Privacy policy

To run a mailbox the service stores:

• Your account: address, display name, password hash, profile picture, signature, role, storage quota and sign-in times.
• Your mail: every message sent to or from your address, its headers, body, attachments and the original message as received, plus the labels, stars and read state you apply.
• Your files: everything you upload to Drive, its folder structure and any shares you create.
• Your contacts: addresses you have written to or received from, built automatically for autocomplete, and any public keys you pin to them.
• Your encryption keys: the public key you publish and, only in the passphrase-protected form your browser produced, your private key so you can open your mail from another device.
• Delivery events reported by the sending network: deliveries, bounces and complaints for mail you sent.
• If you enrol two-step verification: the phone number codes are sent to.

When you and your correspondent both have encryption keys, the message is encrypted and signed in your browser before it is sent. The service stores only the ciphertext. It cannot read the body or the attachments, cannot index them for search, and does not keep drafts of them. Your passphrase never leaves your device; nobody at the service can recover an encrypted message for you if you lose it.

The subject line, sender, recipients and timestamps of an encrypted message are not encrypted. That is a property of email itself, not of this service.

Data is stored with Amazon Web Services in the region shown in your administrator's console: message metadata and account records in a managed database, message originals, attachments and Drive files in private object storage, all encrypted at rest with provider-managed keys and reachable only over TLS. Mail is delivered and received through Amazon Simple Email Service, which handles it in transit in the same region.

• You, through your mailbox.
• Your domain administrator: they can create, suspend and delete mailboxes on their domain, set quotas and aliases, and see the audit log of those actions. They cannot read your mail through the console.
• The operator of the service, who maintains the servers and database and can access stored data for maintenance, abuse investigation and legal compliance. Encrypted message bodies remain unreadable to them.
• Amazon Web Services, as the infrastructure provider, under its own terms.
• Anyone you share a Drive file with, for that file only, and anyone with a public link you create, until you revoke it.

We do not sell data, do not use mail content for advertising, and do not train models on it.

Images referenced from other servers are withheld when you open a message, because loading them tells the sender you read it and from where. You choose per conversation whether to load them. Links open in a new tab without passing the page you came from.

• Mail and files stay until you delete them. Deleted mail moves to Trash; emptying Trash removes it from the database and then from storage.
• Deleting a mailbox removes its mail, attachments, originals and Drive files. An administrator confirms this by typing the address.
• Delivery events, audit log entries and sign-in records are kept for operational and security purposes and pruned by the operator.
• Backups of the database and storage are retained by the provider for a limited period after deletion.

• Change your name, picture, signature and password under Account.
• Set up, replace or revoke your encryption key under Settings → Encryption, and download a copy of it.
• Turn two-step verification on or off under Account.
• Export a message as the original it arrived as, from the message details.
• Ask your domain administrator to delete your mailbox, which removes everything above.

One session cookie keeps you signed in for up to thirty days. A theme preference is kept in your browser. There are no advertising or analytics cookies.

This page carries the date it was last changed. Material changes are announced to domain administrators before they take effect.

Questions go to your domain administrator first; they can reach the operator of the service through the administrator console.