Privacy information for Free (test phase), version free-beta-1

Archive copy of version free-beta-1. Fixed address of this version: /en/legal-archive/free-beta-1/privacy-free/. The text remains available here unchanged. If a newer version is in force, this is an earlier version; the version in force is at Privacy information.

1. The essentials

• Test phase. The Free plan is being trialled. There is no availability commitment, no commitment to restore your data from a backup and no third-party review. Do not store sensitive or business-critical content (section 3).
• What we collect at registration: the address you choose and a verification record for your password. The password itself does not leave your device. We do not ask for a name, phone number, second address or payment data.
• Your stored mail is encrypted on the server with a key of your account. This is the "Compatible" mode. It is neither end-to-end encryption nor "zero access": the server sees plaintext when delivering, when sending and during a mail session (section 6).
• Two exceptions to this encryption: Drafts and send jobs of the webmail are also kept in an operating journal protected by a server key that is the same for all accounts; completed entries are meant to lose the message and the attachments after 24 hours (what remains is the checksum, size, kind of operation and time), and the journal is meant to be deleted when your account is deleted. A message in the mail server queue lies unencrypted on the disk until it is delivered (section 4.2).
• Mail initially goes only between Free accounts. Addresses @privymail.eu cannot be reached from outside, and the service does not send mail to external addresses. Sending in the webmail and with an email client (IMAP and SMTP, with an app password) is intended. We do not promise that it is possible when this information is published.
• No advertising, no analytics, no third-party content. We set exactly two technically necessary cookies and use no tracking or analytics service (section 10).
• Access and deletion you request by e-mail; there is no button for them yet. We handle requests by hand, within one month. There is no bulk export. (sections 8 and 9)

2. Who is responsible?

(Art. 13(1)(a) and (b) GDPR)

3. What "test phase" means

The Free plan goes live for first users before all reviews and operating structures exist. The test phase has no fixed end; we announce its end with at least 14 days' notice. Before registration we show the key points in a box. Honestly, that means:

• The encryption of stored messages has not been reviewed by an external party (no external cryptography review). There has been no external penetration test. A data protection impact assessment under Art. 35 GDPR does not exist.
• The virtual machine on which the server runs is backed up in encrypted form; the backup storage is in Düsseldorf (Germany). Restoration is not promised and has not been demonstrated by a restoration test; it can lose data up to the time of the last backup. If the server or its disk fails, accounts and messages can be lost, and it is possible that nobody can sign in any more. Deleted content can remain in backups; we do not yet state how long backups are kept (section 8). At a software change we first create an intermediate copy of the account database on the same server, which stays until we delete it; it does not protect against a failure of the server (section 4.3). Data can be lost.
• There is no availability commitment and no round-the-clock on-call. The server installs software updates automatically and may restart at night for that; further restarts are possible.
• Mail goes only between Free accounts. Before external delivery is enabled we will update this privacy information.
• The number of accounts is limited for now. When the limit is reached, registration closes and reports that no places are free at the moment.
• If you lose your password and your recovery codes, access and mail cannot be restored. We have no master key for stored mailboxes.

4. Which data do we process? From where, where, how long?

(Art. 13(1)(c) and (e), (2)(a) and (e); Art. 14(2)(f) GDPR)

All data come from you or arise from your use. Exception: data of other people in messages that other Free users send you (sender address, content). Not processed as of today: name, phone number, date of birth, a second address, payment data, location data, and device or browser identifiers in the account database. Messages can contain any personal data, including particularly sensitive details such as health information. We process contents only technically, to store and deliver them, and we do not read them. The Free plan is not meant for such content during the test phase.

4.1 Account and sign-in

The dashboard only reads these existing details and shows them to you. It stores nothing additional and keeps no sign-in history and no event log.

4.2 Mailbox, webmail, sending

Headers: The template of the mail server sets smtpd_hide_client_session = yes; the effect has not been checked in operation.

Free limits (for orientation): immediate sending; initially at most 10 recipients per 24 hours, after seven full days 50; at most 10 recipients and 10,000,000 bytes per message.

4.3 Protection, technology, logs

5. For what purpose and on which legal basis?

(Art. 13(1)(c) and (d) GDPR)

Legitimate interests (Art. 6(1)(f) GDPR) are named per purpose in the table; your right to object is in section 9.

6. Who can technically access your data?

An honest answer for the "Compatible" mode (the default).

• Stored messages are encrypted with a key of your account. The private key exists only "wrapped", once each for your password, every app password and every recovery code. We have no master key.
• Compatible is neither end-to-end encryption nor "zero access". The server sees plaintext (a) when delivering and sending, (b) during a mail session through webmail or a mail program, because Dovecot then holds the unlocked key in memory, (c) on account changes such as new app passwords, where your device sends the server an unlock secret derived from the password (memory only, not stored).
• The same limit applies to anyone with administrator access to the running server. The server runs without disk encryption.
• Transport: browsers connect only over HTTPS. TLS is intended for mail programs, at least TLS 1.2.

Metadata (sender, recipient, time, size, folder) are visible to the server at every protection level. In this stage there is no automatic content scanning (spam or virus filter), and the service queries no block lists or information services of third parties.

7. Recipients, processors, third countries

(Art. 13(1)(e) and (f) GDPR)

Not involved: advertising and analytics services, third-party CAPTCHA services, payment service providers (Free is free of charge), VPN providers (not part of this plan in the first go-live), spam or reputation services of third parties in this stage.

Third countries. We do not intend to transfer user data to countries outside the EU and the EEA. Two third-country links do exist, however: the AI-assisted tools in development come from a company based in the USA, and the source code is kept with a host in the USA (sections 6 and 7). The source code contains no user data. The tool with administrator rights on the production server can, however, see user data there, and its commands and outputs go to the provider in the USA for processing (section 6). When external delivery of mail is enabled (later), messages can go to servers outside the EU; we will inform you beforehand.

Data of third parties (Art. 14). Messages contain data of other people, for example senders. We process them only to provide the service for you and do not inform these people individually.

8. How long do we store data? Deletion

(Art. 13(2)(a) GDPR)

The periods are in the tables in section 4. In short:

Deletion today. There is no button for deleting an account. You delete individual messages, app passwords, sessions and second factors yourself. We delete a whole account by hand on your request within 30 days with our operator tool. There is no cooling-off period; you can withdraw your request until it is carried out. After deletion the address is not issued again. For this we keep a block entry, that is, a keyed check value of the address without plain text, without account identifier and without time, without limit (section 4.1). Its purpose is to protect the post and identity of former holders; the legal basis is Art. 6(1)(f) GDPR. You can object to this storage under section 9; we examine an objection case by case. In doing so we remove the account and access data from the database and delete the mailbox together with the key copies; the block entry remains as the only remnant in the database. Deletion removes the rows from the database. Physical remnants (for example address and account identifier) may remain on the disk of the server until the database service overwrites the space at a later clean-up or with new data; we do not promise a fixed period for that. The webmail journal is meant to be deleted together with the account. Logs disappear only when their periods expire. Deleted content may still be contained in backups of the virtual machine; we do not yet state for how long (section 8). An intermediate copy of the account database (section 4.3) may likewise still contain the account until it is deleted. There is no automatic deletion of unused accounts. Orphaned registrations whose key never reached the mail server are discarded by the clean-up run (every 5 minutes) as soon as they are older than 15 minutes.

9. Your rights

(Art. 13(2)(b) to (d) GDPR)

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). There is no consent in the Free service that you could withdraw (Art. 7(3)).

• How to exercise your rights: by e-mail to legal@patchletter.com (alternatively hello@patchletter.com) or by post to the address in section 2. We reply without undue delay and at the latest within one month (Art. 12(3) GDPR). Exercising your rights is free of charge. Please do not write passwords, codes or mail contents into the request.
• Proof: So that nobody can obtain someone else's data by deception, we reply only to the address of your account and require proof from the signed-in account. We handle requests by hand, within one month. Accounts without access: Without password and recovery code we cannot release or delete anything.
• Export and data portability (Art. 20): There is no bulk export, and we cannot decrypt and hand over your mailbox without your password or a recovery code. You download individual messages in the webmail as a file. Retrieving all messages with a mail program via IMAP is intended; we do not promise that it is possible when this information is published (section 1). We answer requests for data portability by referring to this retrieval, within one month.
• Complaint: You can lodge a complaint with any data protection supervisory authority (Art. 77 GDPR), in particular at the place of your residence or of the alleged infringement. Competent for us: the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany, postal address Postfach 20 04 44, 40102 Düsseldorf.

Your right to object

You have the right, on grounds relating to your particular situation, to object at any time to processing of your personal data that we base on legitimate interests (Art. 6(1)(f) GDPR) (Art. 21(1) GDPR). We then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. We do not process your data for direct marketing. Send your objection to the address in section 2.

10. Further information

• Do you have to provide data? For an account, address and password are necessary; without them we cannot set up an account. For webmail and mail programs you need an app password. A second factor and labels are optional. (Art. 13(2)(e) GDPR)
• Cookies: Only two technically necessary cookies on account.privymail.eu: __Host-privymail-session (session, at most 7 days) and __Host-privymail-login (sign-in step, at most 10 minutes). Both are Secure, HttpOnly and SameSite=Strict. There is no local browser storage, no service worker, no fonts or scripts from third parties and no tracking or analytics service; you choose the language through the address (/de/, /en/). The webmail does not load external content from messages.
• Automated decisions, profiling: We do not build profiles and do not take any decision based solely on automated processing with legal or similarly significant effect (Art. 22 GDPR). Limits do take effect automatically: blocking sign-in attempts for a time window, temporary refusal of mail above the Free limits (SMTP 451), temporary refusal of requests in webmail when an account makes too many at once or too quickly one after another (a technical protection of the other accounts, not a measure against you), closing registration when the account budget is reached. There is no automatic account suspension.
• Minimum age: You must be at least 16 years old. If you are not yet 18, clause 4.2 of the terms of use also applies (consent of your parents or legal guardians).
• Commitments: We do not use your data for advertising and do not sell it.
• Changes: We adapt this privacy information when processing or the legal position changes, in particular before external delivery of mail and at the end of the test phase. The current version carries version and date. We announce material changes on the website and, as far as possible, by a message to your mailbox.
• Further texts: The Terms of use and the Acceptable use policy belong to the same set of texts (version free-beta-1).
• Version: free-beta-1 dated 21 October 2026, revised on 8 November 2026 (details on the location of the server and on backups, sections 1, 3, 4.3, 6, 7 and 8).