> For the complete documentation index, see [llms.txt](https://docs.yeymail.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.yeymail.com/using-yeymail/privacy-controls.md).

# Privacy controls

## What never leaves with your mail

These apply to every alias, on every message. There is nothing to switch on.

**Replying always goes through us.** Whoever writes to your alias, your reply leaves from the alias, never from your real mailbox. That holds even when the message shows you the sender's real address, and even when the sender tries to claim the reply for themselves: a `Reply-To` header pointing somewhere else is replaced with a YeyMail reply address before the message reaches you. Newsletters set that header routinely, so without this a single tap of Reply would have gone straight from your real inbox to them.

**Read receipts are refused.** A sender can ask your mail app to confirm the moment you open their message, which your app would answer from your real address without asking you first. Those requests are removed before the message reaches you, in every form mail clients recognise, so there is nothing for your app to answer.

**Failed deliveries don't name you.** If your inbox refuses a forwarded message, the sender is told it didn't arrive and nothing else. An ordinary mail server replies with a report quoting the address it tried to reach; forwarding through an alias, that address would be yours.

**Mail you send doesn't carry your IP address.** When you send from an alias through your own mail app, the connection details that would normally travel with the message (your address, your provider, your mail client) are replaced before it goes out. Two aliases can't be tied to one person by where they were sent from.

## What we store, and what we don't

**We never store the content of your messages.** Mail is encrypted in transit wherever the receiving server offers it. For destinations that publish an enforcing MTA-STS policy and present a certificate chain we can verify, encryption is required and the certificate checked, with no fallback to plaintext. That is a specific list rather than every destination: where a provider publishes no policy, publishes one only in testing mode, or serves a chain we cannot verify, delivery stays opportunistic, encrypted whenever the far end offers it but not enforced. We would rather deliver your mail than hold it.

Either way the body is discarded the moment it's delivered. There is no message archive to breach, subpoena, or leak, because there is no archive.

We also publish our own MTA-STS and TLS-RPT records, so senders can check they are really talking to our mail servers. That policy is in testing mode for now, which means a sender that finds a problem reports it to us and still delivers. It does not yet stop anyone delivering to us in the clear, and this page will say so when it does.

We do keep **delivery metadata**: which alias received something, when, and whether it was delivered, bounced or queued. That's what makes the activity log and the per-domain statistics work, and what lets you spot an alias that's been leaked. Per-message delivery logs are kept 30 days; account activity 90 days. Both are pruned automatically, on a daily job.

We don't run ads, embed trackers in the app, or build advertising profiles.

## Tracker removal

Marketing email is full of things that report on you: a 1×1 invisible image that tells the sender the moment you open the message, along with roughly where and on what device, and links wrapped in redirectors that log every click.

Switch on **Remove trackers** for any alias and we strip both in transit: the invisible images are deleted, and tracking parameters are pulled out of the links, before the message reaches you.

This works on the HTML part of a message, which is where tracking lives. An invisible image can only load from HTML, so opens stop being reported. It is deliberately conservative: anything we can't parse cleanly is passed through untouched rather than risk mangling a message you wanted. A determined sender can still invent something we don't recognise yet, so treat this as removing the routine tracking that arrives in ordinary marketing mail, rather than a guarantee that no measurement of any kind is possible.

One visible consequence: cleaning a message means modifying its body, which invalidates the sender's original signature, so we re-sign it. The sender line is not what this setting changes: every forwarded message, cleaned or not, reaches you from a YeyMail reply address, with the real sender kept in the display name as `Sender (real@address) via your-alias@yeymail.com`. The real sender's name and address stay visible that way and replying still works. But if you'd rather see the untouched body, leave it off for that alias. It's per-alias precisely so you can have it on a newsletter address and off on one where the exact original matters.

## PGP encryption

Paste your public key in **Settings → PGP** and we re-wrap incoming mail as PGP/MIME before forwarding it. The body of the message sitting in your inbox is then encrypted to a key only you hold, which means your own mail provider can't read it either. As with all PGP/MIME, that covers the body: the subject line, the From and To addresses and the date are left as they are, and stay readable.

Available on both plans. If you turn it off and on again, re-paste the key rather than assuming the old one is still there.

## Breach checking

The checker on our home page runs entirely in your browser. The address you type goes directly from your device to the [XposedOrNot](https://xposedornot.com) community breach database and never reaches our servers. We don't receive it, log it, or store it.

## Cookies

We set exactly two, both strictly necessary:

* a **session cookie** that keeps you signed in — a random identifier, no personal data, `HttpOnly`, signed, and `Secure`
* a **ten-minute sign-in cookie** used only while you're completing "Continue with Google", to stop a third party forging that sign-in

That's the whole list. No analytics, advertising or tracking cookies, which is why you haven't been shown a cookie banner: consent is required for tracking cookies and we don't use any. If that ever changes we'll ask first.

## Your data

**Export** and **delete** are both self-service in Settings.

Deleting your account disables every alias immediately, cancels any subscription, and purges your account, aliases, destination inboxes, domains and mail history.

Two records survive, both with the link to you removed: a content-free marker that a given `@yeymail.com` address was once in use, so it can never be reassigned to a stranger who would then start receiving what was your mail; and, if your account was ever the subject of a fraud or chargeback report, that report, which we keep for abuse prevention.

Full detail on your rights is on the [GDPR page](https://yeymail.com/gdpr).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.yeymail.com/using-yeymail/privacy-controls.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.