الأمانة
Ethics, with mechanisms
Every service promises to respect your privacy. The difference worth paying for is enforcement — commitments that hold even when the operator is lazy, acquired, subpoenaed, or hacked. Each commitment below names the mechanism that keeps it; where the mechanism is weak, the entry says so.
These commitments are governed by the RocMail Constitution — the document this service answers to, whose articles are held in place by tests that fail the build if a protection is removed.
We cannot read the mail we store
Not a policy — a property. Stored content is sealed to keys only you hold; the server key that once existed was destroyed on the record. The honest edge: mail from outside is seen as it arrives and sealed at once, and mail to outside addresses is seen while it is sent. Between members, it is sealed in the sender’s browser.
Mechanism: Mashrabiya — ML-KEM-768 + X25519 sealing at ingest; the vault passphrase never leaves your device.
No advertising, ever
Advertising funds itself with attention and pays in profiling. A mail product that shows ads is reading something to target them.
Mechanism: the business model is paid accounts. There is no ad surface in the codebase to fill.
No trackers, no third-party requests
Pages here load from this host and no other. No analytics scripts, no CDN fonts, no like buttons, no tracking pixel in the mail we send you.
Mechanism: the Content-Security-Policy forbids third-party script and connect targets outright — a regression would refuse to load, loudly.
Leaving destroys the keys, not merely the rows
Delete your account and the first thing destroyed is every wrapping of your mailbox key in the live database — the mail there becomes unreadable at once, to anyone. Backups taken before the deletion keep the old wraps until they age out, and open only with your old passphrase or recovery phrase. Deleting rows alone could not promise even that: databases keep copies of deleted data in pages, logs and replicas. There is no escrow and no support path that reverses it, for anyone.
Mechanism: shredVault() runs first in the deletion cascade, and a test sweeps every table and column in the schema for the departed account id — a future table cannot quietly keep someone who asked to be erased.
No data economy
We do not sell, share, enrich, or "anonymise and aggregate" your data. There is nothing to build the product on but the product.
Mechanism: the interesting data is ciphertext. You cannot monetise what you cannot read.
Remote images blocked by default
Marketing mail embeds pixel beacons that report when and where you read. RocMail shows you the message without letting it phone home.
Mechanism: sender HTML is sanitised and remote content held behind a per-message, per-sender choice that defaults to off.
An exit door that works
Lock-in is a business model built on the cost of leaving. Your mailbox exports to standard mbox, attachments included and built in your browser — plaintext, portable, yours — plus a sealed archive format for encrypted backups.
Mechanism: both exports ship in Settings today, not on a roadmap. Both hold the whole mailbox.
The operator is bound too
A multi-user instance needs an operator; ours manages accounts, not correspondence. Suspend, invite, delete — never read. And no account holds even that: it is done on the server’s own console, so a stolen password or session opens one mailbox and nothing more.
Mechanism: there is no privileged read path to remove, and no admin page to phish. The operator’s commands run against ciphertext like everyone else’s queries.
Payment that does not identify you
The cost of privacy is paid in money, never in identity: cash by mail, Monero, or Bitcoin buy a voucher, and the voucher feeds any account.
Mechanism: the voucher table stores no user link and redemption never learns which code paid — the join between payment and mailbox does not exist to be compelled.
Honesty about limits
Traffic analysis, the unlocked-device problem, the client-update trust — the failure modes are printed on the security page, not discovered in a breach notice.
Mechanism: the threat model is public and versioned with the source. Where the docs and the code disagree, the code is authoritative and the doc is the bug.
لماذا
Why an email service, and why like this
Correspondence is where people are most themselves — contracts and love letters, diagnoses and dissent. The industry default treats that intimacy as inventory. We think the correct amount of insight a mail provider should have into its users’ lives is none, and we built the product so that opinion is enforced by mathematics rather than depended on from goodwill.
The same conviction is why this product does one thing. Every feature you will not find here — feeds, boards, trackers, engagement mechanics — is a feature that had to justify reading something about you, and could not.