask, for example when you submit an app for verification. If you accept for a company or other organization, you confirm that you have authority to bind it, and "you" means that organization. The developer program is for business and professional use. If you don't agree, don't create or run an app.

1. How these terms fit with our other terms

  • For anything about your app, these Developer Terms control if they conflict with the Terms of Use, subject to section 2 and section 15. The App review guidelines (https://developers.mailfloss.com/app-review-guidelines) add to these terms but don't override them.
  • Despite the Terms of Use's limits on automated access and internal business use, you may use the documented API for connected users as these terms allow.
  • Our Privacy Policy (https://mailfloss.com/privacy/) explains how we handle personal information. It doesn't authorize your app to process any data.

2. Data from mailfloss users

"mailfloss user data" means any data your app receives through mailfloss, including email addresses, verification results and account information, and any data you derive from it.

  • Use mailfloss user data only to provide the features the user connected your app for, within the scopes the user approved, and as your privacy policy describes. Ask only for the scopes your app needs.
  • Don't sell or rent mailfloss user data, share it for cross-context behavioral advertising, or use it for advertising, profiling or training AI models. Don't use it to build or enrich contact lists or data products for anyone other than the connected user. A connected user's request doesn't waive these limits. Share data only as needed to provide the features the user authorized, with service providers under the rules below, or as the law requires.
  • When a user disconnects your app, revokes its access or closes their mailfloss account, or when your access to the API ends, stop accessing and using the affected mailfloss user data at once. Within 30 days, delete it, including copies, backups and data derived from it, and make your service providers do the same. Keep only data the law requires you to keep, use it only for that purpose, protect it, and delete it when the requirement ends. Confirm deletion if we reasonably ask.
  • Publish a privacy policy that describes how your app collects, uses, shares and keeps mailfloss user data, and follow it. Give people any notice, and get any consent, that the law requires.
  • Your legal role and ours depend on how each of us actually handles personal data, and each of us must meet the duties of that role under the data protection laws that apply, such as the GDPR, UK GDPR, PIPEDA and US state privacy laws. Before processing personal data, put in place any data processing agreement the law requires with the connected customer and, where required, with us. These terms don't replace those agreements or remove duties the law imposes. If an applicable data processing agreement between you and us conflicts with these terms about personal data, that agreement controls, subject to section 15. An agreement you make with a connected customer or anyone else doesn't change your duties to us, or our duties or liability, unless we expressly agree in writing. Resolve any conflict before processing the affected data.
  • Before you receive personal data in, or allow access from, another country, put in place any transfer safeguards your role requires, such as transfer agreements, assessments and added security, and cooperate with us and the connected customer on theirs. An OAuth connection isn't a transfer safeguard. Don't start or continue a transfer that lacks its required safeguards.
  • Use service providers only as needed for the features the user authorized. Before giving them access, bind them in writing to confidentiality, security, purpose limits, deletion and any other protections the law requires. Get any sub-processor authorization the law or the customer requires, and stay responsible for your service providers' work. Where you act as a processor, contractor or service provider, follow the documented instructions and every legal limit on keeping, using, disclosing or combining personal data. Tell us promptly if you can no longer comply.
  • Keep records that show you follow this section. Promptly help us and the connected customer with privacy requests, complaints, assessments and regulatory inquiries within the deadlines that apply. On reasonable notice, give us relevant records and allow a proportionate compliance audit by us or an independent auditor bound to confidentiality; an urgent incident may need shorter notice. Promptly fix any failure we identify.

3. Credentials and security

  • Keep your client secret and every access and refresh token confidential. Store them on your server; never put them in a browser, a mobile app, a public repository or a public log.
  • You're responsible for everything done with your app and its credentials, including by your employees, contractors and anyone who gets them from you.
  • If credentials may have leaked, contain the exposure at once, rotate the affected secret, revoke the affected tokens, and tell us at [email protected]. Rotating a client secret doesn't revoke tokens already issued.
  • Use HTTPS for every redirect URI, except loopback addresses during development, and for every call to mailfloss.
  • Protect mailfloss user data with appropriate technical and organizational measures. At a minimum: limit access to people who need it and bind them to confidentiality; encrypt personal data and credentials in transit and at rest; use multi-factor authentication for administrative access; keep appropriate access logs; fix security vulnerabilities promptly; and regularly test your security and deletion controls.
  • Tell us at [email protected] without undue delay, and no later than 24 hours after you become aware of unauthorized access to, or disclosure, loss or misuse of, mailfloss user data or your app's credentials. Don't wait for a complete investigation: share what you know, the likely impact and your containment steps, then keep us updated, preserve evidence and cooperate with our response. Give any notice the law requires you to give affected people or authorities, without waiting for our approval.

4. Using the API

  • Respect rate limits, scopes and other technical limits, and don't try to get around them, for example with multiple apps or accounts.
  • Email verification your app starts spends the connected account's credits. Start it only when the user asked for it, directly or through a setting they chose.
  • Don't use mailfloss, or let your app use it, to send email, or to harvest, guess or generate email addresses. Your app may send lawful email through other services.
  • Don't use mailfloss to check lists you have no right to process, or to support sending unsolicited email in breach of anti-spam laws such as CASL or CAN-SPAM.
  • Don't resell mailfloss email verification, or offer a substitute email verification service built on the API, without our written permission.
  • Don't use mailfloss for anything illegal, or anything the mailfloss Terms of Use prohibit.
  • Don't interfere with, probe, scan, overload, reverse engineer or scrape mailfloss, or reach it other than through the documented API.
  • Don't misrepresent who you are, what your app does, or how it uses mailfloss user data.
  • Follow export control and sanctions laws, and don't offer your app's mailfloss features where those laws prohibit it.

5. Your app and your users

  • You support your app, its integration with mailfloss and its users, and you're responsible for building and running it and for your own terms and privacy policy with your users. We remain responsible only for support we separately agree to provide for mailfloss itself.
  • Don't make promises or commitments for mailfloss, or say that mailfloss is responsible for your app.
  • Tell us before you materially change what your app does, how it uses or shares mailfloss user data, or who owns or operates it. Don't start a new use of mailfloss user data without the notices, permissions and agreements it needs. We may require a new review before the changed app uses mailfloss user data or keeps showing as verified.

6. Verification and your listing

  • What you submit for verification must be accurate, and you must keep it up to date. We review submissions under the App review guidelines. We decide whether to verify an app, and we may decline or withdraw verification.
  • Verification reflects our review of what you submitted, at that time. It isn't a security audit, an endorsement, a certification, or a guarantee of your app's identity, performance, security or legal compliance. Don't describe it as one.
  • You give mailfloss a non-exclusive, worldwide, royalty-free license to use your app's name, logo, description and screenshots to show and promote your app in the mailfloss product, our documentation and any directory of apps we create. This license covers only material you submit for your public listing, not private testing steps or review evidence. You confirm that you have the rights to grant it.

7. Brand

  • Write our name as "mailfloss", in lowercase. You may use it to say truthfully that your app works with mailfloss.
  • Don't use the mailfloss name or logo in a way that suggests mailfloss built, owns, sponsors or endorses your app, and don't use them in your app's name, domain or logo except as the App review guidelines allow.
  • Only an app that is verified now may say it is "verified by mailfloss". When verification ends, remove the badge and every claim that your app is verified at once.
  • If we ask you to change or stop a use of our name or logo, do so promptly.

8. Ownership, confidentiality, feedback and fees

  • mailfloss owns the API, its documentation and the mailfloss service. These terms give you only a limited, revocable, non-exclusive, non-transferable right to use the API for your app as these terms allow. You own your app.
  • Information we share with you that isn't public, such as review notes or unreleased features, is confidential. Use it only for your app. You may share it with advisers and contractors who need it and are bound to confidentiality, or where the law requires; where lawful, tell us before a required disclosure. This duty doesn't cover information you can show was already lawfully known to you, developed independently, lawfully received without restriction, or public through no fault of yours.
  • If you send us feedback or suggestions, we may use them for any purpose without any obligation to you.
  • These terms don't charge a separate fee for the developer program. They don't change payment duties under a mailfloss subscription, your indemnity and reimbursement duties under section 12, or any other agreement with us. API calls your app makes use the connected account's credits and plan.

9. Suspension and termination

  • We may refuse, suspend or remove your app, revoke its tokens, withdraw its verification, or end your access to the API at any time and for any reason, including if you break these terms, if your app puts mailfloss users, their data or our systems at risk, if the law requires it, or if we stop offering the API or part of it. We tell you why when we can.
  • You may stop at any time by deleting your app in Your apps, which disconnects every account connected to it.
  • When your access ends, stop using the API and delete mailfloss user data as section 2 requires. Stop using our name and logo, except for accurate historical references that don't suggest a current relationship.
  • Sections 1 to 3, 5, 7, 8 and 10 to 15 continue after your access ends, as do duties about earlier acts, retained data and unresolved claims.

10. Disclaimers

THE API, ITS DOCUMENTATION, VERIFICATION AND EVERYTHING ELSE WE PROVIDE UNDER THESE TERMS ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT, AND WITHOUT ANY WARRANTY THAT THEY WILL BE ACCURATE, RELIABLE, UNINTERRUPTED, SECURE OR ERROR-FREE. An email verification result is an assessment, not a guarantee that an address will or won't receive email. We may change, limit or discontinue the API or any part of it, and we don't promise any level of availability or support.

11. Limitation of liability

TO THE MAXIMUM EXTENT THE LAW ALLOWS, MAILFLOSS, ITS AFFILIATES AND THEIR DIRECTORS, OFFICERS, EMPLOYEES, AGENTS AND SERVICE PROVIDERS WON'T BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, GOODWILL OR BUSINESS, ARISING OUT OF OR RELATING TO THESE TERMS, YOUR APP OR THE API, HOWEVER CAUSED AND EVEN IF WE WERE TOLD SUCH DAMAGES WERE POSSIBLE. TO THE MAXIMUM EXTENT THE LAW ALLOWS, THE COMBINED TOTAL LIABILITY OF MAILFLOSS AND EVERYONE PROTECTED BY THIS SECTION, FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS, YOUR APP OR THE API, IS ONE HUNDRED CANADIAN DOLLARS (CA$100). THIS IS ONE AGGREGATE LIMIT ACROSS THESE TERMS AND THE TERMS OF USE, NOT A SEPARATE LIMIT FOR EACH CLAIM, APP, AGREEMENT OR PROTECTED PARTY. THESE LIMITS APPLY TO CLAIMS IN CONTRACT, TORT (INCLUDING NEGLIGENCE) AND ANY OTHER LEGAL THEORY.

12. Indemnity

To the maximum extent the law allows, you'll defend, indemnify and hold harmless mailfloss, its affiliates and their directors, officers, employees, agents and service providers from all claims, liabilities, damages, losses, costs and expenses, including reasonable legal fees, arising out of or relating to your app, your users' use of it, your handling of mailfloss user data, your breach of these terms or of any law, or any claim that your app, its name or its logo infringes someone else's rights.

  • Use defense counsel reasonably acceptable to us. We may take part in the defense with our own counsel at our own cost. If you don't defend promptly, or a material conflict prevents an adequate defense, we may control the defense and recover the reasonable costs this indemnity covers.
  • Don't settle a claim in a way that admits fault for us, imposes duties on us or doesn't fully release us, without our written consent.
  • Reimburse our reasonable investigation, containment, notification and remediation costs to the extent your breach, negligence or misconduct caused them.

13. Changes to these terms

We may update these terms. We tell you by email at least 30 days before a change that materially affects your rights or duties takes effect, unless the law or a security risk requires a change sooner. The same rule applies to changes to the App review guidelines and to terms these terms rely on, as they apply to your app. Other changes take effect when we post them. Changes apply going forward and don't change the dispute rules for a claim that already exists. Where the law requires your express acceptance, we'll ask for it before the change applies to you. If you keep running your app after a change takes effect, you accept it. If you don't accept it, delete your app.

14. Governing law and disputes

These terms are governed by the laws of Ontario and the federal laws of Canada that apply there, without regard to conflict-of-law rules. Disputes are resolved by binding arbitration as set out in the mailfloss Terms of Use. Claims must be brought individually, not as a plaintiff or class member in a class or representative proceeding, to the extent the law allows. Despite the arbitration terms, either party may ask a court with jurisdiction for temporary relief to protect its intellectual property, credentials or data while arbitration goes ahead. Doing so doesn't waive arbitration of the underlying dispute.

15. General

  • Nothing in these terms or the Terms of Use excludes or limits liability, or a right or remedy, that the law doesn't allow us to exclude or limit, including any mandatory right to go to court, to bring or join a collective proceeding, or to complain to a regulator. This takes priority over any conflicting wording in these terms or the Terms of Use.
  • We send notices to the contact email you gave for your app or the email on your mailfloss account. Send notices to us at [email protected].
  • Don't assign these terms, or transfer your app, developer account or credentials, without our written consent. Tell us before a change of control of the business that runs your app; we may require the new operator to accept these terms and pass a new review before its access continues. We may assign these terms.
  • These terms don't create a partnership, joint venture, agency or employment relationship.
  • If a provision is unenforceable, the rest still applies. If we don't enforce a provision, we haven't waived it.
  • These terms, the App review guidelines, the mailfloss Terms of Use and any applicable data processing agreement between you and us are the entire agreement between you and us about your app, and replace any earlier understanding between us about it.

Contact

Questions about these terms: [email protected].