Messages

Forwarded messages are not stored. A message goes from the incoming connection to the outgoing one and no copy is kept.

The mail server's own log, which every mail server keeps and which records who sent what to whom, is read and then emptied every five minutes.

If you enable the mailbox here, mail delivered into it is stored until you delete it. It is never written readable: a message is stored only if it can be encrypted to your OpenPGP key, or if it arrived already encrypted end to end. That is the one deliberate exception and it only exists if you switch it on. See Keeping mail here.

Addresses

Your alias addresses are stored in plain text, because the relay has to read an address to route mail to it. We say that rather than implying more protection than exists.

The address your mail is forwarded to is encrypted under a key held separately from the one protecting the rest of the database.

Records

Records of messages sent through an alias live for seven days and contain no content. Delivery failures live for seven days.

If you write to support, the message and the address you wrote from are kept for seven days after the ticket is closed. Files you attach are kept with the ticket and deleted with it: they are scanned before they are stored, and metadata is stripped from images, because a screenshot carries the device and often the place it was taken. Tickets about abuse or a legal order are kept for two years, because they document a decision that somebody may contest.

Donations

A donation is recorded as an amount, a currency, how it arrived and when. There is no column linking it to an account, so the question "who donated" has no answer here rather than an answer we decline to give. The donation wall is separate and opt-in: a name and a line of text that somebody typed in on purpose.

What we cannot do

We identify you by your account, not by your name, and we never asked for one. We cannot link an alias to a person without the account it belongs to.

What we can see, being honest

Your list of aliases tells us which sites you have accounts with, if we chose to look. That is the map this service is built around, and no design removes it entirely while forwarding still works. What we can do is not keep more than the map needs, not log what passes through it, and encrypt the one field that turns it into a person, which is what the sections above describe.

The full detail, including the legal basis for each purpose, is in the privacy notice.