Legal

Email Communication Policy

Coxa is committed to responsible, transparent, and consent-based email communication. We never spam. We never share your email. Period.

Last updated: January 2024

1. Our Commitment

Coxa is committed to the highest standards of email communication. We believe that email is a critical channel for account security, service delivery, and user communication — and with that comes a responsibility to use it ethically and transparently.

This Email Communication Policy explains what types of emails we send, why we send them, how we obtain email addresses, and the practices we follow to ensure your inbox is respected. We have designed our email practices to fully comply with AWS Simple Email Service (SES) acceptable use policies.

2. Email Service Provider

Coxa uses Amazon Simple Email Service (Amazon SES) to deliver service-related emails to our users. Amazon SES is a reliable, scalable email sending service provided by Amazon Web Services (AWS).

We chose Amazon SES because:

  • It provides industry-leading deliverability and reliability
  • It offers robust security, authentication (SPF, DKIM, DMARC), and compliance features
  • It enforces strict anti-spam and abuse prevention policies that align with our own values
  • It supports detailed sending metrics so we can monitor delivery rates and identify issues promptly

All emails sent by Coxa are transmitted exclusively through Amazon SES from our verified domain (coxa.web.id). We have configured SPF, DKIM, and DMARC records to authenticate all outgoing email and protect against spoofing and phishing.

3. Types of Emails We Send

Coxa sends only service-related, transactional, and security emails. We do not send marketing emails, newsletters, or promotional content unless you have separately and explicitly opted in.

3.1 Account Verification Emails

When you register for a Coxa account, we send a single email to verify that you own the email address provided. This email contains a verification link and is sent automatically upon registration. The purpose is to confirm your identity and prevent fraudulent account creation.

3.2 Password Reset Emails

If you request a password reset, we send an email containing a secure, time-limited reset link. This email is only sent when you explicitly request it by clicking “Forgot Password” on the login page. The reset link expires after a short period for security reasons.

3.3 Security Alert Emails

We send security-related emails to notify you of important account events, including:

  • Suspicious login attempts or logins from new devices or locations
  • Password changes
  • Email address changes
  • Account recovery attempts
  • Changes to two-factor authentication settings

These emails are essential for your account security and are sent automatically when a relevant event occurs. They are critical for protecting your account from unauthorized access.

3.4 Task and Project Notifications

Coxa can send you notifications related to your work, including:

  • Someone assigns you a task
  • Someone @mentions you in a comment
  • A task you are following is completed or updated
  • A project deadline is approaching
  • A teammate invites you to join a project or team

These notifications are only sent if you have explicitly enabled them. By default, email notifications for task and project activities are off. You must opt in through your Account Settings to receive them. You can disable them at any time.

3.5 Service Announcements

Infrequently, we may send service-wide announcements about:

  • Changes to our Terms of Service or Privacy Policy
  • New features or major product updates that could affect your workflow
  • Scheduled maintenance or service interruptions
  • Security advisories

Service announcements are rare and sent only when necessary. We keep them concise and relevant.

4. Our Email Practices

We adhere to strict email sending practices designed to protect recipients and maintain high deliverability:

  • Consent-based only: Emails are only sent to individuals who have explicitly consented by registering for a Coxa account. We never send unsolicited emails.
  • First-party collection: All email addresses are collected directly from users during the registration process on coxa.web.id. We do not obtain email addresses from any other source.
  • No purchased lists: We NEVER use purchased, rented, scraped, or third-party email lists. Every email recipient is a registered Coxa user who provided their address directly to us.
  • No unsolicited commercial email: We NEVER send spam or unsolicited commercial email. Every email we send has a specific, legitimate purpose related to the user’s account or their use of the Service.
  • Clear sender identification: Every email clearly identifies the sender as Coxa, includes our domain (coxa.web.id), and contains our physical or web contact information.
  • User control: Users can manage their communication preferences in Account Settings at any time, choosing exactly which types of non-essential emails they want to receive.
  • Bounce and complaint handling: We actively monitor bounce rates and complaint rates through Amazon SES. Email addresses that hard-bounce are immediately suppressed. Complaint rates are kept well below AWS thresholds.
  • List hygiene: We automatically remove invalid and bouncing email addresses from our sending lists to maintain list quality and deliverability.

5. Consent & Opt-In

We take consent seriously. During registration on Coxa, users are presented with clear information about the emails they will receive:

  • A mandatory acknowledgment that account verification and security-related emails are essential for account security and will be sent
  • Optional checkboxes for task/project notification emails (off by default)
  • Optional checkbox for service announcements (off by default, but users are informed that critical security and legal notices will still be sent)

Consent is not buried in fine print or obtained through pre-checked boxes. Users must take an active, affirmative action to opt in to non-essential emails. This ensures that all email communication is based on informed, explicit consent.

6. Unsubscribe & Preferences

You have full control over the emails you receive from Coxa:

  • Notification settings: Visit your Account Settings page to manage which types of notification emails you receive (task assignments, @mentions, project updates, deadline reminders)
  • Opt-out: Non-essential email types include an unsubscribe link in every email. Clicking it immediately stops that type of email.
  • Essential emails: Certain emails are essential for account security and cannot be fully disabled, including:
    • Account verification (only sent once upon registration)
    • Password reset (only sent when you request it)
    • Security alerts (suspicious logins, account changes)

If you do not wish to receive any emails from Coxa, including essential ones, you may delete your account at any time. Once deleted, we will no longer send you any emails.

7. Email Retention & Privacy

Your email address is protected with the same level of security and privacy as all other personal data in our care:

  • Never shared: Your email address is never shared with third parties for marketing or any other purpose
  • Never sold: We do not sell, rent, or trade email addresses under any circumstances
  • Never disclosed: We do not disclose email addresses except as required by law or to protect our legal rights
  • Data retention: Email addresses are retained only while your account is active and are deleted along with all other personal data when you delete your account (see our Privacy Policy for details)

8. Contact

If you have questions about our email practices, believe you have received an email from us in error, or wish to report a concern:

We respond to all email communication inquiries within two business days.

For security-related concerns regarding our email infrastructure, you may also contact security@coxa.web.id.