What is stored, and who can see it
A specific inventory rather than a reassurance. Judge it yourself.
What never leaves your computer
- Your private keys. They are calculated on your device from your
recovery phrase and are never transmitted anywhere, in any form.
- Your recovery phrase. Shown to you once, then held only by you.
- Your mail password, if you use automatic protection. It is stored
encrypted on your own machine, unlocked with your passphrase, and forgotten when you
lock the app. It is never sent to us or to the network — only to your own mail server,
the same way your mail program sends it.
- The list of people you correspond with. The look-alike-domain check
learns which domains are familiar to you, and that list stays on your device.
What is published to the network
The network holds a public record. Anyone can read it. It contains:
- Your address and your public keys, signed by you, so anyone can find
the key for an address they want to write to.
- A proof that you control your mailbox, signed by the gateway that
checked it, with an expiry date.
- One record per protected message, containing your address, a
fingerprint of each recipient's address, a fingerprint of the subject, a fingerprint of the
body, a timestamp and your signature.
Read that last one again. Your address and the time are in a public
record. The recipients, the subject and the body are not — of each there is only a
fingerprint, which cannot be turned back into text. A recipient's fingerprint is tied to you
and the exact time, so nobody can follow who receives mail from whom; but someone who
suspects you wrote to a particular person can test that one guess. If the fact that you
wrote to a particular person, at a particular time, is itself sensitive, this is not the
right tool for that message. (Records made by older versions hold the recipient's address
in the clear.)
What a fingerprinted subject does and does not do: it stops a node operator from
reading subjects, and — because the fingerprint is tied to the sender and the exact
time — from grouping a person's mail by subject. It does not stop someone who already
suspects a subject from fingerprinting their guess and comparing, so a short, predictable
subject can still be confirmed. Records from before 23 September 2026 hold the subject in
readable form and cannot be changed.
What your mail provider can still see
Everything they see today, minus the body of encrypted messages:
- Who you write to and who writes to you.
- When, and how often.
- Subject lines.
- The body of any message that is signed but not encrypted.
- Attachments.
They cannot read the body of an encrypted message. Nobody can except the recipient.
What we can see
The gateway that carries mail between the AnuuTech network and ordinary e-mail handles
messages in transit, the way any mail server does. It sees what a mail server sees. It does
not have your keys, so it cannot read an encrypted body.
For a secure link the gateway also sends the
one-time codes, so it learns the recipients' addresses — blind copies included — and when a
message is opened. It still
cannot read the message: it holds half of the key, and the other half is in the link, which
never reaches any server.
When you open a message, the software asks anuumail.com for the key its sender published,
to check the signature. So the server sees which addresses are looked up, and from which IP
address — for every sender whose mail you open, protected or not. It does not know who you are:
there is no account.
The desktop application also asks once a day which version is current, so it can tell you
when there is a newer one. That request carries nothing else, and the application never
downloads or installs anything by itself.
There is no account system, no tracking, no analytics on this website, and no telemetry in
any of the clients.
How long things are kept
- Key records and mailbox proofs stay in the public record. A mailbox
proof expires after six months and must be renewed; the record of it remains.
- Message records are the evidence that a message was genuine, so they
outlive the message — but not forever: each node keeps up to 250,000 and drops the
oldest first. When one is gone, the recipient's software says it could not confirm the
message rather than pretending it did.
- A published record cannot be withdrawn. Signed public records are what
make verification work; being able to erase one would let a sender deny a message they
really sent.
- Secure links are the exception. The encrypted message behind a link is
deleted from the network when it expires — after 30 days unless the sender chose
otherwise — or when the sender withdraws it. What stays is the fact that the network
had it, and when.
The consequence, stated plainly. Protecting a message publishes the
fact that you wrote to that address, at that time — permanently. The contents stay private.
The existence does not.
If you are in the EU
This matters for the GDPR and it deserves a straight answer rather than a reassuring one:
an e-mail address is personal data, and every message record contains two of them. Those
records are published to a distributed network and cannot be deleted afterwards. That the
subject is now only a fingerprint narrows what is exposed; it does not change that
conclusion.
If you are deploying this in an organisation, that is a decision to take deliberately,
with your data protection officer, before you roll it out — not afterwards. We would rather
tell you that now than have you discover it later.
The privacy statement →
← All documentation