What happens to a message here.
The short, plain version. No message body is ever sent to a model, and nobody here reads your mail.
01when mail arrives
Our server checks who is sending: SPF, DKIM, DMARC and ARC, plus public blocklists. A first message from an unknown server may be asked to retry a few minutes later (greylisting). A spam filter then scores the message with rules and statistics, on our own machine. High scores go to your spam folder; very high scores are refused before they are accepted.
Your own allow and block lists are applied on top. Marking a message as spam, or as not spam, trains the filter for your mailbox.
02humans and machines
Mail from automated senders is tagged “auto”. The decision uses headers and rules only: List-Unsubscribe, List-Id, Precedence, Auto-Submitted, no-reply style addresses, the signing domains of bulk-mail providers, and what you have told us about a sender. One key hides all of it. You can overrule any decision with “this is a human” or “this is a machine”.
03where it is kept
Messages are stored on an encrypted disk, with a search index next to them so that searches like from:*@0wn.si or contract* are fast. The index is deleted with the message. Encrypted backups run nightly and are kept 7 daily / 4 weekly / 6 monthly.
04when you read it
- Plain text is shown first. HTML mail is cleaned against a strict allowlist and displayed in a sandbox that cannot run scripts.
- Tracking pixels and known tracker domains are always removed.
- Link-tracking parameters (utm_*, fbclid, gclid, mc_eid and friends) are stripped from links.
- Remote images are blocked until you ask, per sender or always. When loaded they come through our proxy, so the sender never sees your IP address.
- Read receipts are never sent.
05when you send
You write plain text. The message waits on our server for your undo window (5, 10 or 30 seconds), then leaves signed with DKIM. We add no pixels, no tracking links and no advertising footer.
06who can see it
You, and whoever you write to. Staff tools show accounts, billing and delivery statistics; they have no way to open a mailbox. Your mail is not used to train models, by us or by anyone we work with.
07when you leave
Export everything as mbox from settings → plan, as often as you like. Trash empties itself after 30 days. A deleted account is gone after its 14-day grace window, and its data ages out of backups within 6 months. The full schedule is in the privacy policy.