Dispatch is a portfolio project that demonstrates an email API. It is not a commercial service. It does send real email through AWS SES, so what you put into it is real data in real systems.
What Dispatch stores
Your email address, and a display name if you set one. Supabase handles passwords and Dispatch never receives one. Signing in with Google or GitHub passes on the email address of that account.
The domains you add, and the DKIM tokens AWS issues for them.
API keys as a hash and a short prefix. The key itself is shown once, at creation, and is never stored.
Templates: the name, the subject, and both bodies you write.
Emails you send: the sender, the recipients, the subject, the html and text bodies, the status, and the delivery events AWS reports back.
Webhook endpoints: the url, its signing secret, and every delivery attempt with the status code it returned.
A record of every request your API keys make: the method, path, status code, duration, and time.
Who else processes it
Supabase: accounts, sign in, and the Postgres database all of the above lives in.
AWS SES and SNS: sending the mail, holding your verified domains, and reporting deliveries and bounces.
Vercel: hosting.
Upstash: Redis, holding rate limit counters and nothing else.
Inngest: runs the send and webhook jobs, so a queued email passes through it.
PostHog: feature flags. Flags are resolved on the server against definitions downloaded in advance, so no page view or event about you is sent.
Resend: sends the confirmation and password reset email, until Dispatch's own sending pipeline takes that over.
Cookies
Supabase's session cookies, which keep you signed in. Nothing else. There is no analytics script on any page.
How long it is kept
Until you delete your account. There is no retention window on sent email or request logs yet.
Deleting your account
The Danger zone on your profile removes your domains, keys, templates, emails, and webhooks. Two things it does not remove. Your request logs stay, with the account detached from them. Any domain you verified stays registered as an identity in Dispatch's AWS account until it is removed by hand.