Your letters are not the product.

Mail you send. Outgoing letters are delivered through Mailgun, a mail delivery service, so they reach every inbox reliably. Mailgun handles each letter on its way out, like any mail server between you and the person you wrote to. Letters sealed with PGP pass through still sealed.

Notifications. When a letter arrives, our server asks Apple (iPhone) or Google (Android) to tell your phone. That request carries no sender, no subject and no words. On iPhone it’s a plain “New mail” notice; the app then asks our server, directly, for the sender and subject and shows them. Apple and Google only learn that your device got a notification, and when.

Finding keys. To seal a letter, Epistle looks for the recipient’s public key: first on our own server, then on the recipient’s mail domain (Web Key Directory), then on keys.openpgp.org. That lookup sends the recipient’s address, from our server, not from your phone.

Pictures in letters. Remote images are fetched through our own image proxy, so the sender never sees your IP address, your device or whether you opened their letter. In the app, you choose whether they load at all.

We have no other processors. Nobody else gets your data, and we don’t sell it, rent it or swap it.

Epistle signs you in with SRP (Secure Remote Password, an open standard). Your phone or browser proves it knows your password, and the server checks that proof against its verifier. The password itself never travels and is never stored.

The exceptions, so you know them: an address made on this website’s sign-up page, or made or reset by an administrator, has its password sent to the server when it’s set and once more at its first sign-in, to set SRP up. Until then the mail server keeps only a one-way hash of it, which is then replaced with random data. From then on it’s SRP like everyone else, and sign-ups in the app never send it at all.

Your encryption keys are locked with a key made from your password on your own device. We can’t unlock them.

Like every server, ours keep short technical logs to keep Epistle running and safe: the time, the IP address, which page or app request it was (never its contents or the letter), and events such as “signed in”, “password changed” or “account deleted”, with the address. The mail server logs who sent mail to whom and when, as all mail servers do, to deliver it and fight spam.

Logs are kept for [LOG RETENTION — Martynas to fill, e.g. 14 days] and only read to fix problems or stop abuse.

Addresses you signed up for can be deleted in the app: tap your picture at the top of the inbox, then Settings › Account › Delete account, type your password and your address. Your mailbox, every letter in it, your contacts, settings and keys are deleted at once, your recovery email is forgotten, and every device is signed out.

Addresses made for you by an organisation (a church, a school, a business on its own domain) belong to that organisation. The app shows “ask your administrator”, and your administrator deletes them.

A few small records outlive the account for a while: the sign-up record (address and hashed IP) for up to 30 days, the list of devices that were signed out (names and dates, no tokens), the sign-in verifier, and server logs until they roll over. Backups of the mail server are kept for up to [BACKUP RETENTION — Martynas to confirm; the current setting is 1 year of snapshots], then overwritten; we never restore a deleted account from them unless you ask.

You can ask for a copy of what we keep about you, for it to be corrected, or for it to be deleted, and you can object to how we use it. Write to contact@epistle.email; we answer within a month. If you’re in the UK or the EU you can also complain to your data protection authority (in the UK, the ICO).

We use your data to provide the mail service you asked for (our contract with you), to keep it safe from abuse (our legitimate interest: logs and rate limits), and your recovery email because you chose to give it (your consent; remove it any time).

Epistle is not meant for children under 13.

If this policy changes in a way that matters, we’ll say so in the app or by email before it takes effect.