# Privacy notice

Skudo holds as little about you as it can, and encrypts what it holds wherever the service allows it. This page says what is stored, why, and for how long.

## What sets it apart

- **We do not store your mail.** It passes through and is gone.
- **We cannot read your notes.** Notes you write in the dashboard are encrypted in your browser.
- **Your password never reaches us.** Sign-in uses OPAQUE, and passkeys work too.
- **No ads, no trackers, nothing sold.**
- **Deleted means deleted.** When you delete your account its data is erased, and its key in our backups is destroyed.

## 1. Who is responsible

The controller is the operator of Skudo, in Italy.

_(Operator name and postal address: shown as an image on the notice page.)_

If you cannot read the image, write to privacy@skudo.org and we will send the same details as text. That address is also the contact for this notice and for your rights.

## 2. What is stored

| What | Form | How long |
| --- | --- | --- |
| Your account | Username and a sign-in credential that is not your password (an OPAQUE record; older accounts keep a password hash until their next sign-in) | Life of the account |
| Alias addresses | Plain text, because the relay must read an address to route mail | Until you delete the alias |
| The address an alias forwards to | Encrypted, under its own key | Until you remove it |
| Notes and display names | Encrypted. Notes written in the dashboard are encrypted in your browser; those written through the API or the extension are encrypted on our side | Until you delete the alias |
| Sign-in recognition | Hashes of your browser identifier and one-way tags of your network address, so we do not ask for a code at every sign-in. No readable IP address | Until removed; network tags rotate every 30 days |
| Security notices | Such as a new sign-in, encrypted, in your notification inbox. The latest 100 are kept | Until you delete them |
| Records of messages sent through an alias | References and type, whether it bounced. No content | 7 days |
| Delivery failures | Sender and destination encrypted | 7 days |
| Support tickets and attachments | What you wrote and the address you wrote from. Attachments are encrypted | 7 days after the ticket closes |
| Abuse reports, legal orders, administrative actions | The address and category, or the action and the account | 24 months |
| Aggregate counters | Whole numbers only, with no account, address or IP attached | 30 days by the hour, 400 days by the day |
| Fault reports and logs | The error and where it happened, without request parameters. Logs redact addresses | 90 days after the fault closes; logs 7 days |
| Backups | Nightly, encrypted, stored in the EU, each account with its own key | Expire automatically after a limited period |

Sessions do not record your IP address or browser identifier. A deleted alias is erased within 24 hours.

Backups and deleted accounts: the key protecting an account's data in the backups is not kept on the server. When you delete your account it is destroyed within minutes, after a 24 hour quarantine copy that lets a mistaken deletion be undone. From then on that data cannot be opened in any backup. This applies to backups made from 20 September 2026; earlier ones are a single archive and expire on their normal schedule.

Message content is never archived. If your inbox is unreachable, a message waits in the mail queue until it is delivered or expires, as in any mail server. The optional mailbox, off by default, stores only mail encrypted to your OpenPGP key or already encrypted end to end.

## 3. Why, and on what basis

| Purpose | Basis |
| --- | --- |
| Providing the service you asked for | Contract, Article 6(1)(b) GDPR |
| Preventing abuse and keeping the service deliverable | Legitimate interests, Article 6(1)(f) |
| Answering lawful orders | Legal obligation, Article 6(1)(c) |

We do not rely on consent, because verifying parental consent would mean collecting identity. On legitimate interests: accounts sending spam can get our domains blocked, which breaks every alias for everyone. That processing covers counters and signals about an account, never the content of mail, and you can object to it.

## 4. Who else is involved

Servers and backup storage are at providers inside the European Union, and no personal data leaves the European Economic Area. Card donations happen on Ko-fi, a separate service with its own privacy policy. Bitcoin and Lightning go through our own BTCPay server. We record the amount, currency, method and date of a donation, with nothing tying it to an account.

## 5. Your rights

You can ask for access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Export in JSON, CSV and ZIP is available in the application at any time.

Because we identify you by your account and not your name, we may be unable to answer a request about an alias from an address we cannot connect to an account. Article 11 GDPR lets us say so instead of collecting more about you. We answer within one month. You can complain to the Garante per la protezione dei dati personali in Italy, or to the authority where you live.

## 6. Security incidents

If a breach is likely to risk your rights we notify the supervisory authority within 72 hours and you without undue delay, and publish an incident report within 14 days.

## 7. Age

You must be at least 14. We cannot verify age without asking for identity, which we will not do, so we rely on what you tell us. If you believe a younger child has an account, write to privacy@skudo.org and it will be closed.

## 8. Changes

Material changes are announced at least 30 days in advance, and previous versions stay available.