›

Cookie Policy

What personal information we collect, how we use it, and how we keep it safe.

Last updated: August 23, 2026

Mailbox To Go Inc. (“Mailbox To Go”, “we”, “us”, or “our”) uses cookies and similar technologies when you visit mailboxtogo.com, access app.mailboxtogo.com, or use another related online interface through which we provide our virtual mailbox products and services (collectively, the “Services”).

This Cookie Policy explains what these technologies are, which technologies we and our service providers use, the information they may collect, the purposes for which they are used, and the choices available to you.

This Policy should be read together with our Privacy Policy and General Terms and Conditions and, if you subscribe to a virtual mailbox, our Renter Terms and Conditions. The Privacy Policy provides additional information about how we collect, use, disclose, retain, and protect personal information.

Cookies and similar technologies

A cookie is a small text file stored on a browser or device when a website is visited. Cookies may contain or generate an identifier that allows a website or service provider to recognize a browser, maintain a session, remember a preference, protect an account, or understand how a website is being used.

Session cookies generally expire when the browser is closed or the applicable session ends. Persistent cookies remain until their stated expiry, until they are replaced, or until they are deleted through the browser or device.

We may also use technologies that perform similar functions without using a conventional cookie, including:

pixels and web beacons;
tags and scripts;
browser local storage and session storage;
device, browser, and online identifiers;
advertising click identifiers;
embedded payment and support tools; and
tracked links in emails.

A technology may be operated directly by Mailbox To Go or by a third party that provides services to us. First-party cookies are set through a Mailbox To Go domain. Third-party cookies or similar technologies are operated by another organization, although a browser may sometimes display them as being associated with the Website.

Necessary and security technologies

We use necessary cookies and similar technologies to operate, protect, and administer the Website and Services. These technologies may be used to:

maintain an authenticated account session;
recognize that a customer has logged in;
protect accounts and forms against unauthorized or fraudulent activity;
maintain Website and application security;
balance, route, and manage Website traffic;
identify and mitigate bots, attacks, or other abusive activity;
process a payment or prevent payment fraud;
preserve information required to complete a customer-requested action; and
maintain other functions without which the requested Website or Service feature would not operate properly.

Mailbox To Go may use session and security cookies for these purposes. Cloudflare may also use necessary cookies and related information to manage traffic, protect the Website and application, respond to security challenges, and identify potentially automated or malicious activity.

Necessary technologies may operate automatically when you access the relevant Website or Service feature. Blocking them may prevent login, payment, account security, or other essential functions from working.

Account and preference technologies

When you log in, we use technologies to maintain your authenticated session. If you select the “Remember me” option, a persistent identifier may be stored so that your browser can remain recognized beyond the current session.

We may also use cookies or browser storage to remember selections, interface settings, notification preferences, or other choices made through the Website or Services.

A “Remember me” or preference identifier may remain until its configured expiry, until you sign out or change the applicable setting, or until you delete it through your browser. Removing it may require you to log in again or re-enter the applicable preference.

Support and live-chat technologies

We use tawk.to to provide live chat and related customer-support functionality on the Website and application. The chat service may use cookies, local storage, session storage, and similar identifiers to:

display and operate the chat widget;
maintain a conversation while you move between pages;
recognize a returning browser;
route and administer support conversations;
remember chat status or availability;
provide technical and service support; and
help prevent misuse of the chat service.

When the chat service is available or used, tawk.to may receive information such as an online identifier, IP address, approximate location, browser and device information, pages visited, dates and times, and information submitted during a chat.

Customer-support messages and the personal information they may contain are handled as described in our Privacy Policy.

Analytics and performance technologies

We use Google Tag Manager to administer selected Website tags and Google Analytics to understand how visitors use the Website and Services.

Google Analytics may use cookies and similar identifiers to collect information such as:

an analytics client or browser identifier;
IP-derived approximate location;
browser, device, operating-system, and language information;
referring and exit pages or links;
pages and features viewed;
dates, times, sessions, and time spent;
clicks, navigation, and other Website interactions;
whether a visitor is logged in; and
limited plan, registration, or account-status information where configured for measurement.

We use this information to understand Website traffic and use, identify technical or usability issues, measure registration and subscription activity, improve the Website and Services, and evaluate the results of communications or advertising.

Google Analytics commonly uses cookies such as “_ga” and related container-specific cookies. Their default duration may be up to two years, although the actual duration may be affected by our configuration, browser restrictions, user activity, or changes made by Google.

Advertising and conversion technologies

Google Analytics is linked to Google Ads. We use Google Ads conversion technologies to determine whether an advertisement led to activity such as registration, checkout, or a completed transaction.

These technologies may process:

advertising and analytics identifiers;
Google or other advertising click identifiers;
referring campaign information;
pages and conversion steps completed;
transaction identifiers;
transaction value and related purchase information;
device and browser information; and
dates and times associated with an advertisement or conversion.

We also use Google Ads enhanced conversions. When a qualifying conversion occurs, customer information such as an email address may be normalized and protected using a one-way cryptographic hashing process before being sent to Google. Google may compare the hashed value with information associated with signed-in Google accounts to determine whether an advertisement contributed to the conversion and improve the accuracy of advertising measurement.

We use Meta Pixel on limited conversion-related pages, including payment or transaction-confirmation pages. Depending on the page and tag configuration, Meta may receive a page-view or conversion event relating to registration, checkout, or a completed payment, together with information such as browser or device identifiers, IP address, referring information, date and time, and limited transaction or conversion information.

Google and Meta may use cookies or related advertising identifiers to attribute activity to an advertisement in accordance with their own technologies, privacy notices, account settings, and legal obligations.

Payment technologies

Mailbox To Go uses Stripe Elements to process payments. Stripe may use cookies, scripts, IP addresses, browser and device characteristics, interaction signals, and related technologies to:

securely display and operate payment fields;
process and authenticate payments;
recognize a payment session;
prevent fraudulent transactions;
distinguish legitimate customers from bots or attackers;
operate Stripe Radar and related payment-security features; and
comply with payment-network and legal requirements.

Complete payment-card numbers and security codes entered through Stripe Elements are submitted to Stripe rather than stored in Mailbox To Go’s own application. Additional information about our payment practices appears in the Privacy Policy.

Email tracking technologies

We use Postmark to deliver transactional or service-related emails and MailerCloud to deliver marketing communications. Open and click tracking are enabled for both types of email.

An HTML email may contain a small invisible image or similar web beacon. When the image is requested, the email provider may record that the message was opened, together with information such as the date and time, IP address, approximate location, device, operating system, browser, or email application.

A tracked link may be replaced with a link that passes through the email provider’s systems before redirecting to the intended destination. This may allow us and the provider to record that the link was clicked, when it was clicked, the destination, and related browser, device, or approximate-location information.

We use email engagement information to:

assess delivery and technical performance;
identify undeliverable or inactive addresses;
understand whether service communications are reaching customers;
evaluate the usefulness of communications;
measure marketing performance; and
manage communication and subscription preferences.

Open information may be incomplete or inaccurate because some email applications block images, preload images, or route them through privacy proxies.

Disabling automatic image loading or reading an email in plain-text form may prevent some open tracking. Clicking a tracked link may still generate a click record. Marketing messages include an unsubscribe method, but unsubscribing from marketing does not stop necessary account, mail, payment, verification, security, or legal communications.

Information collected through these technologies

Depending on the technology and how you interact with the Services, cookies and similar technologies may collect or generate:

IP address and approximate location;
cookie, session, device, browser, advertising, or analytics identifiers;
browser, device, operating-system, display, and language information;
referring pages, links, campaigns, or advertisements;
pages, features, and account areas viewed;
clicks, navigation, searches, and other interactions;
dates, times, session duration, and frequency of visits;
login, authentication, security, and error information;
preferences and “Remember me” selections;
registration, checkout, and conversion activity;
transaction identifiers and values;
hashed customer information used for enhanced conversion measurement;
live-chat activity and messages; and
email delivery, opening, and clicking information.

Information collected through cookies and similar technologies may be combined with other information where reasonably necessary to operate the Services, maintain security, provide support, measure conversions, or understand Website activity, as described in our Privacy Policy.

How long these technologies remain

The duration of a cookie or similar identifier depends on its purpose and configuration.

Session cookies and session storage generally remain until the browser is closed, the session expires, or the user signs out.
Authentication and “Remember me” technologies may remain beyond the current browser session until their configured expiry, sign-out, or deletion.
Security and payment technologies may remain for the period required to maintain a secure session, recognize a device, prevent fraud, or satisfy the provider’s security requirements.
Analytics and advertising identifiers may remain for periods established by Google, Meta, our configuration, and the browser. Google Analytics cookies may remain for up to two years by default.
Live-chat technologies may remain for the duration required to maintain the conversation or recognize the browser, subject to tawk.to’s configuration.
Local storage may remain until it is deleted by the Website, the applicable provider, or the user.

Providers may change the names, functions, or durations of their technologies as their services and browsers evolve. Browser restrictions may also shorten or prevent the stated duration.

Your choices

Mailbox To Go does not currently provide a separate Website cookie-preference centre. You can control cookies and related technologies through the options described below.

Most browsers allow you to view, block, or delete cookies and clear local or session storage. Browser controls normally apply only to that browser and device, so you may need to repeat your choices on other browsers or devices.

Blocking all cookies may prevent you from logging in, remaining signed in, making a payment, using live chat, or accessing other Website or account features.

You may also:

use Google’s Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout;
manage Google advertising choices through My Ad Center at https://myadcenter.google.com/;
manage Meta advertising preferences through the settings available in your Facebook or Instagram account;
disable automatic image loading or use plain-text mode in your email application to limit some email open tracking; and
unsubscribe from marketing messages using the method included in the message.

Deleting a cookie or identifier does not ordinarily delete analytics, conversion, security, payment, support, or email records already created before the deletion. Requests concerning personal information held by Mailbox To Go may be submitted as described in our Privacy Policy.

Processing outside Canada

Some providers described in this Policy, including Google, Meta, Stripe, tawk.to, Postmark, and MailerCloud, may process cookie, device, payment, support, email, analytics, or advertising information in the United States or other countries where they or their service providers operate.

Information processed outside Canada may be subject to the laws of the foreign jurisdiction and may be accessible to courts, law-enforcement agencies, national-security authorities, or regulators in accordance with local law. Additional information about processing outside Canada appears in our Privacy Policy.

Changes to this Policy

We may update this Policy to reflect changes in law, browsers, technology, our service providers, or our use of cookies and similar technologies. We will post the updated Policy and revise the “Last updated” date.

If a change is material, we will provide additional notice through reasonable means where appropriate or required by applicable law. We will obtain additional consent where required before introducing a materially new use for which existing consent or another lawful basis is insufficient.

Questions and complaints

To ask a question or raise a concern about cookies, tracking technologies, or our handling of related personal information, contact:

Privacy Officer
Mailbox To Go Inc.
103-2727 Steeles Ave W
Toronto, Ontario M3J 3G9
Canada

Or via contact form at https://www.mailboxtogo.com/contact/