Keep your mail app
privymail.eu works with the apps you already use. Rather than its own protocol island, the service speaks open standards for mail, filters, calendars and contacts. In the default mode, Compatible, your mail app has native IMAP access in every paid plan, with no extra program between app and mailbox.
The standards at a glance
| Standard | Used for |
|---|---|
| IMAP | Fetching mail and keeping devices in sync |
| SMTP submission, POP3 | Sending (SMTP) and simple retrieval (POP3) |
| Sieve, ManageSieve | Filter rules on the server |
| CalDAV, CardDAV | Synchronising calendars and contacts |
| OpenPGP (RFC 9580) | Encrypting Sealed folders |
| WKD, Autocrypt | Publishing (WKD) and exchanging (Autocrypt) public OpenPGP keys |
IMAP runs as IMAP4rev1 with extensions such as IDLE and QRESYNC. IMAP4rev2 is not included, because Dovecot, the server software, does not provide it. IMAP and POP3 are available over TLS only. The Open source page lists the software in use.
What it works with
Through these standards, privymail.eu works with Thunderbird, Apple Mail, Outlook and any other IMAP and SMTP app. The standard is what counts, not a list of individually tested apps.
Automatic configuration handles set-up: Thunderbird autoconfig, Apple configuration profiles and SRV records (RFC 6186). There is also webmail in the browser. For your own domain, see Domain Autopilot.
Signing in from mail apps
To sign in over IMAP, SMTP, CalDAV or CardDAV, an app sends a secret to the server, protected by TLS. Mail apps therefore never sign in with your main password. Every device gets its own app password, which can be revoked individually.
Where an app supports it, OAuth 2.1 takes the place of the app password.
Two levels of protection
You choose the level of protection per folder.
Compatible (default)
Mail is stored encrypted with a separate key per account. When your mail app signs in, the server decrypts and delivers over TLS, so any IMAP app works without extra software. The price: the server temporarily processes plain text, for example while your app is signed in. Compatible is therefore neither zero access nor end-to-end encryption.
Sealed
These folders are encrypted with OpenPGP; decryption lies with your device, not the server. An ordinary mail app therefore cannot open them directly. Access is through our own software.
The Security page covers encryption, sign-in and the limits.
Moving and export
Open standards also apply to the way out. We call this exit by design: every plan includes a complete, free export of mail, contacts, calendars and keys in open formats. We document the data format, and the export tool uses standard protocols such as IMAP. For context, see the comparison.
Questions about mail apps and standards
Do I need an extra program for my mail app?
No, not in the default mode, Compatible: your mail app reaches the mailbox directly over IMAP. Sealed folders are different; an ordinary mail app does not open them directly.
Do you keep a list of tested mail apps?
No. The standards are what count: privymail.eu speaks IMAP and SMTP, the protocols that Thunderbird, Apple Mail, Outlook and other mail apps work with.
May my main password be stored in a mail app?
No. Every app gets its own app password, one per device and each individually revocable. More under Signing in and your account.
Can mail be fetched without encryption?
No. IMAP and POP3 are available over TLS only.
Does the export cost anything?
No. Every plan includes a complete, free export of mail, contacts, calendars and keys in open formats.