Privacy

How we protect your mail

• Encrypted at receipt. Inbound mail is PGP-encrypted the moment it reaches our EU mail worker — during the SMTP transaction, before it is queued. If you attach a PGP key to a recipient, only that key can read the message.
• No plaintext at rest. The worker's queue lives in memory, not on disk, so plaintext is never written to storage before encryption.
• EU-owned mail hosts. Mail is handled on EU-owned infrastructure (Finland primary, Germany backup) with no US parent, outside the Five/Nine Eyes intelligence-sharing arrangements.
• Amazon never sees content. Delivery runs through Amazon SES, which sees who mail is for but only ever receives ciphertext — never the message body — when a recipient has a key. We summarise this as "AWS sees who, never what."
• No message retention or body logging. Messages are not stored or logged; only per-alias counters and monthly bandwidth totals are kept, and they expire.

These guarantees apply to recipients with a usable PGP key. Without a key — and unless you switch on "require encryption" — mail is forwarded unencrypted, and the providers in the path (including Amazon SES, which handles the destination address) can see its content.

What we store

• Account: a username, a password hash, and your settings (from name, default alias format). No name, phone number, or email address is required to sign up.
• Aliases and recipients: the alias addresses you create and the inbox addresses they forward to. Recipients are the addresses mail is delivered to, so they necessarily exist.
• Forwarded mail: processed in memory and relayed. Messages are not retained; only per-alias delivery counters (how many, when) and monthly bandwidth totals are kept.
• Billing: subscription state and provider references. Card details are handled entirely by Polar, our merchant of record; we never see them. Crypto invoices are handled by NOWPayments.

Encryption

If you attach a PGP key to a recipient, inbound mail is encrypted to that key on our mail worker before it is queued or relayed. Private keys never leave your machine.

What we do not do

• No advertising, profiling, or selling of data.
• No third-party analytics or tracking scripts on this site.
• No reading of forwarded message bodies; only the counters described above.

Retention and deletion

Delivery counters and monthly usage totals are retained for a limited window and then expire. Deleting your account removes your profile, subscription, aliases, and recipients, and deletes the account itself.

Contact

This is a pilot deployment; contact details will be published before general availability.