This page tells authorities how to make a request, and tells everyone else what we are able to produce. Both audiences matter, so nothing here is written to be read only by lawyers.
Who we are
Skudo is operated by a private individual in Italy, subject to the Italian courts. The operator's name and postal address are given in the privacy notice. Service of process should be preceded by contact at the address below.
Where to send a request
legal@skudo.org, stating the legal basis, the issuing authority, the addresses concerned and the period. Requests arriving by other channels are redirected here rather than acted on.
We do not accept requests by telephone. We do not act on a request from an individual claiming to represent an authority without documentation.
What we can produce
Everything we hold is listed in the privacy notice, and there is nothing else. In practice a request about an alias can reach:
- the alias address itself, which is stored in plaintext because the relay has to read it to route mail;
- the counters and last-used timestamps attached to it;
- the address it forwards to, which is encrypted under a separate key that we hold and can therefore be compelled to use;
- records of messages sent through it in the last 7 days, which contain no content;
- delivery failures from the last 7 days;
- if the account holder has written to support, the correspondence itself, and any files attached to it, kept for 7 days after a ticket is closed, or 24 months where the ticket concerned abuse or a legal order;
- abuse reports made about the address, kept 24 months.
What does not exist
Message content. Forwarded mail is not stored. There is no archive to produce, no mailbox to image and no backup containing message bodies. Where a user has enabled the optional mailbox, stored messages are either encrypted to that user's own OpenPGP key, whose private half we do not hold, or were already encrypted end to end when they arrived and were stored unchanged. Either way we cannot decrypt them for you or for anyone, and mail that could not be encrypted was never stored in the first place.
Anything older than the retention periods above. Deletion is automated and we do not keep a copy against the possibility that somebody may later ask.
Data about deleted aliases. An alias deleted more than 24 hours ago is gone.
Any link between a donation and a user. Donations are recorded as an amount, a currency, how they arrived and when. There is no column tying one to an account, and no payment path here carries an account reference, so a request for "the account that paid" cannot be answered by producing something we hold back.
Preservation orders
We comply with a valid preservation order to the extent that the data exists at the moment the order arrives.
We will not begin collecting data that we do not otherwise collect in order to satisfy a preservation order, unless separately and lawfully compelled to do so. An order to preserve is not an order to start recording.
Emergency requests
We respond to a credible request concerning an imminent risk to life or of serious physical harm without waiting for formal process, and we report the number of such requests in the transparency report.
Orders we refuse
We refuse orders that are defective on their face, that come from an authority without jurisdiction over us, or that demand more than is proportionate to the matter stated. Where the law allows, we contest them.
Foreign orders are actioned through mutual legal assistance or an equivalent recognised route, not directly.
Telling the user
We notify the user whose data is requested, before disclosure where possible and afterwards where not, unless we are legally prohibited from doing so or unless notification would create a risk to life.
Where a prohibition has a time limit, we notify when it expires. The expiry is recorded against the request when it arrives and comes back as a reminder, so that notifying does not depend on somebody remembering.
What we publish
Periodically, and at least once a year: how many orders arrived, how many sought an identity, how many forwarding addresses were disclosed, how many accounts were affected, and how many requests were refused. Figures are published even when they are zero.
One thing we will not pretend
This is one operator in one country. A valid Italian order compels what we hold, and there is no second party who could refuse on your behalf. What we can promise is that we hold as little as the service allows, and that we say exactly what that is.