Privacy Policy

What Inpriv stores, what it can and can't read, how long it keeps things, and who else handles your data.

Effective 22 October 2026. Earlier versions are in the source history.

The short version

Mail between Inpriv users is end-to-end encrypted in the sender's browser. Your mailbox keys are locked with a mailbox passphrase that never leaves your device.
Mail from or to other providers (Gmail, Outlook…) is normal email. Our mail provider and our server can read it while it passes through; incoming mail is then stored encrypted to your key.
Subject lines, sender and recipient addresses, sizes and times are not encrypted. We need them to deliver and list your mail.
Temp inboxes are not encrypted. Their messages are deleted after 24 hours. The address itself is never given to anyone else.
We keep a security access log (the network your IP address belongs to, country, network operator, browser family, time, what happened) for 30 days.
Opening an email doesn't load anything from the sender until you choose Load images.
No ads, no analytics, no tracking cookies, no data sales. The code is open source, so you can check this.
Inpriv gives you an address that isn't your name. It doesn't make you anonymous (section 15).

1. Who we are

"Inpriv", "we" and "us" mean the operator of the Inpriv services at inpriv.xyz, mail.inpriv.xyz, temp.inpriv.xyz and id.inpriv.xyz. We are the controller of the personal data described here. Questions and requests: privacy@inpriv.xyz.

2. Encryption, in plain terms

"Encrypted" means different things in different places. Here's which is which:

Kind	What it protects	Who can read it
End-to-end (Mail between Inpriv users)	The message body, encrypted in the sender's browser to the recipient's public key (RSA-OAEP 2048 + AES-256-GCM)	The sender and the recipient. Not our server, as long as the pages it serves aren't changed (section 18).
Encrypted on arrival (mail from other providers)	The stored body, encrypted by our server to your public key as soon as it arrives	You, once stored. Before that: the sender's provider, our mail provider and our server, which received it as normal email.
Your Sent copy of mail to other providers	Stored encrypted to your key	You, once stored. The message itself went out as normal email (readable to our server, our mail provider and the recipient's provider).
Encrypted at rest (Cloudflare's storage)	Everything in our databases, against someone taking the disks	Our servers, and Cloudflare under its terms
HTTPS (every page and request)	Traffic between your browser and our servers	Our servers, which decrypt it on arrival
Not encrypted	Subjects, addresses, times, sizes; Temp messages; mail to our team addresses	Our servers

Encryption doesn't hide who writes to whom and when. That routing information stays readable to us and to the mail providers along the way.

3. Inpriv ID (your account)

Data	Why
Username and your `@inpriv.xyz` address	Identify your account and deliver your mail
Display name (optional)	Shown to people you write to
Recovery email (optional), whether it's verified, and short-lived hashed verification codes	Confirm that the address is yours. It can't reset your password or your mailbox passphrase, and we don't use it for anything else.
Password hash and salt (PBKDF2-SHA-256, 300,000 iterations)	Check your password when you sign in. Your password itself reaches our server over HTTPS at sign-in and is checked, not stored.
Two-factor secret (encrypted at rest) and hashed one-time recovery codes	Two-factor authentication, if you turn it on
Sessions: browser and system name, the first part of your IP address (e.g. `203.0`), created / last used / expiry times	Keep you signed in, and let you see and sign out sessions
Security events: type (sign-in, failed sign-in, password or 2FA change…), the first part of your IP address, browser name, time	Your security log on id.inpriv.xyz
Settings ("Skip mailbox passphrase"), connected services and profile preferences (encrypted at rest)	Make the services behave the way you chose
Rate-limit counters keyed by your IP address (IPv6: its /64) or by account	Slow down password guessing and mass sign-ups. Each counter is deleted within an hour of its window ending.

4. Inpriv Mail

Data	Readable by us?
Your public key and its key id	Yes. Others need it to write to you.
Your key ring: your private keys, encrypted in your browser with a key made from your mailbox passphrase (PBKDF2-SHA-256, 600,000 iterations)	No. The passphrase never reaches us. Someone who has the encrypted key ring could try to guess the passphrase, which is why it must be long and is never your password.
For each message: the other party's address and display name, the subject, the time, read/unread, direction, the encrypted size and which key it was encrypted to	Yes. Metadata needed to list and deliver mail.
For each message: the body and its formatting	No, once stored. It's encrypted to your key. Mail from or to other providers was readable while it passed through (section 2).
Sessions: browser and system name, created and expiry times	Yes
"Skip mailbox passphrase": per device, a random device id, the browser and system name, the time it was last used, and your passphrase key wrapped with a key that stays on that device	No, without the device

Mailboxes created before 22 October 2026

Until then, a mailbox's private key was locked with your Inpriv ID password, which our server receives every time you sign in. We never recorded it, but a compromised or compelled server could have used it to unlock that key. The next time you open such a mailbox, Mail asks you to set a mailbox passphrase:

your earlier key is moved into a new key ring locked with the passphrase, so your earlier mail stays readable;
a new key is made for mail sent to you from then on, and senders can only encrypt to that new key;
the copy locked with your password is removed from our servers (it may stay in Cloudflare's restorable history for up to 7 days, section 13).

This can't undo the past: mail encrypted to your earlier key was protected only as well as your password was. If that matters for some of it, delete those messages. Until you upgrade, your mailbox keeps working the old way.

Mail to and from other providers

Incoming: mail from other providers reaches our mail provider Resend over normal email. Our server fetches it, removes anything that could run in your browser (scripts, forms, frames), encrypts it to your public key and stores it.
Outgoing: mail you send to other providers is handed to Resend as normal email. Our server, Resend and the recipient's provider can read it. The copy in your Sent box is encrypted to your key.

5. Inpriv Temp

The inbox: its address, a hash of the access key your browser holds, and created and expiry times.
Messages: sender, recipient, subject, text and HTML body (with anything that could run removed), attachments (up to 512 KB each, 2 MB per message), size and time. These are stored unencrypted, so don't use Temp for anything sensitive.
Deletion: the inbox and its messages are deleted once it expires, 24 hours after it's created; cleanup runs every hour. Messages are never kept longer than 7 days in any case. You can delete an inbox yourself at any time.
Not logged: creating an inbox isn't written to the access log, and we don't record which network created it. Short-lived counters limit how many inboxes one network can create per hour.

6. Addresses are never reused

Every @inpriv.xyz address belongs to one owner at a time, and once it has been handed out it is never given to anyone else: not after a Temp inbox expires, and not after an account is deleted. Mail meant for the earlier holder, such as password resets from other sites, can't reach a new one.

To make that possible we keep, for every address ever issued, the address itself, which kind of service took it (account, Temp or team) and the day. Nothing else: no IP address, no account id, no messages. This record is kept for as long as Inpriv runs.

A limit we can't fix: before 22 October 2026, expired Temp addresses could be issued again, and most of them were never recorded. We now refuse every address in the old Temp format (like amber-fox-123) and every Temp address in our records, but a custom Temp name (one you typed yourself) that was used and expired before 17 October 2026 isn't on record, and could still be claimed.

7. Access log and security events

To investigate account takeovers and abuse reports, and to answer valid legal requests, we keep an access log. Each entry has:

the time, the service, and what happened, such as "Mail sign-in", "message sent" or "mailbox key upgraded";
the account (username);
the network your IP address belongs to, not the full address: the first three parts of an IPv4 address (203.0.113.0/24) or the first 48 bits of an IPv6 address;
the country and network operator (ASN) for that address, and your browser family and system (for example "Firefox · Linux").

It's written when you create, sign in to or change your Inpriv ID (failed sign-ins included), sign in to Mail, create or upgrade a mailbox, change your mailbox passphrase or send a message. It doesn't record recipients, message content, passwords, passphrases, keys, tokens or recovery codes. Entries are deleted after 30 days, including after you delete your account.

A network, a country and a time are not anonymous: combined with an account, they can still point to a person or a household.

Entries written before 22 October 2026 hold the full IP address, the full browser string and, for sent mail, the recipient address. They're deleted 90 days after they were written, so all of them are gone by 20 January 2027.

Separately, your security log on id.inpriv.xyz (section 3) keeps the first part of your IP address and your browser name for 90 days, so you can review your own account.

8. Images and links in email

Emails often load images from the sender's servers, which tells the sender that you opened the message, when, your IP address and your browser. Mail and Temp block all of that by default: images, tracking pixels, stylesheets, fonts and other files hosted elsewhere. Scripts, forms and embedded pages never run.

If you choose Load images for a message, your browser fetches that message's images from the sender's servers, and the sender learns the above. Opening a link takes you to the other site, which sees your IP address and browser; Inpriv doesn't pass on which page you came from.

9. On your device

We don't use tracking or advertising cookies. The sites store only what they need to work:

id.inpriv.xyz: a sign-in cookie that page scripts can't read (HttpOnly, Secure, SameSite=Strict). Other Inpriv sites ask id.inpriv.xyz whether you're signed in, for Quick Sign-In.
Mail: a sign-in cookie of the same kind, for mail.inpriv.xyz only. While Mail is open, your unlocked keys are held in the page's memory and are dropped when you sign out or close it. The page also remembers the key ids of people you've written to, to warn you if one changes.
Mail, with "Skip mailbox passphrase" on: a random device key and device id in the browser's storage. With them, this browser opens your mailbox without the passphrase. Anyone who can use this browser profile can open your mailbox too, and so could any script that managed to run on mail.inpriv.xyz. Use it only on devices you trust. Turning it off on any device removes it from every device; you can also forget single devices in Mail's Account tab.
Temp: the access key for your current inbox, in the browser's storage, until the inbox expires or you delete it.
Everywhere: your theme and a few display preferences.

Clearing your browser's site data removes all of this.

10. Account and key recovery

Inpriv ID password: there's no reset by email yet. If you have two-factor on, a recovery code replaces a lost authenticator, not a lost password.
Mailbox passphrase: nobody can recover it, including us: we never have it. If you lose it, you can start over with a new key (with your password, and your two-factor code if it's on). Your address keeps working and new mail can be read, but mail sent to you before stays stored and can't be opened again. Recovering your account never gives anyone your earlier mail.

11. Mail you send to us

Messages to our team addresses (support@, abuse@, dmca@, legal@, privacy@, security@, admin@, hello@) are stored as received, so we can answer them, and kept until we delete them. They aren't end-to-end encrypted.

12. Who else handles data

Provider	What for	What it handles
Cloudflare, Inc.	Hosting, network and databases (Workers, D1)	Every request, including your full IP address, and all stored data, which is encrypted at rest
Resend, whose mail servers for `inpriv.xyz` run on Amazon Web Services in Ireland (eu-west-1)	Receiving and sending email with other providers; Inpriv ID verification emails	Mail to and from non-Inpriv addresses and verification emails, including their content and the addresses involved

These providers process data on our behalf under their own terms and data-processing agreements. They may process it outside your country, including in the United States. Where the law requires, the transfer relies on safeguards those providers offer, such as the European Commission's Standard Contractual Clauses.

They keep their own operational logs and copies under their own policies, and we don't control how long. We haven't turned on Cloudflare's optional Workers request logging (Workers Logs or Logpush). Error messages our code writes don't include message content, passwords or keys.

We don't sell or rent personal data, and we don't share it for advertising.

13. How long we keep it

Data	Kept until
Inpriv ID account, mailbox, key ring and stored mail	You delete your account. Deleting your Inpriv ID also deletes your mailbox and all its mail.
Individual messages	You delete them
Sessions	Expiry (30 days) or sign-out. Changing your password or two-factor setting, or signing out everywhere, ends your Mail sessions too.
Access log	30 days (entries written before 22 October 2026: 90 days)
Your security log (ID security events)	90 days
Rate-limit counters, sign-in tickets	Minutes to hours; deleted hourly once expired
Temp inboxes and their messages	24 hours (at most 7 days for any message)
Which addresses were ever issued (section 6)	As long as Inpriv runs
Verification codes	15 minutes
Mail to our team addresses	Until we delete it

Deleted isn't instantly gone everywhere: Cloudflare keeps a restorable history of each database, 7 days on our current plan, so deleted data can remain there that long. Clean-up runs every hour; if it fails, it catches up on the next run. When we receive a valid legal preservation request, we may keep the specific data it covers for longer, only as long as the law requires.

Only:

with the providers in section 12, to run the service;
when the law requires it, in answer to valid legal process. See the Law Enforcement Guidelines for what can and can't be provided. We notify affected users unless the law forbids it or it would put someone in danger.
to protect someone's life or physical safety in an emergency;
to investigate and stop abuse of Inpriv, as described in the Acceptable Use Policy.

15. Pseudonymous, not anonymous

An Inpriv address doesn't carry your name, but that alone doesn't make you anonymous. What can link an address to you:

the access log, which ties sign-ins to a network for 30 days, and the networks and times our providers see;
a recovery email, if you add one;
what you write, who you write to, and when: encryption doesn't hide that routing information;
using the same address, display name or writing style elsewhere;
mail to other providers, which they read and keep under their own policies.

Tor or a VPN can hide your IP address from us. They don't hide your account, your recovery email, the people you write to or what you write. If your safety depends on not being identified, don't rely on Inpriv alone.

16. Legal bases

Where the EU or UK GDPR applies, we rely on:

contract: your account, mailbox, messages, sessions and settings, which we need to provide the service you signed up for;
legitimate interests: the access log, security events, rate limits and the record of issued addresses, to keep the service and its users secure. We limit them to what's needed for that, and delete them on the schedule above.
legal obligation: responding to valid legal requests and keeping data a preservation request covers;
consent: the optional recovery email, which you can remove at any time.

17. Your rights

Depending on where you live, you can ask us to:

give you a copy of your data;
correct it;
delete it (you can delete your account yourself in your account settings on id.inpriv.xyz);
restrict or object to how we use it;
hand it to you in a portable format.

Write to privacy@inpriv.xyz from your @inpriv.xyz address, or say how we can verify you. We answer within one month.

We can't hand over stored mail content, because we can't decrypt it, but you can open and copy it yourself while you're signed in. You also have the right to complain to your data-protection authority.

18. Security, and its limits

All traffic uses HTTPS, and every page tells browsers to use only HTTPS.
Passwords are stored as salted hashes, 2FA secrets are encrypted at rest, and only hashes of session tokens are stored.
Your mailbox keys are locked with a passphrase we never receive. Mail that other people send you is encrypted to a public key you can check: Mail shows each key's id and warns you when a known recipient's key changes.
Pages only run their own scripts, and email content is shown in a frame that can't run any.
The admin panel needs a separate authenticator code; every lookup of user records in it is logged.

What encryption in a web page can't protect against: the code that encrypts your mail is delivered by our servers each time you open Mail. If those servers, or the code, were compromised or compelled to change, a modified page could capture your passphrase or messages. The same applies if your device or browser is compromised. The code is open source so changes are visible, but your browser doesn't check the code it runs against the published source.

No independent audit of Inpriv has been done. If a breach affects your data, we'll tell you and the relevant authority as the law requires. Found a vulnerability? See SECURITY.md.

19. Children

Inpriv isn't for children under 16. We don't knowingly hold data about them. If you think a child has an account, write to privacy@inpriv.xyz and we'll delete it.

20. Changes

We'll update this page when what we store changes, and change the date at the top. For significant changes we'll also give notice on the site before they take effect. The full history is public in the source repository.