ثمن الخصوصية
The cost of privacy
RocMail is paid — always, including the beta — because the alternative is being paid in something worse than money. One plan, one price: €5 a month, flat — no bulk discount, no first-year teaser, no coupon season. A discount is a lever, and a service that pulls levers on price will eventually pull them elsewhere. Longer blocks buy convenience, not a better rate.
An invite from the operator grants your first month free. That is the entire trial: no card harvested, no tier that watches you harder than another.
3 months
€15
€5.00 / month
6 months
€30
€5.00 / month
12 months
€60
€5.00 / month
Prepaid blocks, not subscriptions: nothing renews itself, no mandate sits against your name, and lapsing is not an emergency — sending pauses after a 14-day grace while your mail keeps arriving, stays readable, and can be exported at any time. Nothing is ever deleted for non-payment.
الدفع
How to pay — vouchers, in privacy order
Money buys a voucher code; the code feeds any account. The voucher never learns which mailbox redeemed it and the mailbox never records which voucher paid — the join between payment identity and correspondence is not stored. Anyone can buy a code and hand it to anyone else.
Cash by mail
Banknotes in an envelope with your printed request code. The only truly anonymous rail on earth, and we are proud to run it.
Residue: none. The postal address is published to invited members.
Monero (XMR)
Private by construction. Paid to our own self-hosted payment server — no processor, no exchange in the path.
Residue: effectively none on-chain.
Bitcoin (BTC)
Accepted on the same self-hosted server. Honesty note: Bitcoin is pseudonymous, not anonymous — chain analysis exists.
Residue: the public ledger. Prefer XMR or cash if that matters.
A voucher is prepaid months of service. An unredeemed voucher is refunded on request within 14 days of purchase; the terms say how, and when the right of withdrawal ends.
No cards — and the standing rule if that ever changes
There is no card checkout today. If one is ever added, it will work exactly one way: cards buy vouchers, not subscriptions — on the processor’s own hosted page, never inside ours. The processor would learn that a person bought a RocMail voucher, never which mailbox it fed, because the code is redeemed separately. No recurring mandate, no stored card against an account, no dunning machinery. Anything weaker than that will simply not ship.
ما تحصل عليه
Everything, for everyone — one plan
Sealed mailbox, end to end
Bodies, subjects, senders, attachments and their filenames, drafts, contacts, and the senders you block — ciphertext to everyone but you, including us.
Post-quantum cryptography
Mashrabiya, our hybrid seal (X-Wing: ML-KEM-768 + X25519), on every stored message, today.
Up to 500 names
A fresh address for every service; when one leaks, retire it. Your real mailbox never appears.
Search that stays on your device
Your devices build the search index themselves and keep it sealed. A search never reaches the server — not its words, not what it finds.
Two-factor login
TOTP with single-use recovery codes. Sign in by email or username plus password.
Installable, with an offline cache
Mail you have already opened stays readable if the connection drops while your vault is open. Signing in and unlocking need the network.
An operator who cannot read
The operator manages account shells only, from the server’s own console — no account holds that power, and the strongest query on the server meets ciphertext.
The exit door
Standard mbox export with attachments, built in your browser, and sealed ciphertext archives — of the whole mailbox, in the product, always.
No ads, no trackers, ever
Zero third-party requests on any page, enforced by policy the browser checks and tests that fail the build.
English, German and Arabic
The app speaks all three, with full right-to-left support built in, not bolted on — and so does this site.
5 GB per mailbox
Sealed mail and attachments count against it — the server counts bytes because it cannot read anything else. Full means new mail bounces to the sender until you make room; nothing is ever deleted for you.
Leaving, plainly
Export at any time — standard mbox or a sealed archive, of the whole mailbox. If you delete your account, deletion is immediate and final: the delete panel offers the sealed archive export first, warns you, requires a typed confirmation, and then destroys your vault keys — which makes your mail, names and contacts unrecoverable in the live service, by you and by us. Backups taken before the deletion keep the old wrapped keys until they age out (the schedule is in the privacy policy); they open only with your old passphrase or recovery phrase. No “30 days to change your mind,” no support ticket that undoes mathematics.
Unpaid is not deleted: an expired account only pauses sending. Deletion is yours alone to choose. Article VII, Right of Departure →