Usbforwindows
Even
Do I need to escape get_theme_mod('url') / ('mail') with esc_url?
Yes, you do. Even if you have sanitised the value when saving it, you should always escape on output.......