الخصوصية

Privacy policy

Effective 2026-11-06 · applies to the RocMail service and these public pages

This policy is short because the honest answer to most privacy-policy questions is: we do not have that data. The mail we store is sealed to keys only you hold — the server sees mail from outside only as it arrives, and mail to outside addresses only while it sends it; the public pages set no cookies and load nothing from third parties. What we do hold is listed below, with how long we hold it.

What we store

• ✦Your account email, username and a password hash — to sign you in.
• ✦Ciphertext — your mail, drafts, contacts, attachments and the list of senders you block, and your passwords with the files attached to them and their earlier versions kept for undo, all sealed to your vault keys. A password you share by link is a sealed copy whose key is only in the link you hand out: it never reaches us. We cannot decrypt any of it.
• ✦Your wrapped vault keys — the keys that open your mail, each wrapped under your passphrase, your recovery phrase or a security key. The server stores the wraps and cannot open any of them.
• ✦Routing metadata — timestamps, folder and read flags, message-ids, attachment counts and sizes, the forwarding addresses of your names — the minimum the server needs to act as a mail server while your vault is closed. Content is sealed; this metadata is not. It sits in plain database columns, stored unencrypted on this server’s disk. Forwarding addresses and 2FA secrets are additionally encrypted under a server key.
• ✦Not your searches — search runs on each of your devices, over an index that device builds by opening your mail and keeps sealed in its own storage. We are never told what you search for or what it finds. We do see each device download every letter once, to read it, and a letter move to Spam when a device applies one of your Blocks.
• ✦Spam training — when you mark a message as spam or not spam, the sender’s domain and your decision, so the next letter from that domain is filed the same way — kept for as long as the account exists. The spam filter itself keeps no message history.
• ✦Security logs — login attempts and administrative actions, with IP addresses, kept for abuse defence and deleted automatically on the schedule below.
• ✦Billing — the date your paid period ends. Vouchers record no account; an unpaid self-serve invoice is deleted after two days.
• ✦The public key log — for each Name whose key the member directory has handed out: a label in place of the address, a fingerprint of the key, and the time. The log is public and permanent, because an append-only log is what lets anyone check that the server hands everyone the same key ([how it works](/transparency#key-log)). Its entries never contain the address: someone who already knows an address can find its entries by asking the directory about it, but no address can be read out of the log. When a Name or an account is deleted, a last entry records that the key is gone, and the server deletes its own note of which label belongs to which address.
• ✦The mail server’s journal — for every delivery, the sender, recipient, client IP address, message id, size and delivery status — kept two days, then gone. It never leaves this machine.

How long, exactly

Every period below is enforced by the server’s scheduled clean-up, not by intention. A rule that runs daily can let a row outlive its stated age by up to a day.

Backups

Backups contain the wrapped mailbox keys. So mail you delete — or an account you delete — stays recoverable from an older backup, with your old passphrase or recovery phrase, until that backup ages out: up to 29 days on the server, up to 90 days on the off-box copy. Each backup is encrypted to a key that never lives on the server. Nobody can open a backup’s mail without your passphrase or recovery phrase; the operator cannot either.

What we do not do

• ✦No analytics, no trackers, no fingerprinting — on these pages or inside the app.
• ✦No cookies for visitors. Signed-in users get exactly two: a session and its CSRF twin.
• ✦No selling, sharing, or "aggregating" of user data. There is no advertising anywhere in the product.
• ✦No reading of mail content beyond delivering it — spam scoring happens in memory at arrival, before sealing, and keeps only the verdict; a letter to an outside address is read only to transmit it. If a letter cannot be stored the moment it arrives — the database briefly refusing writes, or an error while storing it — it waits encrypted under the server’s key and is tried again every 15 minutes. Once it can be stored it is sealed like any other; if it still fails after a day for a reason other than the database, its sender is told it could not be delivered; one that still cannot be stored after 14 days is deleted without a notice to its sender.
• ✦No third-party requests from your browser: the app’s own security policy forbids them, and a remote image inside a letter loads only when you ask for it.

Infrastructure

This instance runs on a server rented in our name alone in Reykjavík, Iceland, behind no CDN and no third party’s network: our own machine terminates TLS and therefore sees traffic in transit the way any host does; mail content is already ciphertext before it is stored, which is the layer this product adds. The mail server’s journal stays on that machine; the database leaves it only as the encrypted nightly backup described above.

Legal requests

If compelled by law, we can produce what we hold: the account email, the routing metadata above, the security logs within their retention, and ciphertext. We cannot produce mail content, passphrases, or vault keys, because we do not have them — the same answer a thief gets. Where law permits, we will tell you a request happened.

Deletion — what it destroys, and how we know

Deleting your account destroys the keys, not merely the rows. The very first thing the deletion does is destroy every wrapping of your mailbox key in the live database. That makes your mail there unreadable at once, to anyone — including the copies that database pages, write-ahead logs and replicas keep of deleted rows, which deleting rows alone could never reach. Backups taken before you pressed the button still hold the old wraps until they age out, as described under Backups.

Then the account itself is cleared from every table that holds it — mail, names, attachments, contacts, drafts, passwords with their files, earlier versions and share links, rules, scheduled sends, devices, sessions, push subscriptions, spam training, audit entries, custom domains and the invites you issued. The public key log keeps its entries, which never held your address, and gains a last one for each of your Names saying its key is gone. A test sweeps the entire schema — every table, every column — for your account id after a deletion, so a table added to this product in future cannot quietly keep a person who asked to be erased: it fails the build instead.

There is no escrow, no operator override, and no support request that reverses it — not for you, not for us, not for anyone holding a court order. Export first if you want a copy: the delete panel offers the sealed archive export first, warns you, and requires a typed confirmation. What we cannot reach: copies you exported yourself, mail you already sent that lives in other people’s mailboxes, and logs kept by the infrastructure underneath us.

Your rights under the GDPR

The operator of this instance, named in the imprint, is the controller of the data above. We process it on two legal bases: the contract with you, for everything needed to provide the mailbox (Art. 6(1)(b) GDPR), and our legitimate interest in keeping the service safe, for the abuse and security logs (Art. 6(1)(f)).

• ✦Access to what we hold about you (Art. 15). Settings shows your account; the exports give you your mail.
• ✦Rectification of what is wrong (Art. 16).
• ✦Erasure of your account and everything in it (Art. 17) — immediately, from Settings, as described above.
• ✦Portability of your mail and your passwords (Art. 20): the sealed archive export and the mbox export of the whole mailbox, in Settings, and the encrypted or plain export of your passwords, in Passwords.
• ✦Restriction of processing while a question about it is open (Art. 18).
• ✦Objection to processing based on our legitimate interest, such as the security logs (Art. 21).
• ✦Complaint to a data-protection supervisory authority, in particular where you live or work (Art. 77).

Export and deletion you can do yourself, at any time. For anything else, write to security@rocmail.is; we answer within a month. We cannot hand you your mail in readable form — only your browser can open it, which is why the exports run there.

Changes

This policy is versioned with the source code. If it changes, the change is visible in the repository history, dated above, and material changes are announced to account holders by mail.