What exists

Your account: a username, a password hash, the recipient address you verified (encrypted), your aliases, and your settings. Records of sending activity for seven days, without content.

What does not exist

The content of forwarded messages, because no copy is kept. The mail server log beyond five minutes. A record of when you read your own dashboard. Any name, address or payment detail, because we never asked for one and donations are not tied to accounts.

A request for those receives the same answer that a request from anybody else would: they are not held.

What we do with a request

Every request is checked against the law it claims to rely on, and a request that does not carry the authority it needs is refused rather than quietly honoured. Where we are permitted to tell you, we tell you.

What we publish

The transparency page carries counts of requests received and how they were answered. The canary is signed and published on a schedule; the meaning of a canary that stops appearing is explained on that page rather than left to be inferred.

Your own leverage

The strongest thing you can do is reduce what exists to be asked for. A domain you own, mail forwarded rather than stored, and PGP encryption on forwarding leave very little here that anybody could compel. See Encrypted forwarding with PGP.