Questions

Trust

Can you read my email?

Depends which mode, and the honest answer is different for each. Anyone who gives you one sentence for this question is selling you something.

Forwarding aliases: yes, in principle, while the message is passing through. Mail arrives on our server, we rewrite headers, we send it on. It is not stored, but it exists in memory here for that moment and it is not encrypted to anyone, because forwarding mail you cannot read is not a thing that exists.

Inbox-only aliases: yes. Stored messages are encrypted at rest, but we hold the key, so we can decrypt them and so could anyone who compelled us to.

Inbox-only with the private inbox on: no. Messages are sealed to a key that never leaves your browser. We hold ciphertext we cannot open.

If "can you read my mail" is your actual question, the answer is to use inbox-only aliases with the private inbox on. Everything else is a tradeoff you should make knowingly.

What do you store?

Every table, listed, on the privacy page. It claims to be exhaustive and the build enforces that: adding a table without declaring it fails the test suite.

Short version: metadata about deliveries for a few days, your encrypted forwarding address, encrypted contact addresses, encrypted notes. No subjects, no bodies, unless you are using inbox mode, in which case those too. Details in what we store.

What happens if you get a court order?

We comply with valid legal process, like everyone. The interesting question is what that yields, and for us it is unusually little: no name, no email address unless you volunteered one, no payment identity if you paid in cash or crypto, no IP addresses, and no message content for a forwarding alias.

What we could be made to hand over is the encrypted contents of an inbox-only alias, plus the key, unless the private inbox is on.

What we could in principle be ordered to do, and this is the one people do not ask about, is start capturing something going forward. A German court did exactly that to Tuta in 2020, and the order survived appeal. Encryption at rest is no defence against it. Our warrant canary exists for this, and our architecture limits it only in the modes described above.

What happens if you shut down?

The question everyone should ask an alias service and almost nobody answers.

Aliases on our shared domains die with us. k7fq2m@alias.mom depends on us existing to route it. If we are gone, so is it, and so is every account you used it to register.

Aliases on your own domain do not. Repoint your MX record at another provider, or at your own server, and every address you handed out keeps working. You never have to tell anyone anything.

That is the real argument for using your own domain, and it is a bigger one than any feature. It is also why we are open source: if we disappear, the code to run this yourself does not.

We would give notice and time to migrate. But you should not have to take our word for that, and with your own domain you do not.

Who runs this?

See the transparency page for where we operate from and what that means. We are not going to pretend to be bigger than we are.

Your account

I lost my account number. What now?

If you set a recovery email, use it. If you did not, we cannot help you, and that is not a policy we can make an exception to: we store a one-way hash of your number, so it does not exist anywhere in our systems in a form anyone can read.

Your aliases keep forwarding. You just cannot log in to change them.

This is the cost of the account model. See your account number.

Why is there no email address at signup?

Because an account with an email address is an account we can identify, and a password reset flow is a permanent link between you and an address. The numbered account removes both. You are anonymous to us structurally rather than because we promise not to look.

Is a 16-digit number really as good as a password?

Better, for this purpose. It is generated with proper randomness rather than chosen by a human, so it has no pattern to guess, and it is never reused anywhere else, which is where most password compromises actually come from.

Add two-factor authentication and it is stronger than a password plus 2FA, because there is no reset flow to attack.

Mail

Will my mail land in spam?

It should not, and if it does we want to know.

Forwarded mail is signed with DKIM and aligned so your mailbox provider will accept it. Our sending domains are monitored and rotated if one gets listed somewhere.

Being honest about where we are: we are a young service, and reputation with the large mailbox providers is built over months. If something of yours lands in spam, tell us, because that is data we cannot get any other way.

Why did my message bounce?

The bounce text is a real sentence rather than a code, and it usually says exactly what to fix. The three common ones:

• Not authorised to send from this alias: the address you sent from is not a verified mailbox for it. Add it in settings.
• This alias has no mailbox: it is inbox-only, so it cannot send. Use the web inbox.
• Alias disabled: turn it back on.

Can I use my own domain?

Yes, and you should. How to set it up.

If a record disappears later we notice and tell you, rather than letting mail quietly stop.

Do you have an IMAP server?

No. Forwarding aliases deliver into your existing mailbox, so your client already has the mail. Inbox-only aliases are read here.

Money

Why flat pricing?

Because tiered pricing on an alias service is a tax on using it properly. The whole benefit comes from making an alias every single time, and a plan that counts them trains you not to.

Can I pay anonymously?

Cash by post and Monero are anonymous. Bitcoin is pseudonymous, which is not the same thing, and it is worth knowing the difference: a Bitcoin payment is on a public ledger forever and can be correlated with an exchange account that knows your name.

Card payments are not anonymous and we do not pretend otherwise. They go through a processor who knows who you are. Plenty of people use a card because convenience is what they actually want; that is a fine choice as long as it is an informed one.

We never link a payment to your aliases. What the processor knows is between you and them.

What happens to my aliases if I stop paying?

They keep forwarding. We do not hold your mail hostage.

What you lose is the ability to create new aliases beyond the free limit, and the paid add-ons stop. Nothing you have handed out breaks.

Comparisons

How is this different from you+shop@gmail.com?

Your real address is inside the plus form, and you cannot switch one off. The long version.

Why not Apple Hide My Email, Firefox Relay or DuckDuckGo?

All three are decent and for some people they are the right answer. The short version is that none of them let you take your addresses with you, which is the thing that matters most in five years. Hide My Email, Firefox Relay, DuckDuckGo.

Are you a disposable email service?

No, and we work actively at not being treated as one. The difference.