Yes, if you want one — it's off until you switch it on, because a published address gets scraped. What you don't get is forwarding, and that's deliberate. Forwarding rewrites the envelope sender, which breaks SPF and DMARC alignment and reliably lands mail in junk. Instead an email provider receives and spam-scores the message, we store it in your inbox, and we send you a fresh notification from our own verified domain with Reply-To set to whoever wrote to you. Hit reply in your normal mail client and it goes straight to them. The long version, including why forwarded mail lands in junk, is at /email-forwarding.

An external provider — Resend, Mailgun, Postmark, SendGrid and Cloudflare Email Routing all do inbound parsing. They own the MX records, TLS, spam scoring and bounce handling; we only receive the parsed result over a signed webhook. We are never in the path of outbound mail on your behalf, which is what keeps us out of deliverability and open-relay territory.

The provider scores every message before we see it, and anything above the threshold is filed in a spam view rather than deleted, so a false positive is recoverable. Repeated mail from one sender gets throttled too. You can move anything in or out of spam yourself.

Never. Notifications go to the address you sign in with, and it's read only by the notification job — through a database function granted to the server alone, so there's no API shape that can return it. There's deliberately no box to type a different address into: an unverified forwarding address is how a contact form becomes a spam relay. If you want mail somewhere else, that needs confirming first.

Yes. Add it in Settings and point a CNAME at us — requests arriving on that host are resolved to your page at the edge. The one thing that isn't self-serve is the TLS certificate: the domain also has to be registered with the deployment before HTTPS works. Your page stays reachable at its contactme.co address regardless.

You can change it once every 30 days. Your old handle is retired rather than released, so nobody can grab it and impersonate you the moment you move.

Yes, from Settings, and it's genuinely a delete. Your profile, messages and analytics are removed by foreign-key cascade and your login is removed straight after.

The page, the inbox and the triage are free and stay free. Pro is $8 a month and covers the parts that handle being contacted for you: your own @contactme.co address, screening rules, replies drafted in your voice, your own domain, and removing the footer credit.