Privacy Policy

Elektrine does not sell personal data. Ever.

We keep the bare minimum needed to run your account and stop botnets from burning our mail reputation.

We don't read, scan, or log your web browsing, chats, or mail to build ad profiles.

All you need to sign up is a username and a password. We don't want your legal name, your phone number, or a selfie of you holding your driver's license.

A recovery email is completely optional. If you put one in, it's only used if you lock yourself out.

Account

• Username, password hash, and security settings (2FA, passkeys, etc.).
• Recovery email, if you chose to add one.
• Public profile stuff you choose to publish (display name, avatar, bio).
• Basic UI settings (locale, theme, notification toggles).
• Login timestamps and login count.
• No IP address. If you sign up over the clearnet while open registration is on, we store a temporary sign-up source token: a keyed hash of the connection source so one guy with a script can't register 5,000 spam accounts in ten minutes. It cannot be reversed back into an IP address, and the key used to generate it gets wiped after two weeks, turning old tokens into useless noise. If you sign up over Tor, I2P, an invite code, or a paid Omega account, we don't even record the token.

Your content

• The stuff you actually put here: mail, posts, chats, files, calendar events, contacts.
• Standard mailbox and message metadata required to put mail in the right folders and deliver it.

Sessions and devices

So you can see what's logged into your account and kick dead sessions:

• Rough device/browser labels (e.g., "Firefox on Linux") and when it was last active. The raw browser User-Agent string gets thrown away immediately so it can't be used to fingerprint you.
• No IP addresses are attached to sessions or trusted devices.
• Tor and I2P sessions: we don't even keep the rough browser/device label.

Security and abuse control

• Failed logins, rate limits, and SMTP connection counters are tracked strictly in volatile RAM, keyed by a temporary hash of the source rather than an IP. Pull the plug on the box and it's gone.
• Basic spam and malware filtering signals on incoming/outgoing mail queues so our IP blocks don't get blacklisted by Gmail.

Page and profile view counts

We count daily page and profile views without tracking who looked at what.

• Kept per day: total views per page/profile, domain-level referrer names (not full URLs), and daily click/signup totals from our own promo links.
• Never kept: IP addresses, user agents, cookies, visitor IDs, account IDs, or full referrer URLs.
• How unique views work: we hash the visit with a random salt that only lives for 24 hours. At midnight, the salt and the hashes get nuked. There is zero way to link a view back to a person.
• No Google Analytics, no Cloudflare insights, no third-party tracking scripts.

What we don't do

• We don't keep access logs of what pages you click on.
• We don't sell traffic data.
• We don't scrape your private mail or DMs for "engagement" or ad targeting.

IP addresses

Elektrine does not store IP addresses anywhere in the stack. Not in web server logs, not in Postgres, not in audit logs, not in sessions, not in API tokens, not in app passwords, not in passkeys, not on Maid VPN, and not in outgoing mail headers.

Where we have to stop a repeat attacker or spammer, we hash the source in memory with a key that never touches a hard drive. The only exception is the clearnet sign-up token mentioned above, whose key rotates weekly and gets deleted after two weeks.

• Tor and I2P: no source token, no user-agent.
• Invite or paid signups: no source token.
• Account deletion: instantly wipes your sign-up token, kills all active sessions and API keys, and purges your profile view counts.

Operational logs

System and mail daemon logs outside the main database only hold server error traces and SMTP delivery statuses (so we can fix broken mail routes or bounces). They never contain IP addresses or the URLs you visit, and they avoid message bodies whenever possible. All operational logs are automatically wiped every 6 hours.

Maid VPN

We don't log your traffic, your DNS queries, or when you connect/disconnect.

• No client IP addresses on session records.
• WireGuard and AmneziaWG private keys are generated on your own device and never touch our servers. We only see your public key and an encrypted pre-shared key.
• Peer states live in node RAM. Free-tier accounts only track a raw bandwidth counter so people don't abuse the free pipe.
• Read the full VPN Policy for the low-level routing details.

Standard email runs over SMTP. If you email someone on Gmail, Google's servers obviously see the message and the envelope metadata. We can't fix how 1980s email protocols work on someone else's server.

When you send mail from Elektrine, we strip your client IP out of the headers.

Stored mail bodies are encrypted at rest on our disks by default. We keep the raw original message (encrypted) so DKIM/PGP signatures don't break in mail clients, unless you turn on Private Mailbox mode, which drops the original completely and locks extra metadata behind your browser passphrase.

Admin tools cannot decrypt your private mail or private chats.

Reports: if someone reports a public post or a chat message to moderators, the mods get a copy of the reported message. Don't send things to people who are going to report you.

Trash and spam folders get permanently shredded after a short window.

If you are emailing outside of Elektrine and need true end-to-end encryption against a hostile recipient server, use PGP.

• To actually route your mail, chats, social posts, DNS, and Maid VPN traffic.
• To log you in and keep botnets from DDoSing the boxes.
• To fix server crashes and keep the rack online.
• To reply to you if you open a support ticket.

We don't sell data to anyone. Data only leaves Elektrine when:

• You send it somewhere: like emailing an external address, federating a post to Mastodon/Bluesky, or messaging another domain over Arblarg.
• You connect Telegram for new-mail notices: Telegram receives each notice. It says only "New email" unless you turn on sender and subject.
• Bare metal / upstream providers: the datacenters and bandwidth providers that keep our servers plugged into the internet.
• Law enforcement: if we get served with a valid, legally binding court order that we cannot fight, we have to comply with what the law requires. Because of how the stack is built, we cannot hand over IPs, browsing histories, or client-side encrypted data, because we don't have them.
• Active attacks: stopping someone actively trying to hack the server, run fraud, or cause direct physical harm.

We only use cookies and local storage so the web app actually functions:

• Session cookies to keep you logged in.
• CSRF tokens so malicious sites can't forge requests on your behalf.
• UI preferences (like dark mode).
• If you clicked one of our own promo links, a temporary cookie holds which link it was until you sign up or close the browser.
• Your browser holds your local encryption keys when you unlock a Private Mailbox.

Your data stays here as long as your account is open. You can delete individual posts, files, mails, or nuke your entire account straight from your settings at any time.

System logs auto-delete every 6 hours. There are no automatic backups. Before big maintenance we take a full database dump by hand. It stays on the same locked-down server and gets deleted once it's no longer needed, so something you deleted can survive in one until then.

You can export your data, tweak your privacy settings, or delete your account whenever you want from the UI. If something in the UI breaks or won't let you delete something, email us and we'll nuke it manually.

Don't use this site if you're under 13. We don't knowingly collect data from children.

We publish a PGP-signed warrant canary at /canary and a full list of legal requests we're allowed to talk about at /transparency.

If we change how any of this works, we'll update this page. If it's a major change, we'll put up a notice inside the app.