AnonyMail privacy notice

Version 2026-10-13.1 · effective 13 October 2026

Closed preview. AnonyMail is not open to the public yet. Only people we invite can use it, features and limits can still change, and this text describes the service exactly as it runs today.

What AnonyMail does with your mail and your data, what it keeps and for how long.

Obsah

1. Who is responsible

Operator and controller: Anony Labs
Address: Oude Apeldoornseweg 45-067, 7333 NR Apeldoorn, Netherlands
Chamber of Commerce: KvK (Dutch Chamber of Commerce) number: 42189873
Privacy contact: privacy@anonylabs.com
Questions and help: support@anonylabs.com
Abuse reports and appeals: abuse@anonylabs.com
Security vulnerabilities: security@anonylabs.com
Data protection officer: None appointed. At its current size, AnonyMail's core activity is not large-scale monitoring or large-scale processing of special categories of data (GDPR Art. 37). This is reviewed as it grows.

You sign in to AnonyMail with your AnonyID, the Anony Labs account at account.anonylabs.com. AnonyID is run by the same controller and has its own notice: account.anonylabs.com/privacy.

2. In short

AnonyMail gives you e-mail aliases (addresses ending in @anonymail.cc) that forward to your own mailbox. It forwards mail; it is not a mailbox.
Messages pass through our mail server only while they are being delivered. Message content, subjects and attachments are never stored in our database or in our database backups.
We do keep logs and records, listed in section 4 with how long each is kept. Delivery logs are kept for 7 days with addresses replaced by short hashes. Records are deleted automatically when their period ends; the few without a fixed end are marked there.
No advertising, and no tracking across sites. We count visits to our public pages with our own software, without cookies; no other company is involved (section 19). The website loads nothing from other sites.
The browser extension is optional (section 18). The only thing it ever sends us about the sites you visit is a site's name as the label of an alias, when you click Create with the label left in (you can change or clear it).
There are two plans, Free and Plus. Plus is paid once, in bitcoin over Lightning; for each order we keep an accounting record (section 17). Paid plans are for people aged 18 or older: your AnonyID tells us only whether you are, never your date of birth.

3. Your mail: what we do with it

We do not read your mail. Our systems process message content and headers only:

to deliver it: we rewrite addresses so that your real address stays private and you can reply. Each person who writes to an alias gets a reply address of their own (at r.anonyrelay.com); your reply goes to that address and we send it on from your alias. Unless you switched it off in Settings, we add a short banner at the top of forwarded mail (not on signed or encrypted messages) with links to report spam, block the sender or turn off the alias; its logo is part of the message, not loaded from the web;
to protect your replies: before a reply leaves, we remove read-tracking images that your mail program or a browser extension put into it (they would tell the tracking company and the recipient about you), and we refuse a reply that contains your real address, telling you why;
to protect you and the service: automated spam checks, sender-authentication checks (SPF, DKIM, DMARC) and rate limits against abuse.

No person reads your messages as part of these checks. We do not analyse your mail for advertising, profiling or any other purpose, and we will not do so without asking for your explicit consent first.

AnonyMail is reply-only: you can reply to anyone who wrote to your alias, but you cannot start a new conversation from it.

4. What we keep, why and for how long

To deliver mail and keep the service secure, we keep the data below and nothing more. All periods are maximums; a daily job deletes what has expired and records only how many items it deleted.

What	Why	Legal basis	How long
Your account: the ID your AnonyID gives AnonyMail (an ID only AnonyMail receives), the day the account was made, its status (active, restricted or suspended), trust level, your settings (for example the report banner), and your plan: Free or Plus, when a paid plan ends, and whether it was bought or given by us.	To run your account.	Contract (GDPR Art. 6(1)(b))	Until you delete your AnonyMail account or your AnonyID.
Your forwarding mailboxes: each address, stored encrypted, plus a keyed hash to find it; when it was added and verified; whether it is your default; and its bounce state (since when it fails, how many hard bounces).	To forward your mail and show you your mailboxes.	Contract (GDPR Art. 6(1)(b))	Until you remove the mailbox or delete your account. The bounce state resets on the next successful delivery.
Verification links: only a hash of the link's secret, which mailbox it is for and when it expires; and, to limit how often we send them, a keyed hash of the address with the time of each sending.	To check that a mailbox is yours, and to stop the verification e-mail being misused against others.	Contract (GDPR Art. 6(1)(b))	24 hours.
Your aliases: the address (it has to be readable to receive mail), your label (encrypted), whether it is on, which mailbox it forwards to, the day it was made, the last day it forwarded, and its lifetime counts (forwarded, replied, blocked).	To receive and forward mail for you.	Contract (GDPR Art. 6(1)(b))	Until you delete the alias or your account.
Deleted aliases: a keyed hash of the address and the day it was deleted.	So that a deleted address is never given to someone else, who would then receive mail meant for you.	Legitimate interests: protecting you and your correspondents (Art. 6(1)(f))	Permanently. When you delete your account, the link between these hashes and you is removed.
Your contacts — the people who wrote to an alias: their address and display name (encrypted), keyed hashes of the address and of its domain, the reply address we made for them, how they reached you (From, Reply-To, Cc or a mailing-list header), whether replies to them are allowed and on what basis (their domain's SPF, DKIM or DMARC result), whether you blocked them, the first and last day we saw them and how many messages they sent.	To put the right sender on forwarded mail, route your replies, and block senders.	Contract (GDPR Art. 6(1)(b)) for you; legitimate interests (Art. 6(1)(f)) for your correspondents (section 6)	While the alias exists, but deleted after 12 months without mail in either direction, and at once when you delete the alias.
Block rules: the blocked address or domain (encrypted, plus a keyed hash), whether it applies to one alias or all, and the day you added it.	To refuse mail you do not want.	Contract (GDPR Art. 6(1)(b))	Until you remove the rule or delete your account.
Message-ID map: the message ID we put on your reply, with a keyed hash and an encrypted copy of the original message ID, and the contact it belongs to.	So that replies thread correctly in the other person's mailbox.	Contract (GDPR Art. 6(1)(b))	90 days.
Messages being delivered (the mail queue): the whole message and its envelope, while it is in transit.	To deliver it, and to retry when the receiving server is temporarily unavailable.	Contract (GDPR Art. 6(1)(b))	Until delivered; at most 3 days (1 day for bounces and notices). Never copied into our database or our database backups.
Delivery events: per message, the time (to the minute), the alias and contact by number, the direction, the result, the SMTP status code and a size class. No addresses, subjects or content.	Delivery support and your statistics.	Legitimate interests: delivery support and abuse handling (Art. 6(1)(f))	30 days.
Daily counts per alias: forwarded, blocked, rejected as spam, replies, and read-tracking images removed from your replies (section 3). Counts only.	The statistics you see in the app.	Contract (GDPR Art. 6(1)(b))	45 days.
Reply counters: per account and day, how many replies you sent, to how many different people, and which of your contacts (by number) you replied to that day.	To enforce the reply limits (section 7).	Legitimate interests: a secure service without abuse (Art. 6(1)(f))	30 days.
Incoming-mail counters: per alias, how many messages arrived this hour and this day.	To stop floods of mail to an alias.	Legitimate interests: a secure service without abuse (Art. 6(1)(f))	Until the hour or the day is over, in memory only.
Raw mail-server log: the mail server's normal log lines, which include sender and recipient addresses and the sending server's IP address.	To fix a delivery problem while it happens.	Legitimate interests: delivery support and abuse handling (Art. 6(1)(f))	At most 3 hours, in memory only (never written to disk).
Mail log: for each delivery the time (to the minute), the result and status code, the receiving server's name, the delay, the TLS version, the alias by number, the IP address of the server that sent the mail to us, and the addresses replaced by short hashes. The key for those hashes changes every week and the old key is destroyed, so older hashes can no longer be linked to an address — not even by us.	Delivery support, and finding where spam or abuse came from.	Legitimate interests: delivery support and abuse handling (Art. 6(1)(f))	7 days.
Spam-filter log: per message the score, the names of the rules that matched, the size and the sending server's IP address. No addresses or subjects.	To tune the spam filter and check mistakes.	Legitimate interests: a secure service without abuse (Art. 6(1)(f))	7 days.
System log of the mail services: numbers and result codes only, no addresses.	Running and repairing the service.	Legitimate interests: delivery support and abuse handling (Art. 6(1)(f))	14 days.
Abuse events: the account (and alias) by number, which automatic rule fired, its severity and the time (to the minute). No content, addresses or IP addresses.	Accountability for automatic restrictions, and your trust level (section 7).	Legitimate interests: a secure service without abuse (Art. 6(1)(f))	30 days.
Abuse cases: the case number, the alias and account by number, the kind of report, counts, dates, keyed hashes of the reporting organisations' domains, the decision, and our summary (encrypted, written without addresses or content). The report itself is not kept in this record.	Handling complaints and appeals.	Legitimate interests: a secure service without abuse (Art. 6(1)(f))	12 months after the case is closed. A case without new reports for 90 days is closed automatically.
Audit log: for every automatic or manual decision about an account or alias (and every change our staff make), the time, who did it (automatic, or a staff member as a hash), the action, the object by number and a reason code. No content or addresses.	Accountability: who changed what, and why.	Legitimate interests: a secure service without abuse (Art. 6(1)(f))	12 months.
Spam database (section 5): fingerprints of spam, reputation counts for sending servers, sender domains and link domains, and the spam filter's learned word statistics (stored as hashes).	To recognise spam again.	Legitimate interests: a secure service without abuse (Art. 6(1)(f))	Fingerprints: 30 days after they were last added. Reputation counts: 90 days after the last hit (each new hit starts the 90 days again). Learned word statistics: no fixed end.
Backups of the database: encrypted copies of everything in the database above (addresses in it are already encrypted; no message content or subjects). They are encrypted to a key our servers do not have.	To recover from a failure.	Legitimate interests: availability (Art. 6(1)(f))	7 days on the mail server; 30 days on our second server; in Cloudflare R2: ⟦how long — a deletion rule still has to be set⟧.
Our hosting provider's disk copy: OVHcloud automatically keeps a copy of the mail server's disk, which we cannot switch off. The database and the mail queue in it are on an encrypted volume that cannot be opened without a key kept on another server; the logs and the spam database are in it as they were on the disk.	Required by the provider; not used by us.	Legitimate interests: availability (Art. 6(1)(f))	One copy, replaced daily (at most 24 hours old).
Your sign-in on anonymail.app: a random session ID, your AnonyMail ID, the ID of your AnonyID sign-in session, whether AnonyID says you are 18 or older (yes or no — never your date of birth), the name your AnonyID shows in our apps (your public AnonyChat name or your AnonyID display name) if you allowed AnonyMail to see it, the language your AnonyID keeps for our apps, if you chose one (or the one you pick here while signed in), the ID token AnonyID issued at that sign-in (signed by AnonyID; it repeats what is listed here: the IDs, the sign-in time, the age answer, the name and the language), and when it started and was last used.	To keep you signed in; to show which account is signed in (the name your AnonyID shows in our apps); to show AnonyMail in your language; to sign that browser out of your AnonyID too when you sign out (AnonyMail sends the ID token back to AnonyID); to sign you out when you sign out elsewhere in that browser or use “Sign out everywhere” at your AnonyID; and to offer paid plans only to people aged 18 or older.	Contract (GDPR Art. 6(1)(b))	In memory only: 24 hours after your last visit, 7 days at most, and gone when the app restarts.
Browser extension sessions (section 18): the ID your AnonyID gives AnonyMail, the ID of the AnonyID sign-in session in that browser, the public half of the extension's installation key, hashes of the extension's current keys and of up to 20 earlier renewal keys, when they expire, and when the session started.	To keep the extension signed in, to refuse a copied or reused key, and to end the session when you sign out of your AnonyID.	Contract (GDPR Art. 6(1)(b))	In memory only: 30 days after the extension last renewed it, and gone when the app restarts.
Orders for a paid plan (section 17): the plan, the duration, the price, the amount in sats, the exchange rate, the payment's ID, the dates and the text you agreed to, which includes your country of residence for VAT (its code only).	To sell and apply paid plans, and to keep accounting records.	Contract (GDPR Art. 6(1)(b)); legal obligation to keep accounting records (Art. 6(1)(c))	⟦7 years — to be confirmed by the accountant⟧. The software deletes an order 7 years after it was made. If you delete your AnonyMail account or your AnonyID, your orders stay but are no longer linked to any account.
Invoice details of a business (section 17), only if you ask us for an invoice for your business: the company name, address, country and VAT number, with the order number.	To issue the invoice and keep accounting records.	Legal obligation to issue invoices and keep accounting records (GDPR Art. 6(1)(c)); contract (Art. 6(1)(b))	7 years (tax law), with our accounting records (section 9).
Visits to our public pages (section 19): the page, the domain you came from, your browser and operating system, your country (a two-letter code) and the time — no IP address, no cookie.	To know how many people visit which public pages.	Legitimate interests: knowing how our public pages are used (Art. 6(1)(f))	90 days.

We never store message subjects or content in our database, and we never see your own IP address with your mail: your mailbox provider connects to us, not your device. We do not use any of this data for marketing.

When you delete your AnonyMail account, everything in it is deleted at once: aliases (their addresses are retired as described above), mailboxes, contacts, block rules, the message-ID map and the reply counters. Delivery events keep only a number that no longer leads to anyone, and expire after 30 days. Copies in backups disappear when those backups expire.

5. Spam reports and our spam database

You can report spam in two ways: with the Report spam link in the banner of a forwarded message (it asks you to confirm in the app first), or by forwarding the message to spam@r.anonyrelay.com from the mailbox it was delivered to.

The links in the banner are not stored when we forward a message. Each link carries, signed so it cannot be changed: the alias and the sender by number, the day, the sending server's IP address and a fingerprint of the message text. A link works for 30 days.
A report adds the message's fingerprint and one reputation count for the sending server's IP address, the sender's domain and the domains of links in it to our own spam database on our mail server. A forwarded report also teaches the spam filter which words are typical of spam; it stores these only as hashes. We do not keep the message itself, and no outside spam service receives it.
Incoming mail that our filter scores as very clearly spam (and rejects) also adds its fingerprint and reputation counts.
A report never blocks a sender for you; blocking stays your choice. Up to 20 reports per account per day count.

How long each part is kept is in section 4 ("Spam database").

6. If you write to an AnonyMail address

If you are not an AnonyMail user but send mail to an AnonyMail alias, we process your message to deliver it to the alias owner's mailbox, and we keep: your address and display name (encrypted), keyed hashes of your address and domain, the reply address we made for you, the first and last day you wrote, how many messages you sent, and whether your domain passed the SPF, DKIM or DMARC checks. This lets the alias owner reply to you without revealing their own address. We keep it for as long as the alias exists, and delete it after 12 months without mail in either direction. The legal basis is our and the alias owner's legitimate interest in delivering and answering your mail (GDPR Art. 6(1)(f)). Your rights (section 14) apply to you too; write to the privacy contact.

7. Limits, restrictions and abuse reports

Trust levels. What an account may do each day depends on its trust level, which is worked out from three facts only: whether it has a verified mailbox, how old it is, and whether an abuse rule fired in the last 30 days. We do not build behaviour profiles.
Automatic restrictions. If too many of your replies are refused as spam or under the reply-only rules, bounce, or draw complaints, replies and new aliases are paused for 24 hours (forwarding continues). A third restriction within 30 days suspends the account until a person reviews it. An alias reported by several different organisations can be suspended. These decisions use counters only, never the content of your mail. The app shows the reason and the end time; you can ask for a person to review any decision (abuse@anonylabs.com).
Abuse reports. Mail to abuse@, postmaster@ and security@ at our domains goes to our operations mailbox (section 9). Our mail server also looks in such a report for our own addresses and message IDs, to link it to a case; the case record is listed in section 4.

The limits themselves are in the terms, section 7.

8. Signing in with your AnonyID

When you sign in, account.anonylabs.com gives AnonyMail an ID that only AnonyMail receives (a “pairwise” ID: other Anony Labs apps get a different one), an ID of your sign-in session, and one yes/no answer: whether you are 18 or older. AnonyID works this out from your date of birth each time you sign in and, while that answer is no, at most once a day when you open the Plan page (a sign-in without a page). It never gives us your login username, e-mail address, date of birth, password or second factors. AnonyMail keeps the 18-or-older answer and the ID token of that sign-in with that browser's sign-in session only, in memory (section 4). If you allowed AnonyMail to see your name (a one-time page the first time AnonyMail asks), AnonyID also gives AnonyMail the name your AnonyID shows in our apps: your public AnonyChat name if you have one, otherwise your AnonyID display name. AnonyMail shows it in Settings → Account while you are signed in and keeps it the same way, in memory only, never stored.
Your language: if your AnonyID keeps a language for our apps (the one you chose at AnonyID or in one of our apps), AnonyID gives it to AnonyMail when you sign in, so that AnonyMail is shown in it; AnonyMail keeps it with that browser's sign-in session only, in memory (section 4). AnonyMail also tells AnonyID which language it is showing when it sends you to sign in, so that the sign-in pages use it too. When you pick a language in AnonyMail while signed in, your browser goes to account.anonylabs.com, which stores it for your AnonyID (AnonyID's privacy notice), and back; AnonyMail also keeps your pick in the cookie __Host-anonymail-lang (section 15).
Sign out ends your AnonyMail session in that browser and then sends the browser to account.anonylabs.com with that sign-in's ID token, which signs this browser out of your AnonyID and every Anony site in it (the AnonyMail browser extension in this browser too, as it signed in through this browser's AnonyID); other browsers and devices stay signed in. “Sign out everywhere” in your AnonyID settings signs out every browser and device, including your AnonyMail sessions and the browser extension.
You can delete your AnonyMail account in Settings → Your data. When you delete your AnonyID, the account site first asks AnonyMail whether it holds anything for you and then tells it to delete your AnonyMail account; your AnonyID is only deleted once AnonyMail has done so.

9. Who else is involved, and where

Who	What	Where
OVHcloud (OVH SAS, France)	Rents us the mail server: the mail queue, the database, the logs and the spam database in section 4, and the provider's disk copy.	Germany (EU)
InstantNode (Ben Oliver Mallow, trading as InstantNode, Sickinger Straße 7, 55758 Sien, Germany), on the network of GHOSTnet GmbH	Rents us the server that runs anonymail.app and AnonyID, which also holds the key server that unlocks the mail server's encrypted volume, our second server, which keeps the encrypted backups, and the payment server (section 17); and the server that runs AnonyChat, where the visits to our public pages are counted (section 19).	The Netherlands (EU)
Cloudflare (R2)	Stores encrypted backups; it cannot read them.	A bucket in Cloudflare's EU jurisdiction
Apple (iCloud Mail)	Hosts our operations mailbox, which receives the mail sent to abuse@, postmaster@ and security@ at our domains. Kept there: ⟦retention of the operations mailbox — to be set⟧.	⟦to be confirmed⟧
ACINQ (ACINQ SAS, France)	Our payment server's Lightning channel partner: sees the amount and time of payments to us (section 17), not who you are.	⟦where its Lightning node runs — to be confirmed⟧
Taxmo (Taxmo B.V., Amsterdam, the Netherlands)	Our accounting software (section 17): one invoice record per paid order with the order number, the date, the plan and duration, the price with its VAT, the sats and the exchange rate, under a generic customer per app and country (for example “AnonyMail customer (consumer) – DE”) — no account, name or e-mail address; and the invoices for businesses we make on request. Kept 7 years (tax law).	Amazon Web Services in Frankfurt (Germany, EU), with a standby copy in Ireland (EU); its database at Neon in Frankfurt
Kraken, Bitstamp	The public bitcoin price, for the price in sats; no personal data is sent.	—
Public DNS blocklists (PSBL, s5h, SpamCop, UCEPROTECT, Hostkarma, DNSWL, MSBL)	Our spam filter looks up the sending server's IP address, domain names in the message and hashes of e-mail addresses in it, as DNS queries. No message content is sent.	Each list's own policy applies

Your own mailbox provider (where we forward to) and the providers of the people who write to you are not working for us: they receive and keep messages under their own terms. No other company receives AnonyMail data. Our servers are in the EU.

10. How we protect the data

The database and the mail queue are on an encrypted volume. It is unlocked over a private network link by a key server on another server, at another provider, so a copy of the mail server's disk cannot be opened on its own.
Addresses in the database are encrypted, and look-ups use keyed hashes. Backups are encrypted to a key that is kept offline, not on our servers.
We use TLS for mail connections wherever the other server supports it, and the website only over HTTPS.
The AnonyMail app never sees your IP address: our web server removes it before a request reaches the app, and keeps no access log.

11. What we cannot protect

E-mail was not designed for privacy. Please be aware that:

Content is not end-to-end encrypted by us. Our mail server has to process each message to forward it. If a sender's server does not support TLS, that message reaches us unencrypted.
Your own mailbox provider and the sender's provider see and keep your messages under their own terms.
Your real address can still leak if you reply from an address other than the mailbox linked to the alias, or put it in a signature or quoted text. We refuse replies that would reveal your address when we detect them, but we cannot catch every case.
An alias hides your address. It does not make you anonymous to us or to the authorities (section 13).

12. If something goes wrong

If a security breach affects personal data, we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) without delay. If it is likely to harm you, we also tell you without delay, unless the data involved were encrypted in a way that makes them unintelligible. We keep a record of every breach, including those we do not have to report.

As a provider of an electronic communications service, AnonyMail falls under the Dutch Cybersecurity Act (Cyberbeveiligingswet, which implements the EU NIS2 Directive) once it is offered to the public. Before that, we will register with the National Cyber Security Centre (NCSC). From then on we report significant security incidents through the NCSC within that law's deadlines: an early warning within 24 hours, a notification within 72 hours and a final report within one month. Where it helps, we also tell users about incidents that affect the service.

Found a security problem? Write to security@anonylabs.com.

13. Requests from authorities

We disclose user data only when the law requires it: for example a valid demand from a Dutch public prosecutor or police officer under the Dutch Code of Criminal Procedure (Wetboek van Strafvordering), or a European Production or Preservation Order under Regulation (EU) 2023/1543 (“e-Evidence”). We check each request for validity, and we refuse or challenge requests that do not meet the legal requirements.

We can only hand over what we actually hold, as listed in section 4. We do not hold the content of your messages, so we cannot provide it. If an order asks us to preserve data, we keep the data that exists at that moment for as long as the order requires; the normal deletion periods are suspended for that data only. Neither Dutch nor EU law currently requires us to keep data for longer than our own periods.

We tell you about a request unless the law or the order forbids it. We plan to publish the number of requests we receive each year.

Interception. Whether chapter 13 of the Dutch Telecommunications Act (Telecommunicatiewet) applies to AnonyMail is still an open legal question. That chapter requires some providers to be able to intercept communications on a court-authorised order and to supply subscriber data to the Central Information Point for Telecommunications Investigations (CIOT). We will ask the Dutch regulator, the Rijksinspectie Digitale Infrastructuur (RDI), for a written answer once our company registration is complete, and AnonyMail stays a closed preview until we have it. AnonyMail has no facility to intercept mail today. Like any communication service, we may be asked to cooperate with an interception order under Article 126m of the Code of Criminal Procedure, and we would handle it under the rules above. If the answer is that chapter 13 applies, we will update this notice before AnonyMail opens to the public.

Authorities, including those of other EU member states and the European Commission, can reach us at abuse@anonylabs.com, in English or Dutch.

14. Your rights

Under the GDPR you can:

See your data and take it with you: Settings → Your data → Export gives you everything your AnonyMail account holds as one JSON file: aliases, contacts and their reply addresses, mailboxes, block rules, deleted aliases and the daily counts. For anything else we keep about you, write to privacy@anonylabs.com.
Correct it: Change an alias's label or mailbox, and add or remove mailboxes, in the app. For anything else, write to the privacy contact.
Delete it: Delete an alias (its contacts go with it at once), a mailbox or a block rule in the app, or delete your whole AnonyMail account in Settings → Your data. Deleting your AnonyID deletes your AnonyMail account too.
Restrict or object: Write to the privacy contact. You can object to processing based on legitimate interests, and ask a person to review any automatic restriction (section 7).
Complain: To the Autoriteit Persoonsgegevens (the Dutch Data Protection Authority), autoriteitpersoonsgegevens.nl, or the supervisory authority in your own EU country.

We do not know your name, so for a request made outside the app we may ask you to show that the account is yours, for example by writing from a mailbox verified on it.

15. Cookies

anonymail.app sets only cookies that are strictly necessary for signing in and out, and stores nothing else in your browser:

__Host-anonymail: your sign-in session (a random value), up to 7 days;
__Host-anonymail-auth: the state of a sign-in in progress, 10 minutes;
__Host-anonymail-signed-out: only the value “1”, set when you leave AnonyMail while your AnonyID stays signed in (“Use another AnonyID”, deleting your AnonyMail account, or a sign-in from before 11 October 2026), so that the next sign-in asks which AnonyID to use; up to 30 days;
__Host-anonymail-agecheck: only the value “1”, set when the Plan page asks AnonyID again whether you are 18 or older (section 8), so that it asks at most once a day; 24 hours;
__Host-anonymail-lang: only the code of the language you picked in a language menu on anonymail.app (for example “de”), so that the pages are shown in it; set only when you pick one; 1 year. Without it the pages follow your sign-in's language, else your browser's language.

The landing page at anonymail.app sets no cookies itself; picking a language in its language menu sets __Host-anonymail-lang (above).

The browser extension sets no cookies and does not send anonymail.app's cookies with its requests. What it keeps in your browser is listed in section 18.

16. Age

AnonyMail is for people aged 16 or older. 16 is the age from which you can agree to an online service yourself, without a parent's consent (GDPR Art. 8 and Art. 5 of the Dutch GDPR Implementation Act, UAVG). AnonyMail does not support parental consent, so if you are under 16 you may not use it. AnonyID, which every AnonyMail user signs in with, has the same minimum age. AnonyMail itself never receives your date of birth.

Paid plans are for people aged 18 or older. To check this, AnonyMail receives only an “18 or older: yes/no” answer from AnonyID when you sign in and, while you are under 18 by that answer, at most once a day when you open the Plan page (section 8). It never receives your date of birth, and keeps the answer with your sign-in session.

17. Plans and payments

AnonyMail has a Free plan and a paid plan, Plus. Their limits are on the Plan page. Plus is bought with bitcoin over the Lightning network, on anonymail.app only. No card, bank account, name or address is involved, and we never ask for one. We may also give an account Plus ourselves (for example to sort out a payment).
For each order we keep: your account, the plan and its name, the duration, the price in euros, the amount in sats, the exchange rate used and where it came from, the payment's ID (the payment hash), when the invoice expires, the order's state, when it was made, paid and last checked, the amount received, the period it gave you, and the exact text you agreed to with its version and the version of the terms. The invoice itself is kept only while it can be paid. Orders are stored in the AnonyMail database on our mail server (section 9).
We do not keep your IP address, your device or browser, or anything about your wallet. Lightning payments are passed on by other nodes; our payment server learns that the invoice was paid and the amount, not who paid.
Our payment server runs phoenixd, Lightning wallet software by ACINQ, and is shared with AnonyChat and AnonyVPN (same operator); each payment is labelled with the service it belongs to. Its payment channels are with ACINQ's Lightning node, which therefore sees the amount and time of each payment reaching us — not who you are or what it is for.
The invoice's description, which your wallet shows and may keep, says “AnonyMail”, the plan, the duration and our order number — nothing about you.
To set the price in sats, our server asks two public exchange-rate services, Kraken and Bitstamp, for the bitcoin price, at most once a minute. Nothing about you is sent to them.
Orders are accounting records: kept ⟦7 years — to be confirmed by the accountant⟧, and kept, unlinked from any account, if you delete your AnonyMail account or your AnonyID. Your orders are listed on the Plan page.
Before you order, you choose your country of residence (for VAT): the price includes VAT, and the country decides which country's VAT. Only the country's two-letter code is kept with the order, as part of the text you agree to — no address and no IP address — for 7 years, because tax law requires it.
Each paid order gets a receipt (a PDF on the order's page). Our billing service on the same server as anonymail.app makes it and books the order in our accounting software, Taxmo (section 9): the order number, the date, the plan and duration, the price with its VAT, the amount in sats and the exchange rate, under a generic customer per app and country (for example “AnonyMail customer (consumer) – DE”). No account, name, e-mail address or anything else about you is sent. It is kept 7 years (tax law). Moneybird, which we had set up before, never received any order and receives nothing.
Invoices for a business are not requested on the order's page. If you ask us for one, we use the company name, address, country and VAT number you give to issue it, and keep them with our accounting records for 7 years (tax law).

18. The AnonyMail browser extension

The AnonyMail extension for Chrome and Firefox lets you create an alias for the site you are on, see the aliases you already made for it, and put one into that site's e-mail field or copy it. On Chrome it opens in the browser's side panel, on Firefox as a popup from the toolbar. It is optional, it is part of AnonyMail, and this notice covers it. You get it from the Chrome Web Store or from Mozilla's add-ons site, which handle that download and its updates under their own privacy terms; they do not work for us.

What it may do in your browser (its permissions), and why:

identity: to open the AnonyID sign-in window (account.anonylabs.com) and receive the one-time sign-in code at its end;
storage: to keep its session and your settings in your browser (listed below);
activeTab: only after you click its toolbar button, and only for that tab: to read the tab's address, of which it uses only the site's name (for the label), and to fill that page's e-mail field when you click Fill;
scripting: to put the address into the page's e-mail field when you click Fill, and to switch the in-field icon (below) on and off. On Chrome, while the side panel is open, it also asks Chrome for the page's internal ID (it reads nothing of the page), so the panel can close when that page reloads or you leave it;
sidePanel (Chrome only): to open in the side panel, for the tab you opened it on;
access to the websites you visit: optional, not asked for at installation. Your browser asks you only when you turn on the in-field icon, and the permission is removed when you turn it off.

Signing in. You sign in with your AnonyID in the AnonyID window; the extension never sees your password or second factors. It sends the one-time sign-in code to AnonyMail, which checks it with AnonyID and gives the extension a session of its own: a key that works for 15 minutes and a renewal key, replaced at every renewal, that works for 30 days. The extension makes a key for this installation, whose private half your browser will not let anyone copy out; it signs every renewal with it, so a copied renewal key alone is useless. What we keep for the session is in section 4 (“Browser extension sessions”): in memory only, never on disk.

When the session ends. 30 days after the extension last renewed it; when you sign out of your AnonyID in that browser or use “Sign out everywhere” (section 8); when you delete your AnonyMail account or your AnonyID; when your AnonyID no longer has access to AnonyMail; when an old renewal key is used again; when you sign in to the extension an eleventh time with the same AnonyID (the oldest of your 10 sessions ends) or the number of extension sessions reaches our limit (the oldest end first); and when our app restarts. Afterwards the extension signs you in again by itself only if your AnonyID is still signed in in that browser; otherwise it asks you to sign in. Sign out in the extension deletes its keys from your browser at once, so the session can no longer be used, and ends it on our side straight away if its 15-minute key is still valid; if not, our side forgets the session 30 days after its last renewal, or sooner for one of the reasons above.

What it sends to AnonyMail, and when:

When you open it: its session key, to load your plan, how many aliases you have, your newest aliases (up to 100: the address, its label, whether it is on, and its dates) and your verified forwarding mailboxes. Nothing about the page you are on.
When you click Create: whether you want random words or your own prefix (and the prefix), the label, and, if you have more than one verified mailbox, the one it should forward to. The label is pre-filled with the name of the site you are on (for example “shop.example”: only the site's name, never the page's address or anything on the page); you can change or clear it before you click Create. It is kept like every alias label (section 4).
When you pause or resume an alias: that change.

Nothing else about the sites you visit is sent. “Your aliases for this site” is worked out in your browser: the extension compares the site's name with the labels of the aliases it has loaded. With each request your browser also sends the extension's own address (on Firefox a random ID per installation); we use it only to check that the request comes from the extension, and do not keep it. As on the website, the app never sees your IP address (section 10).

What our logs record. One line per event: a session was started, renewed, ended or refused (with a short technical reason), an alias was created (random words or your own prefix) or switched on or off, and our mail server could not be reached. No key, sign-in code, ID, address, label or extension address is written to these lines. They go to the server's system log, which has no fixed time limit yet: its oldest entries are deleted once it reaches its size limit. To limit misuse we also count requests per extension session, and new aliases per AnonyID (under a keyed hash), in memory only; each count covers one or ten minutes, and all are gone when the app restarts.

What it keeps in your browser:

until you close the browser (its session storage): the 15-minute key; on Chrome, while the side panel is open, which tab it belongs to and that page's internal ID;
until you sign out or remove the extension: the renewal key, the installation key (in the extension's own database) and your last “Forwards to” choice;
until you remove the extension: whether it has offered you the in-field icon, the sites where you chose “Don't show on this site” (at most 500 site names), whether your browser was last in light or dark mode (for the toolbar icon), and, after you sign out, a note to ask which AnonyID to use at the next sign-in.

Filling a field. When you click Fill (or Create and fill), the extension puts the address into the e-mail field you were last in on that page, or else the page's first visible e-mail field; on Firefox, if it finds neither, into the text field you are in. If it cannot fill one, it copies the address to your clipboard, as Copy does. To recognise an e-mail field it looks at each field's type, name, ID and autocomplete hint, the words that label it (its label, placeholder and aria-label) and its size on the screen — never at what is in it or at anything else on the page. It fills only when you click.

The in-field icon (optional). Off until you turn it on; your browser then asks you to let AnonyMail run on the websites you visit. With it on, a small script runs in the pages you open (in the page itself, not in frames inside it, and never on anonymail.app or anonylabs.com) and shows the AnonyMail icon in their e-mail fields. For that it looks at the page's input fields as described above and at the boxes around them (to place the icon), at the site's name (for the label), and at the page's colours (to show the icon and the panel light or dark like the site), and it remembers, inside that page only, the last e-mail field you clicked into. It does not read what you type or anything else on the page, and it sends nothing over the internet: it passes the site's name only to the extension's own panel. The panel that opens from the icon is part of the extension, so the website cannot read it; it loads and sends what the toolbar window does (above). “Don't show on this site” hides the icon on that site (the script still runs there, showing nothing, so that Fill keeps working); turning the icon off removes the permission and the script.

No tracking. The extension has no analytics, telemetry, advertising or error reporting, and loads no code from the internet. It connects only to anonymail.app; it opens account.anonylabs.com for the sign-in, and anonymail.app in a tab when you click “Open AnonyMail”. Firefox lists what it handles as “authentication information” and “browsing activity” (a site's name in the label).

Legal basis: Contract (GDPR Art. 6(1)(b)) — the extension is a way to use your AnonyMail account.

Removing it. Sign out in the extension first, then remove it on your browser's extensions page (Chrome: chrome://extensions, Firefox: about:addons). The browser then deletes everything the extension kept. If you remove it without signing out, the session on our side ends as described above. Your aliases stay in your AnonyMail account until you delete them there. Questions about the extension: support@anonylabs.com.

19. Counting visits to the public pages

We count visits to the public pages of anonymail.app — the landing page (in each of its languages), the legal centre, this privacy notice and the terms — with counting software (Umami) that we run ourselves, on the same server as AnonyChat. It is not a third-party service: the script comes from anonymail.app itself, your browser contacts no other domain for it, and nothing about your visit is sent to any other company. Pages you see when signed in are never counted, and neither are the sign-in pages, the mailbox verification and report links, the 404 page or any page whose address contains an identifier. The browser extension counts nothing (section 18).

For a visit it records: the address of the page (fixed by us; nothing after a “?” or “#” in your address bar is included, except the three campaign labels utm_source, utm_medium and utm_campaign of a link you followed); the website you came from, as its domain only (for example https://example.com), never the page or the search; your browser and operating system, as your browser announces them to every website; and the country you are visiting from, as a two-letter code. Your screen size and your language are not recorded.

Your IP address is used once, on our own server, to look up your country in a list of address ranges we keep there, and is then dropped: it is not passed to the counting software and not stored with the visit. To tell one visit from the next without a cookie, the counting software combines your browser version and your country under a key that changes every day, so the number of visitors is an estimate and nothing links one day to the next.

No cookie is set and nothing is written to your browser's storage; there is no fingerprinting. If your browser sends Do Not Track or Global Privacy Control, nothing is counted. Visits are deleted after 90 days.

Legal basis: Article 6(1)(f) GDPR, our legitimate interest in knowing how many people visit which pages.

Changes to this page

Every version of this page has a version number and an effective date. When we change it, the new version and a line about what changed are added here.

Version 2026-10-13.1: Visits to our public pages are now counted (new section 19; sections 2 and 9): the landing page, the legal centre, this notice and the terms, with counting software we run ourselves on the server that runs AnonyChat — no cookie, nothing stored in your browser, no other company. It records the page, the domain you came from, your browser and operating system and your country; your IP address is used only to look up the country and is not stored; visits are deleted after 90 days. Signed-in pages are never counted. Section 2 no longer says “no analytics”.
Version 2026-10-12.4: AnonyMail is now available in 24 languages (sections 4, 8 and 15). When you sign in, AnonyID gives AnonyMail the language it keeps for your AnonyID, if you chose one, and AnonyMail keeps it with your sign-in session only, in memory; AnonyMail tells AnonyID which language it is showing when you sign in. A language you pick in AnonyMail is kept in a new cookie, __Host-anonymail-lang (only the language code, 1 year) and, while you are signed in, stored for your AnonyID by AnonyID. The landing page sets that cookie only when you pick a language there. The legal documents stay in English.
Version 2026-10-12.3: Bookkeeping (sections 9 and 17, the retention table): paid orders are now booked in Taxmo (Taxmo B.V., Amsterdam; its servers at Amazon Web Services in Frankfurt, a standby copy in Ireland, its database at Neon in Frankfurt — all in the EU), which replaces Moneybird. Per paid order Taxmo receives the order number, the date, the plan and duration, the price with its VAT, the amount in sats and the exchange rate, under a generic customer per app and country (such as “AnonyMail customer (consumer) – DE”) — no account, name or e-mail address; it is kept 7 years (tax law). Moneybird, which we had set up before, never received any order and receives nothing. Invoices for a business are no longer requested on the order's page.
Version 2026-10-12.2: Section 1 now gives Anony Labs' KvK (Dutch Chamber of Commerce) number, 42189873, now that the registration is complete. Nothing else changed.
Version 2026-10-12.1: The name AnonyID gives AnonyMail (sections 4 and 8) may now be your public AnonyChat name, if you have one, or else your AnonyID display name: it is the name your AnonyID shows in our apps. Nothing else changes about it (you allow it once, it is kept with your sign-in session only, in memory, never stored). The menu no longer shows it: its account entry now says “Profile”; the name is shown in Settings → Account.
Version 2026-10-11.4: Your AnonyID display name (section 2): if you set one in your AnonyID and allow AnonyMail to see it (a one-time page the first time AnonyMail asks), AnonyID sends it with each sign-in, and AnonyMail shows it while you are signed in (at the bottom of the menu and in Settings), with your sign-in session only, in memory, never stored. AnonyMail still never receives your login username.
Version 2026-10-11.3: The AnonyMail browser extension for Chrome and Firefox (new section 18): what it does, its permissions and why, what it reads on pages, what it sends us and when (the site's name only as an alias label, and only when you click Create), what it keeps in your browser, what we keep for its sessions (in memory only, 30 days after their last use: a new row in the retention table), what our logs record about it, and how to remove it. Sections 2 and 15 point to it. Section 1 names a support address, support@anonylabs.com.
Version 2026-10-11.2: Receipts, VAT and invoices for businesses (section 17, the retention table, section 9): at checkout you choose your country of residence for VAT, and only its code is kept with the order, for 7 years under tax law; every order gets a receipt; a business can ask for an invoice in its name, and its company name, address, country and VAT number are kept by our billing service for 7 years; our accounting software Moneybird receives each order without anything about you (one anonymous customer per country), and a business's invoice details.
Version 2026-10-11.1: Sign out now signs this browser out of AnonyMail and of your AnonyID (and so of every Anony site in it); “Sign out everywhere” in your AnonyID settings signs out every browser and device. For this, your sign-in on anonymail.app now also keeps, in memory only, the ID token AnonyID issued at that sign-in, which AnonyMail sends back to AnonyID when you sign out (sections 4 and 8). The signed-out cookie is now set only when signing out cannot also sign you out of your AnonyID (section 15).
Version 2026-10-10.3: Plans and payments: a Free plan and a paid plan, Plus, bought with bitcoin over Lightning (new section 17: what an order keeps, for how long, who is involved); paid plans are for people aged 18 or older, checked with only an 18-or-older yes/no from AnonyID (sections 8 and 16); your plan and its end date, the 18-or-older answer with your sign-in, and orders in the retention table; ACINQ, Kraken and Bitstamp in section 9; the age re-check cookie in section 15.
Version 2026-10-10.2: Minimum age 16 instead of 18 (the age for agreeing to an online service without a parent's consent, GDPR Art. 8 / UAVG Art. 5); under 16 may not use AnonyMail. New contact addresses: privacy@anonylabs.com, abuse@anonylabs.com (also for authorities) and security@anonylabs.com.
Version 2026-10-10.1: First version, for the closed preview: AnonyMail's own notice (before this, no AnonyMail notice existed).