Zero-knowledge content, minimal metadata
We say it plainly: the client is open source, so you can verify that data is encrypted before it reaches us. We cannot read your email content, but we do run an account service, so we hold minimal metadata to make it work.
What "zero-knowledge" means, without the jargon
Your email is encrypted on your device with a key derived from your password. The key never reaches us. On our servers we store only ciphertext that we cannot decrypt. The client is open source, so you can easily see that only encrypted data is sent before upload. This is not a policy promise — it is a technical impossibility.
What metadata we hold, and why
To operate your account, we hold a minimal, clearly bounded set of metadata:
We are precise: "we cannot read your email content" (true, verifiable in the open-source client) versus "we hold no metadata" (false). We hold minimal metadata — never "no metadata".
Data residency
Data is hosted in the European Union, in Romania, at our trusted partner pidginhost.com, which operates a dedicated datacenter building. No transfers outside the EU for archive storage.