Privacy
1. Controller
The controller for personal data processed by Envelt is WebsiteDev. Solutions GmbH, Kreuzackerweg 14, 3250 Lyss, Switzerland. Privacy enquiries: privacy@envelt.com. This policy is written to satisfy the Swiss Federal Act on Data Protection (FADP) and, where it applies to you, the EU/UK General Data Protection Regulation (GDPR).
2. Data we store, and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Username | Identify your account, form your address | Contract | Until account deletion |
| Argon2id hash of a password-derived authentication key | Login. The password itself never reaches us. | Contract | Until deletion |
| Public key; private key wrapped in your browser | Encrypt incoming mail; return the wrapped key to your browser at login | Contract | Until deletion |
| Addresses (mailbox or forward) and forwarding destinations | Route mail. A forwarding destination must be readable to forward to it. | Contract | Until you remove them |
| Custom domains, verification token, DKIM signing key | Accept and sign mail for your domain | Contract | Until you remove them |
| Per message: opaque id, folder, unread and starred flags, size, ciphertext | Store and list your mail. Sender, recipient, subject and dates exist only inside the ciphertext. | Contract | Until you delete the message |
| Plan name and expiry date; storage used | Apply plan limits | Contract | Until deletion |
| Open invoices: amount, network, months, expiry | Match an incoming USDT transfer to your account | Contract | Deleted when paid or expired |
| Spam classifier: one-way hashes of words in messages you mark as spam or not spam, with counts | Filter spam for you | Legitimate interest (yours) | Until deletion |
| Whether mail-app access is enabled | Allow IMAP/SMTP login | Contract | Until you turn it off |
3. Data we deliberately do not collect
- IP addresses. The web application never reads the client address, the reverse proxy strips forwarded-address headers and discards its logs, and the mail server logs to nowhere.
- Timestamps of registration, login or reading. Sessions exist only in memory. Stored file timestamps are neutralised.
- Who mailed whom. There is no index of correspondents. Forwarded mail passes through and leaves nothing behind.
- Device or browser fingerprints, analytics, cookies for tracking. See the Cookie Policy.
- Identity documents, phone numbers, recovery addresses, payment identities.
4. Data that passes through us without being stored
Email is a transport service. To deliver a message we necessarily process it in memory: incoming mail is authenticated (SPF, DKIM, DMARC lookups on the sender's domain), scored for spam and encrypted before it is written to disk. Outgoing mail is signed and handed to the recipient's mail server in the form email requires. Messages in transit are protected with TLS when the other server supports it.
Mail sent to you contains header lines written by the sender's servers, which may include their IP addresses; these are stored only inside your encrypted message.
5. Mail-app access (IMAP/SMTP)
If you enable it, each login from a mail app sends your password to our server, which derives your key and keeps it in memory for that connection only. Nothing about these sessions is logged. It is off by default.
6. Recipients and transfers
We do not sell, rent or share personal data. Data leaves our systems only: (a) as email you send, to the recipient's mail provider; (b) as DNS queries about sender domains when authenticating incoming mail; (c) as read-only queries to public blockchain nodes to detect payments to our address (these queries reveal our address, not yours); (d) to our hosting provider, which stores encrypted disks and has no application-level access; (e) when required by law, subject to Section 9. Where data is transferred outside Switzerland or the EEA, we rely on the recipient country's adequacy or on standard contractual clauses.
7. Your rights
You may access, correct, export and delete your data. Because your mail is encrypted to your key, the practical way to access or export it is through the web app while logged in; we can provide only ciphertext. Account deletion is self-service and immediate. You may object to processing based on legitimate interest and lodge a complaint with the Swiss Federal Data Protection and Information Commissioner or your local supervisory authority. Contact privacy@envelt.com; we answer within 30 days.
8. Security
Client-side key generation, X25519 and AES-256-GCM for stored mail, Argon2id for authentication hashes, TLS for every connection, a content security policy that blocks all remote loads, and a server design that holds no logs. No system is perfectly secure; if we learn of a breach affecting your data we will notify you through the Service and, where required, the authorities.
9. Legal requests
We respond only to requests that are valid under Switzerland law. Because of how the Service is built, what we can produce for any account is: the username, the public key, the wrapped private key (unusable without the password), the list of addresses and forwarding destinations, plan and expiry, and ciphertext blobs. We cannot produce IP addresses, login history, message contents, subjects or correspondents, because we do not have them.
10. Children
The Service is not directed at children under 16 and we do not knowingly hold their data. Because we collect no identity data we cannot verify age; if you believe a child is using the Service, contact us.
11. Changes
We will announce material changes on the Service at least 14 days before they take effect. The date at the top shows the current version.