What is stored, and who can see it

A specific inventory rather than a reassurance. Judge it yourself.

What never leaves your computer

Your private keys. They are calculated on your device from your recovery phrase and are never transmitted anywhere, in any form.
Your recovery phrase. Shown to you once, then held only by you.
Your mail password, if you use automatic protection. It is stored encrypted on your own machine, unlocked with your passphrase, and forgotten when you lock the app. It is never sent to us or to the network — only to your own mail server, the same way your mail program sends it.
The list of people you correspond with. The look-alike-domain check learns which domains are familiar to you, and that list stays on your device.

What is published to the network

The network holds a public record. Anyone can read it. It contains:

Your address and your public keys, signed by you, so anyone can find the key for an address they want to write to.
A proof that you control your mailbox, signed by the gateway that checked it, with an expiry date.
One record per protected message, containing your address, the recipient address, the subject, a fingerprint of the body, a timestamp and your signature.

Read that last one again. The subject line and the recipient's address are in a public record. The body is not — only a fingerprint of it, which cannot be turned back into text. But if the fact that you wrote to a particular person, about a particular subject, at a particular time is itself sensitive, this is not the right tool for that message.

What your mail provider can still see

Everything they see today, minus the body of encrypted messages:

Who you write to and who writes to you.
When, and how often.
Subject lines.
The body of any message that is signed but not encrypted.
Attachments.

They cannot read the body of an encrypted message. Nobody can except the recipient.

What we can see

The gateway that carries mail between the AnuuTech network and ordinary e-mail handles messages in transit, the way any mail server does. It sees what a mail server sees. It does not have your keys, so it cannot read an encrypted body.

There is no account system, no tracking, no analytics on this website, and no telemetry in any of the clients.

How long things are kept

Key records and mailbox proofs stay in the public record. A mailbox proof expires after six months and must be renewed; the record of it remains.
Message records stay too. They are the evidence that a message was genuine, so they have to outlive the message.
A published record cannot be withdrawn. Signed public records are what make verification work; being able to erase one would let a sender deny a message they really sent.

The consequence, stated plainly. Protecting a message publishes the fact that you wrote to that address, about that subject, at that time — permanently. The contents stay private. The existence does not.

If you are in the EU

This matters for the GDPR and it deserves a straight answer rather than a reassuring one: an e-mail address is personal data, and message records contain two of them plus a subject line. Those records are published to a distributed network and cannot be deleted afterwards.

If you are deploying this in an organisation, that is a decision to take deliberately, with your data protection officer, before you roll it out — not afterwards. We would rather tell you that now than have you discover it later.

← All documentation