What we can actually promise

Every email company says it respects your privacy. The useful question is which specific claims a provider is willing to put in writing, and which ones are physically or legally impossible for anyone to make.

What we do

• We do not scan your mail to target advertising. Not as a policy that could quietly change — as an architecture. The advertising components in this product exist only on the public website and have no access to mail data.
• We do not sell inbox data to anyone, in any form, aggregated or otherwise.
• We do not sell or rent your email address.
• We collect the minimum needed to run the service: your address, a hashed password, your names, and security events.
• We hash IP addresses rather than storing them in the clear.
• Encryption in transit with TLS, and encryption at rest on stored mail.
• Strong authentication — two-factor and passkeys, available to every account including free ones.
• A security log you can actually read, in your account, showing sign-ins and changes.
• Published retention periods in the privacy policy, with real numbers.
• No cookie-based tracking in our own analytics, and no third-party analytics beacons.

What nobody can promise, including us

You will see these claims elsewhere. They are not true, and we are not going to make them:

• “100% secure.” No system is. Anyone claiming this is telling you they have not thought about it carefully.
• “We cannot be subpoenaed.” We can. We operate in the United States and we are subject to lawful process like every other provider. We will tell you when we are legally permitted to.
• “Government proof.” Meaningless.
• “Zero knowledge” on a standard mailbox. Mail arrives from the outside world unencrypted. A provider that stores your mail so you can search it can, by definition, access it. Providers offering genuine end-to-end encryption do so with real trade-offs; we are not claiming that property, because we do not currently have it.

The honest summary

We are a small, independent provider that does not have an advertising business built on reading your mail — which removes the structural incentive that makes most free email what it is. That is a real difference and it is worth something. It is not the same as mathematical privacy, and we would rather you know the difference than be flattered by us.

If your threat model genuinely requires end-to-end encrypted mail, use a provider built specifically for that, and use it properly. We would rather say so than sell you something that does not fit.

Ads, specifically

We intend to run Google AdSense on editorial pages. That is how a lot of the publication gets paid for. Two hard rules:

• No advertising is ever placed inside a mailbox.
• No advertising is ever targeted using the contents of email.

Ads on articles are sold against the article, the way a magazine sells a page.