Privacy-Focused Self-Hosted Email Forwarding: Your Mail, Your Cloudflare

Every email you forward through a third-party service passes through that service’s infrastructure. A privacy-focused self-hosted email forwarding setup removes that dependency: mail stays on your Cloudflare account, and no provider sees it by default.

What “privacy-focused” means here

• Data ownership — D1, R2 and the Worker live in your account; the forwarder is software, not a mailbox host.
• Default no-peek — the panel can be configured without server-side AI; nothing reads your mail unless you enable it.
• Revocable access — the panel’s API token can be revoked at any time while the forwarding pipeline keeps running.

Privacy details that matter

• HTML bodies render in a sandboxed iframe — remote images (tracking pixels) are blocked by default, so senders don’t learn your IP or that you opened the mail.
• Attachments and full copies stay in your R2; retention is a setting you control (default 30 days).
• Blocked mail stores metadata only by default — no spam-storm bloat in your storage.

Self-hosting vs privacy-forward managed services

Services like Proton and Fastmail are privacy-focused by design, but they hold your mail on their servers. A self-hosted forwarder on Cloudflare is a different trade: you own the storage, Cloudflare provides the pipe, and the forwarding software is open source (MIT) so it can be audited.

InboxFly follows this model: open source, deploy to your own account, and the panel never holds your mail — only the interface to it.

FAQ

Does self-hosting mean I run a mail server? No — Cloudflare Email Routing is the MX infrastructure; you only run a Worker.

What if I stop using the panel? Revoke its API token. Your D1/R2 and the Worker remain yours, and forwarding keeps working.