Privacy Policy

Who this covers

This policy covers Neir's website, webmail, SMTP, IMAP and POP3 services, operated from Sweden. Privacy requests: hello@neir.io.

No identity, no KYC

Creating or using a mailbox never requires your legal name, address, phone number, date of birth, government ID, selfie or a recovery email. There's no identity or advertising profile. You must be at least 16, or the digital-consent age where you live (never below 13). We have no technical way to verify this, so creating an account is your representation that you meet it.

Signing in

Your browser generates an Account Key, a 12-word recovery phrase and an OpenPGP key pair. We store only one-way verifiers (Argon2id plus a keyed lookup hash) for the Account Key and recovery phrase, never the originals. If you lose both, we cannot recover the account. Account creation also requires a short automatic proof-of-work check in your browser to limit bulk signups; it uses no CAPTCHA or device fingerprinting, doesn't identify you, and only a short-lived hash plus anonymous totals are kept, not tied to Tor, VPN or clearnet status.

Signing in sends your Account Key to our server over TLS so its verifier can be checked, and we discard it afterwards. The same Account Key also protects your OpenPGP private key, so this design relies on our servers not retaining it. Do not treat the webmail copy as protection against a malicious or compromised operator.

What we store

• Your address(es): one primary plus any aliases your plan includes.
• Metadata needed to route and show mail: sender, recipients, subject, timestamps, message IDs, folder/flag state.
• A webmail body copy encrypted to your own OpenPGP key. Subjects and addresses are not part of that encryption.
• A standard Maildir copy for SMTP, IMAP, POP3 and spam filtering, which means ordinary mail is not end-to-end or zero-access unless the sender encrypts it themselves first.
• Attachments, stored separately. The webmail copy is encrypted to your own OpenPGP key like the body; files that arrived before this was introduced are converted in a one-time migration. The standard Maildir copy of the message, which includes its attachments, is not encrypted.
• Anything optional you turn on: saved contacts, filters, app passwords (shown once, then kept only as a hash), an encrypted 2FA secret, session device/timestamp (never IP or location), push subscriptions, sender open-tracking, and support tickets (kept as plain text so staff can read them, deletable anytime).

Backups

Backups are encrypted before they ever leave our servers. Local copies (database, mail, config) rotate every 3–8 days depending on type; an offsite encrypted copy is also kept on Cloudflare R2 for 30 days as disaster recovery. Deleted data can persist in these encrypted backups until they age out.

Logs and abuse prevention

Web, mail and security logs can hold IP addresses, request paths and timestamps for a bounded period (system logs: 14 days max). They are used only for rate-limiting and abuse defense, never added to an account profile or used for advertising. Shared Tor and VPN exits are not scored, blocked or penalized as a category.

Payments

Free accounts need no payment data. Pro purchases, made in cryptocurrency through Heleket, store the amount, asset, network, deposit address, provider ID, status and transaction hash. No KYC is added to this.

Analytics and other services

No ad trackers, no third-party analytics. We keep anonymous per-page daily counters with no visitor ID, IP or cookie attached. We also tally which website or app sent a visitor to Neir (the referring site name only, or a campaign tag in the link such as utm_source), once per browser session and counted per day, so we know whether people find us through search, AI assistants or other sites. That tally holds no path, IP, cookie or visitor ID. Remote images in mail are proxied through Neir, so the sender never sees your IP. Optional Pro payments involve Heleket and the public blockchain; optional push notifications involve your browser vendor; operational alerts (admin actions, security events such as failed sign-ins, rate-limited or blocked requests and suspicious request patterns, and the sender/subject of new support tickets) go to our own Telegram bot for on-call monitoring; your mail and your IP are never included. Lawful-request totals are published via our warrant canary.

Retention, deletion and your rights

We process this data to provide the service, keep it secure and reliable, and where Swedish or EU law requires it, but never to sell it or target ads. Trash and Spam empty after 30 days. Deleting your account is immediate and irreversible: the live account is removed right away and its Maildir is erased after a 3-day quarantine (protection against a botched deletion), though it can persist longer in the encrypted backups above. From Settings you can export, correct, revoke sessions/app passwords, disable optional tracking, and permanently delete your account; you can also request access, correction, erasure, restriction or portability by contacting us, or complain to Sweden's IMY (Authority for Privacy Protection). We disclose data only when legally required and only what we actually hold. That excludes your Account Key or recovery phrase, but not your mail, metadata or the logs above.

Changes

Material changes appear here with a new date. The no-KYC commitment is also part of the Terms of Service.