GDPR data request (EU and UK)

Open What we hold about you. It lists every category stored under your account and counts each one at the moment you open it — messages and threads, attachments, Drive files, signatures, the people you have written to, your keys, devices signed in, security keys, push registrations, sending limits and the operator records that mention your account.

Each row says how long that category is kept, and rows we cannot read are labelled as encrypted. The list is generated from the database, not written down in advance, so it cannot drift from what is actually there.

In the app: Settings → Security and privacy → Privacy and data → What we hold about you

Open Download my data and press Prepare the file. The server assembles one small JSON file: your email address, display name, settings, receiving aliases, devices signed in, what you have agreed to, and the operator records that mention you. The prepared file is removed from the server again after the number of hours the screen states.

Your mail, chats, attachments and Drive files are not in it, and not because they were left out. They are encrypted with your key, so the server holds ciphertext it cannot assemble into anything readable. Each message can be saved from the app itself with Show original, which gives you the message as a file — see Show original.

In the app: Settings → Security and privacy → Privacy and data → Download my data

Nearly everything we hold is something you entered yourself, so you can correct it in Settings:

• Display name — change it at any time.
• Recovery email address — replace or remove it. We store only a hash of it, never the address.
• Username — possible in limited cases; the article explains when.

If something you cannot reach is wrong, write to support from the account and say what is incorrect.

Use Pause my account. Nothing goes out while it is paused: no mail, no chat messages, no calls, no invitations, and your public key stops being published, so nobody can look it up to write to you encrypted.

Mail addressed to you still arrives and is stored, and you can read your mailbox as before. Nothing is deleted, and you can switch the account back on from the same screen at any time.

In the app: Settings → Security and privacy → Privacy and data → Pause my account

Use Delete my account. It asks twice: the first screen says what deletion reaches, the second asks you to type your email address. Then everything stored for the account is wiped — mail, chats, attachments, Drive files, signatures, your keys, your devices and your settings — every device is signed out, and your email address stops working.

Two things it cannot reach, both stated on the screen itself:

• Messages you already sent are in other people's mailboxes, encrypted to their keys. Deleting your account does not remove them and we cannot take them back.
• Operator records that mention the account are kept for as long as the audit trail is kept, then deleted. They hold the account id and what was done — never an address and never message content.

Your email address is not released afterwards: the empty record stays so that the handle cannot be registered again, by you or by anyone else.

If you cannot sign in, see Delete your account for the route that works without a session.

In the app: Settings → Security and privacy → Privacy and data → Delete my account

The only processing we do is running the service you signed up for: delivering and storing your encrypted mail and chats, and keeping the service free of abuse. We do not profile you, do not advertise and do not sell data, so there is no separate processing to object to.

In practice an objection means one of the two controls above: Pause my account stops everything going out and keeps your data, Delete my account removes it. If you mean something else, write to support and say what.

Two consents are stored on the server, and both are switches under What you have agreed to:

• Publish my public key so others can encrypt to me. Turning it off removes your key from the public directory immediately; a lookup then answers exactly as it does for a name nobody holds. Mail inside Private.Ki stays encrypted either way.
• Browser notifications. Turning it off here removes every browser you have registered, not only this one.

Your recovery email address is optional too and can be removed in Settings.

In the app: Settings → Security and privacy → Privacy and data → What you have agreed to

We take no automated decisions that produce legal effects or anything similar. What is automated is abuse prevention: outgoing mail is checked against blocklists and a few link rules, and sending limits apply to new accounts. A check can refuse one message or put a strike on an account — see Why am I rate-limited?.

If one of those refusals affected you and you think it was wrong, write to support and ask for it to be looked at by a person. We record that as a request for human review.