LAST UPDATED · SEPTEMBER 17, 2026

Privacy

This page describes the current InMask Windows app and this website. InMask is an independent app, not affiliated with Cloudflare, Inc.

What InMask does

InMask manages Cloudflare Email Routing rules for addresses on your domain. Cloudflare forwards incoming mail to your verified destination; Gmail receives it. InMask does not provide a mailbox, read email bodies or send or reply to email.

Cloudflare sign-in

You sign in through Cloudflare in your browser. InMask uses an authorization-code flow with PKCE; it does not ask for your Cloudflare password. Credentials are protected locally using Windows DPAPI for your Windows user. Authorization codes and temporary sign-in values are used during sign-in and are not placed in normal logs or metrics.

The required permissions let the app read DNS, zones, zone settings, routing addresses and routing rules, and write zone settings, routing addresses and routing rules. Account routing-rule access is read-only. Analytics access is optional. The desktop app does not request DNS Write, Email Sending or Registrar access. Website publisher credentials are separate from user sign-in and are not distributed with the app.

Address and profile data

Profiles, cached rules, address labels, drafts and settings are stored on your computer in your user's local application data. Regular local data is not necessarily encrypted. Labels you enter are also stored in Cloudflare rule names, so Cloudflare and people with access to those rules can see them. Avoid putting secrets in labels.

The app sends rule and address changes to Cloudflare when you request them. It does not upload your catalog to an InMask backend. Destination addresses may be shown in shortened form in the UI; local logs and technical reports redact sensitive values.

Optional local metrics and reports

Validation metrics record setup milestones, operation timings, activity counts and error codes locally. They can be disabled. They do not include email bodies, full destination addresses or window titles. There is no automatic telemetry upload. If you export and share a report, you decide who receives it.

Disconnecting and removing the app

“Disconnect this device” removes the local sign-in and this device's app data and attempts to revoke the credential. Existing Cloudflare rules and domains remain. Removing the app is not the same as deleting routing rules. Use the separate app-managed-address deletion action only if you want to remove those addresses.

This website

The page demos use invented example.com addresses. Demo changes stay in page memory and reset on reload. They do not connect to Cloudflare, copy to your clipboard or send mail. The website does not include advertising, analytics scripts, sign-in forms or tracking cookies.

Cloudflare hosts this website and may process connection information such as IP addresses, user-agent information and request data to serve and protect it. Cloudflare and Gmail handle forwarded mail under their own policies. See Cloudflare's privacy policy and Google's privacy policy.

Limits of address separation

Using an alias avoids sharing your Gmail address during signup, but replies from Gmail, automatic replies, account recovery or other provider behavior can reveal it. InMask does not promise anonymity, encryption of forwarded messages or guaranteed delivery.

Contact

For product support or questions about this page, email [email protected]. Never send passwords or access tokens.