A free service from Oderland. Move your mail yourself, without the hassle.
epostflytt.se
English
Privacy

Privacy policy.

Epostflytt moves email between two mailboxes you nominate yourself. This page describes what the service stores, for how long, and what is never stored. Oderland Webbhotell AB is the data controller.

For your rights, contact details and how to complain, see Oderland's privacy policy.

What we store, and for how long

DataWhyHow long
DataThe notification address you enterWhyTo send you the key to your move, and word when it finishesHow longDeleted with the move, after 7 days or the moment you purge it yourself
DataUsernames and server addresses for both mailboxesWhyTo carry out the move and show it on the move's own pageHow longSame
DataYour IP addressWhyTo limit moves per hour and stop abuseHow longPurged automatically each night, anything older than 7 days
DataThe logWhyTo show what happened: folder names, counts and error codesHow longSame
DataThe time you accepted the terms of useWhyTo show that the terms were accepted when the move was startedHow longDeleted with the move, after 7 days or the moment you purge it yourself

The log never contains the content of a message, a sender, a recipient or a password.

A job that never finished is purged after 30 days rather than 7.

When a move is deleted, its number of copied messages is added to a public total. That is a single figure attributable to nobody. It carries no address, no folder name and no timestamp.

Oderland staff can read the log during the seven days it exists, through an internal interface that requires a sign-in and that only a handful of people can reach. Who has read it is recorded.

The web server also keeps an ordinary access log (IP address, time and which address was requested) for troubleshooting and so that abuse can be audited after the fact. It is rotated automatically and purged after 8 days at the latest; it is separate from the move's data, but the address of the move's own page contains the key to the move, so that key appears in the log when you open the page.

Your mailbox passwords

The passwords are needed to sign in to the two mailboxes and for nothing else. They are held in memory for the duration of the move and never written to disk, not to the database, not to the log, not to a backup. When the move ends they are erased immediately, whether it finished, was aborted or failed. If the move never starts, they are erased after 24 hours at the latest.

Cookies

Epostflytt uses three cookies. All three are needed for the site to work, none of them follows you between websites, and none is used for analytics or advertising. That is why there is no cookie banner to click away: consent is not required for cookies that are strictly necessary for a service you asked for yourself.

CookieWhat it doesHow long
Cookieepostflytt-sessionWhat it doesHolds your visit together: form protection, and the sign-in in progress if you choose Microsoft 365How long2 hours
CookieXSRF-TOKENWhat it doesProtects the forms against forged requests from other sitesHow long2 hours
CookiethemeWhat it doesRemembers that you chose dark mode. Only set if you click the toggleHow long1 year

We use no visitor analytics, no advertising tools and no external resources. The fonts are on our own server, so no third party sees your visit.

Who else is involved

The move runs between two mailboxes you choose yourself. Those two providers see the traffic to and from their own servers, exactly as they do when you read your mail day to day, and their privacy policies govern what sits with them.

The service runs on Oderland's own infrastructure in Sweden, and the mail we send goes out through Oderland's own mail servers. No third party processes your data on our behalf.

If you choose Microsoft 365 you sign in with Microsoft. We receive back a time-limited access token and the address you signed in with. The address is shown in the form so you can see which account is being used, but it is never stored with the move's data. Which Microsoft account authorised a move is not recorded. The token sits in the same memory as the passwords and is erased the same way.

Legal basis and your rights

We process the data about your move in order to carry out the move you asked for. It is needed to deliver the service, and that is the legal basis. Your IP address we process for a different reason: our legitimate interest in protecting the service against abuse and overload. You have the right to object to that second kind of processing.

You have the right to request access, rectification and erasure. The fastest way to erase everything we hold about a move is to open the move's own page (the link you got by email) and click Delete the log now. That works once the move has ended, whether it finished, was aborted or failed; if it is still running, abort it first.

For your rights otherwise, contact details and how to complain to the Swedish Authority for Privacy Protection (IMY), see Oderland's privacy policy.

Last updated: 27 August 2026