1
DNS directs the sender
The sender looks up the MX record for neir.io or neirmail.com and connects to mail.neirmail.com. SMTP transport uses TLS when the sending server supports it.
System transparency
What happens to your mail, step by step.
This is the technical map of Neir: what enters the system, which services touch it, where encryption begins and ends, what is retained, and what we deliberately never ask you for.
No KYC. Ever. Neir does not ask for or provide fields for your legal name, home address, phone number, date of birth, government ID, selfie, recovery email, or identity documents. You choose a mailbox address and receive an Account Key. Using email still creates necessary service data, such as addresses, message metadata and short-lived security logs, and this page names those limits precisely.
No identity profileNo KYC, identity proof, recovery contact, advertising profile or address-book upload requirement.
User-held accessYour Account Key and recovery phrase are generated in your browser. Their plaintext values are not stored.
No ad-techNo advertising pixels, cross-site trackers or third-party analytics SDKs. Page counts are aggregate-only.
No hidden boundaryConventional email is not zero-access. The sections below show exactly where plaintext must exist.
01 / OVERVIEW
The system at a glance
Public SMTP and HTTPS terminate at a deliberately small edge. Mail security, protocol storage and webmail each have separate jobs; internal databases and admin interfaces are not publicly exposed.
02 / INCOMING
When an email arrives
An inbound message is accepted only after recipient, abuse and malware checks. Delivery then creates both a standards-compatible mailbox copy and a webmail representation.
2
Postfix controls acceptance
Postfix applies connection, recipient and relay rules. Unknown recipients are rejected before mailbox delivery. Fail2ban and rate controls limit repeated abusive authentication attempts.
3
Rspamd evaluates the message
The local Rspamd milter checks SPF, DKIM, DMARC and ARC signals, reputation, rules, Bayes and neural classifications. Its learning and history state live in an isolated Redis instance.
4
ClamAV scans content
Rspamd passes content to the local ClamAV scanner. Malware is rejected. If the spam or malware layer is unavailable, delivery is temporarily deferred instead of silently bypassing the check.
5
Dovecot writes the mailbox
Postfix hands accepted mail to Dovecot over a local LMTP socket. Dovecot writes the RFC message to Maildir and serves it to IMAP, POP3 and the internal sync worker.
6
The sync worker imports it
IMAP IDLE provides near-real-time notice, backed by periodic reconciliation. The worker parses MIME, records flags and metadata, applies user filters, and avoids duplicate imports by mailbox UID identity.
7
The body gets a webmail-encrypted copy
Plaintext and HTML bodies are encrypted with the account's OpenPGP public key before being stored in PostgreSQL. Downloadable attachments are separate mode-restricted files; envelope metadata remains queryable.
8
Your browser opens the message
The API returns ciphertext plus the encrypted private key. After you unlock that key with your Account Key, OpenPGP decryption occurs in the browser. The decrypted private key is held only for the browser session.
Push notifications are optional. If enabled, the browser vendor's push relay receives an encrypted Web Push message whose visible notification contains the sender name/address and subject. The feature is off by default.
03 / BOUNDARY
Where encryption protects you, and where it cannot
“Encrypted” is not a single state. Neir separates transport protection, encrypted webmail storage, and conventional protocol storage instead of presenting them as the same thing.
Encrypted or one-way
- HTTPS, IMAPS, POP3S and submission transport
- Webmail body copies: OpenPGP public-key encryption
- Stored OpenPGP private key: PBKDF2-derived AES-GCM encryption
- Account Key: Argon2id verifier plus keyed lookup hash
- Recovery phrase and app passwords: one-way verifiers
- 2FA secret and pending delivery payloads: AES-256-GCM
- Credential-bearing configuration backups: age encryption
Visible to the mail system
- Sender, recipients, subject, timestamps and routing headers
- Message plaintext while receiving, filtering, importing or sending
- RFC message copies in Maildir for IMAP/POP3 compatibility
- Downloadable attachment bytes in protected server-side files
- User-created contacts, filters, settings and session user-agent
- Operational source IPs and request paths in bounded security logs
- Crypto checkout amount, network, address, status and transaction hash
The honest limit: this architecture reduces database exposure and keeps the OpenPGP private key encrypted, but ordinary SMTP/IMAP email is not zero-access or end-to-end encrypted by Neir. The server must process plaintext and retains protocol-compatible Maildir and attachment data. For true content secrecy from every mail provider, the sender must encrypt the message for the recipient before SMTP delivery.
04 / OUTGOING
When you send an email
The encrypted Sent copy and the delivery copy have different purposes. A message cannot be delivered to an ordinary external mailbox without being made available to the SMTP delivery process.
1
Compose and save
The body reaches the API over HTTPS. The Sent or Draft body is encrypted to your OpenPGP public key; subject and addressing metadata stay readable for listing, routing and search.
2
Queue without body duplication
BullMQ stores the message identifier, not a duplicate plaintext body. A separately encrypted, single-use delivery payload exists while the worker needs to perform delivery and is removed after successful processing.
3
Local or external route
A local recipient receives a body encrypted to that recipient's own public key. External mail is handed once to local Postfix, which signs DKIM and applies outbound policy and rate controls.
4
Transport to the destination
Postfix validates destination TLS policy with MTA-STS when published and otherwise negotiates opportunistic SMTP TLS. The remote provider receives the message and applies its own storage and privacy rules.
Open tracking is opt-in and off by default. If a sender enables it, an external message contains a random pixel URL and Neir records the first load time. Loading that URL also produces a bounded infrastructure request log. Local-to-local open status uses an internal message link and no pixel.
05 / ACCOUNT
An account without an identity dossier
Neir authenticates possession of secrets, not a civil identity. The browser creates the credentials; the server stores only what is needed to verify them and operate the mailbox.
A
Generated on your device
The browser generates the Account Key, 12-word recovery phrase and OpenPGP key pair. The private PGP key is encrypted in the browser with an AES key derived from the Account Key.
B
Abuse resistance without a CAPTCHA profile
After an explicit click, Neir signs a fresh random SHA-256 work challenge bound to a commitment of the future Account Key. One browser worker solves the bounded search and a small 8 MiB Argon2id memory-hard step locally before the key is displayed. Five-minute aggregate issuance, redemption and replay totals can raise the signed search bound equally for everyone during abuse. The server receives no benchmark, hardware profile, behavior score or third-party CAPTCHA result. Challenges expire within ten minutes, and local Redis keeps only a short-lived redemption hash to prevent replay. Free and Pro signup both require the proof.
C
Verified, not retained in plaintext
Registration and login send the Account Key through HTTPS so the server can verify it in memory. The database retains an Argon2id verifier and keyed lookup hash, not the plaintext. The recovery phrase is also stored as a one-way verifier.
D
Session data is minimal
A secure session cookie identifies a login. The session record contains timestamps and the browser user-agent so devices can be reviewed and revoked; it does not contain an account location field or a saved account IP address.
E
Optional additions stay optional
2FA, contacts, filters, push notifications, app passwords, open tracking and Pro payment are user choices. Neir never asks for a legal name or fallback email to activate them.
06 / DATA MAP
What exists, why, and for how long
Retention follows function. Deletion removes active records and message files, while rotating backups can retain a deleted item until that backup reaches the end of its limited recovery window.
| Data | Purpose and protection | Lifecycle |
|---|---|---|
| Mailbox account | Internal random ID, address, plan/status, quota, one-way credential verifiers and encrypted PGP private key. | Until you delete it, legal deletion is required, or optional 365-day inactivity deletion is enabled and triggers. Deletion removes the live database account immediately and quarantines Maildir for 3 days before erasure. |
| Messages | Maildir RFC copy for protocols; OpenPGP-encrypted body copy for webmail; plaintext metadata for routing, folders, threading and search. | Until message/account deletion. Trash and Spam are automatically emptied after 30 days; optional read-mail retention is user controlled. |
| Attachments | Randomly named, mode-restricted server files with filename, media type and size metadata. | Deleted with the owning message/account; may remain temporarily in rotating mail backups. |
| Delivery queue | Redis job contains an email ID. A PostgreSQL AES-256-GCM payload is available to the worker while delivery is pending/retrying. | Payload removed after successful processing; completed jobs are bounded to 1 hour/100 entries and failed job records to 7 days/500 entries. |
| Sessions and settings | Session timestamps/user-agent, contacts, filters, aliases, preferences, encrypted 2FA secret, hashed app passwords and optional push endpoint. | Until revoked, removed, expired by feature behavior, or the account is deleted. |
| Payments | For Pro only: amount, asset/network, deposit address, provider tracking ID, payment status and transaction hash. The provider and public blockchain are separate parties. | Retained as the transaction/subscription record; never supplemented with KYC data by Neir. |
| Signup abuse proofs | Signed random challenge, SHA-256 Account Key commitment, bounded solution, Argon2id result, Redis redemption hash and anonymous five-minute aggregate counters. No browser fingerprint, benchmark, behavior history or external CAPTCHA provider. | Challenge validity is at most 10 minutes. The redemption hash expires with it; aggregate counters expire after at most 15 minutes. Neither is attached to the created account. |
| Operational logs | Bounded web/mail/security logs can contain source IP, request path, protocol event, timestamp and error detail. They are for abuse defense and reliability, not advertising or identity profiling. | Rotated and size bounded; the system journal is configured for at most 14 days and can expire earlier under storage pressure. |
| Analytics | Per-page, per-day integer totals. The beacon omits credentials and no visitor ID, IP, cookie or session is attached to the analytics row. | Aggregate counts only; no individual browsing timeline exists in analytics storage. |
| Backups | Database, Maildir/attachments, Redis and encrypted configuration recovery sets. Access is restricted; credential-bearing configuration archives are age-encrypted. | Rolling local windows, generally 8–14 days depending on backup class. |
07 / OUTSIDE NEIR
When another party is involved
The core mail filter and storage path is self-hosted, but no internet email product exists in isolation. These are the deliberate external boundaries.
Other mail providers
Senders' and recipients' SMTP servers process envelope data and message content. Their policies apply to copies they handle. SMTP TLS protects a hop in transit; it does not control the destination's storage.
Crypto payment provider
Heleket creates and reports Pro checkouts. It receives checkout amount, currency/network and a random order identifier. Cryptocurrency transfers are also visible on the relevant public blockchain.
Browser push relay
Only if push is enabled, Mozilla, Google, Apple or another browser-vendor relay carries the encrypted Web Push payload to the subscribed device.
Remote content and support
Remote email images are fetched through a constrained Neir proxy so the image host sees Neir's request rather than your browser IP. If you contact Telegram, X or email support, that channel's provider handles what you send.
08 / PROMISE
Privacy by minimisation, not slogans
Neir's commitment is to avoid collecting identity data, limit operational data to a stated purpose, keep retention bounded, make optional disclosures opt-in, and publish the real technical limits.
Neir will not introduce KYC
No identity verification, government identification, biometric check, legal-name requirement, proof of address, phone verification or mandatory recovery contact will be required to create or use a Neir mailbox.
You remain in control
You can export account data, revoke sessions and app passwords, change optional privacy features, remove individual messages, and permanently delete the account from Settings.