Privacy statement
What happens to personal data when you use ProtectMyMail
and the anuumail.com gateway. Written to be checked against the software, not to reassure.
Version of 9 October 2026 (draft). This describes the service as it runs
during the beta. Changed since 25 September: recipients in message records are now
fingerprints, organisations and devices, accounts and payments, and who may run a node.
See also the terms of use and, for organisations, the
data processing agreement.
Before this is published: the legal name, postal address and chamber of
commerce number below must be filled in, and the whole text should be read by someone
qualified in data protection law. The facts in it come from the software; the legal framing
is a starting point, not advice.
The section on accounts and payments describes the web app as built in pull request #9,
which is not live yet. Check it against what ships — in particular what the plugin sends
the web app about recipients — before publishing it.
Who is responsible
[Legal name], [postal address], [chamber of commerce number], the Netherlands, operates the
AnuuTech testnet nodes and the anuumail.com gateway and is the controller for the processing
described here.
Questions, requests and complaints: privacy@anuumail.com. Abuse and
problems with mail delivery: abuse@anuumail.com and
postmaster@anuumail.com. All three reach the same mailbox and are read by a
person.
The short version
- Your keys are made on your own device and never leave it. We cannot read an encrypted
message, and we cannot recover your account if you lose your recovery phrase. (If your
organisation keeps a recovery key, it can — see "Organisations" below. We still cannot.)
- Protecting a message publishes a record to a distributed network:
your address, a fingerprint of each recipient's address, a fingerprint of the subject,
a fingerprint of the body and the time. Neither the subject, the body nor the
recipients' addresses are published. The fact that you wrote, and when, is.
- That record is public, it is copied to every node, and it cannot be recalled.
- The website sets no cookies, runs no analytics, and the clients send no telemetry.
What is processed, why, and on what basis
| What | Why | Basis |
|---|
| Your e-mail address with your public keys and display name (the "binding") |
So anyone can find the key belonging to an address and check a signature. This is what
the product does; without publishing it, nothing can be verified. |
Performing the service you asked for |
| A mailbox proof: your address, your key, the gateway's signature, valid six months |
To show that the mailbox is yours. The gateway mails a code to it and signs the proof
when you enter the code. |
Performing the service you asked for |
| One record per protected message: your address, a fingerprint of each recipient's
address (To, Cc and Bcc, at most 200), a fingerprint of the subject, a fingerprint of
the body, the time, your signature |
So the recipient's software can check that the message it received is the message you
sent, and that it was sent to them — not forwarded on by someone else. |
Performing the service you asked for |
| Secure links: the encrypted message, and the recipients' addresses sealed for the
gateway |
So someone without the software can still read a protected message, after entering a
code the gateway mails them. |
Performing the service you asked for |
| Mail passing the gateway, in both directions |
Ordinary mail handling: receiving, signing with DKIM, delivering, retrying. |
Performing the service you asked for |
| Lookups: when you open a message, the sender's address is asked of anuumail.com, from
your IP address |
To find the key that sender published and check the message's signature against it.
The software asks for every sender whose mail you open, so the server sees which
addresses are looked up from where, though not who you are. |
Performing the service you asked for |
| The desktop application asks once a day which version is current, from your IP
address |
So it can tell you when a newer version — possibly with a security fix — is available.
It sends nothing but the request itself, and never downloads or installs anything. |
Legitimate interest in you running a version without known faults |
| Organisations: the domain, the organisation's name and its public keys; confirmations
of its people's mailboxes; and, when the organisation keeps a recovery key, each
person's recovery phrase sealed to that key |
So an organisation can vouch for its own addresses, and restore a person's account
when they leave or lose their phrase. The gateway checks the domain's DNS record
before it confirms an organisation. |
Performing the service the organisation asked for; for the people in it, the
organisation's own basis as their employer (it is the controller there, we process for
it — see the data processing agreement) |
| Devices: for each browser or app you add as a device, its public keys, the name you
gave it and when it was added or revoked |
So a message signed on any of your devices checks out as yours, and mail to you can be
opened on each of them. |
Performing the service you asked for |
| Accounts and payments (once paid plans start): your e-mail address and key address
when you enrol, your plan and trial, invoices; a referral code if someone referred you;
and, to show whether a recipient's protection is paused, the addresses you are writing
to |
To run a trial, take payment and keep a subscription. Payments are handled by Stripe:
your card details go to Stripe and never reach us. |
Performing the contract; keeping invoices is a legal obligation (seven years under
Dutch tax law) |
| Server logs: connections, IP addresses, errors, how much was sent |
To keep the service running and to stop abuse — the gateway limits how much one sender
may send out. |
Legitimate interest in a service that works and is not used for spam |
What the network publishes, and what that means
The AnuuTech network is a distributed record. The nodes that hold a full copy are run by
us, from a list our validators keep. A node run by another party is let in only with a
signed admission from a majority of the validators, and even then it receives none of the
records described here — no keys, no message records, no mail, no organisations — only what
it needs to stay in step with the network. Records can still be looked up by anyone who
asks for a particular address or message, which is what makes checking a signature possible.
Published records are signed, which is what makes them worth anything — and also why they
cannot be taken back.
Protecting a message publishes who wrote, and when.
Your address and the time are in that record in readable form. The recipients, the subject
and the body are not: of each there is only a fingerprint. A recipient's fingerprint is tied
to you and to the exact time, so nobody can collect who receives mail from whom across
messages — but someone who suspects a particular recipient can test that guess against one
message. If the existence of a message is itself sensitive — a journalist's source, a medical
question, an application nobody should know about — this is not the right tool for that
message. A secure link keeps the recipient's address
out of sight of other people, but the gateway still learns it.
A fingerprint hides a subject from a reader, not from a guesser. Anyone
may take a subject they suspect, compute its fingerprint the same way, and see whether it
matches. Short and predictable subjects — "Invoice", "Interview Thursday" — can be found
that way; an unusual sentence cannot be guessed. The fingerprint is tied to the sender and
to the exact time, so the same subject on two messages looks entirely different and nobody
can sort a person's mail by subject.
Older records hold more in readable form. Records published before
23 September 2026 hold the subject in the clear, and records published by versions before
[version with recipient fingerprints, released on date] hold the recipient's address in the
clear. Those records stay as they are, because a published record cannot be recalled.
What stays on your device
- Your private keys and your recovery phrase.
- Your passphrase, and the mail password if you use automatic protection.
- The activity list (the last fifty things the software did), the counters, the address
book of senders whose signature checked out, the links you sent, and the domains the
look-alike check has learned.
None of that is sent anywhere. "Sign out" removes all of it from that device.
One exception, now closed: before version 0.5.5 the Outlook add-in kept the encrypted
recovery phrase in the mailbox's own settings, which are stored on the mail server. It moves
it to the device the first time 0.5.5 runs there, and removes it from the mailbox once the copy
on the device reads back the same.
Who else can see something
- The nodes we run hold the published records described above, in full.
Nodes of other parties hold none of them.
- Your organisation, if your address is on its confirmed domain: that you
use ProtectMyMail and which key and devices you have; and, if it keeps a recovery key,
your recovery phrase — with which it can read everything sealed to you. You are told this
in the plugin and the apps before anything is sent.
- Your mail provider and the recipient's: everything they see today
except the body of an encrypted message — who, when, how often, subject lines,
attachments.
- The gateway: mail in transit, the way any mail server sees it, and for
a secure link the recipients' addresses — blind copies included — and when a message was
opened. It does not hold your keys and cannot read an encrypted body.
- Our suppliers: TransIP (servers, Netherlands), KPN (connectivity,
Netherlands), Let's Encrypt (issues the certificates and therefore sees the host names),
Railway (hosts the web app for accounts and payments; [region]), Stripe (payments; Stripe
is a controller in its own right for card data and fraud checks), and our e-mail
provider for invoices and account mail [name].
Nothing is sold, and nothing is used for advertising or profiling.
How long things are kept
| What | How long |
|---|
| Your binding and your mailbox proof |
In the public record. A proof is valid for six months and can be renewed; a newer
binding replaces an older one, and the fact that the older one existed remains. |
| Message records |
Each node keeps up to 250,000 and drops the oldest first. Old ones therefore
disappear on busy nodes — after which the recipient's software says it could not
confirm the message, rather than pretending. |
| Messages in a mailbox on the network |
30 days, and at most 50,000 per node. |
| A secure link |
30 days by default; the sender may choose between one hour and 90 days, and may
withdraw it earlier. On expiry or withdrawal the encrypted message is deleted from
the network. |
| Mail that cannot be delivered yet |
Retried for five days, then given up on and the sender told. |
| Organisation records, device certificates and recovery escrows |
In the public record, like a binding. An organisation record runs at most 400 days;
a newer escrow replaces an older one; a revoked device stays listed as revoked. |
| Account and payment data |
While you have an account, then deleted — except invoices and payment records, which
the law makes us keep for seven years. |
| Server logs |
Until the log file's space is reused by newer entries; they are not archived. |
| Backups |
Encrypted, made nightly; the last 30 are kept, and the last 14 of those on a second
machine. |
Where it is kept
The network's servers stand in the Netherlands. The web app for accounts and payments runs
at Railway, and Stripe processes payments; both are American companies, and data may reach
the United States. Transfers rely on [the EU–US Data Privacy Framework certification of each,
or standard contractual clauses — to be confirmed per supplier]. Mail you send to someone else
naturally travels to their provider, wherever that is — sending mail to a Gmail address means
Google receives it.
Your rights, and what we cannot do
You may ask what we hold about you, have it corrected, ask for it to be deleted, object to
processing, and ask for a copy. Write to privacy@anuumail.com.
Two honest limits:
- A published record cannot be recalled. It is signed, it is copied to
every node, and being able to erase one would let a sender deny a message they really
sent. What we can do: stop publishing new records for you, and tell you exactly what is
out there.
- We cannot decrypt anything for you, including your own old mail if you
lose your recovery phrase. That is the point of the design, and it cuts both ways.
What you can do yourself: withdraw a secure link, replace your key with a new one (the
network records that the old one held your address until that moment), and remove everything
local with "Sign out".
If you think we handle your data wrongly, tell us first — and you may complain to the Dutch
Data Protection Authority (Autoriteit Persoonsgegevens).
How it is protected
- Keys are made and kept on your device, encrypted with your passphrase.
- Traffic to the site and the viewer runs over HTTPS; mail between servers uses STARTTLS
where the other server offers it.
- Mail stored for you on the network is encrypted for your key when you have published
one.
- Backups are encrypted and checked by restoring them.
- How much one sender may send out is limited, so one account cannot turn the gateway into
a spam source.
If something goes wrong
If personal data is exposed, we will say so: to the people affected where the risk is
material, and to the Autoriteit Persoonsgegevens where the law requires it. During the beta we
will also say what we changed to stop it happening again.
Cookies, tracking and children
This website sets no cookies and runs no analytics. The software keeps things on your own
device, which never leaves it. The service is not aimed at children.
Changes
This statement changes when the software does. The date at the top says when it last did.
Material changes will be announced on this site before they take effect.
What is stored, in technical detail →
← All documentation