Private, secure, and honest about the trade-offs
We keep your mail in the EU, protect your account with modern sign-in, and make money from subscriptions only. We also tell you clearly what we can and cannot see.
Hosted in the EU
Your mail and account data are stored in data centres in the European Union, and the EU's data protection law (GDPR) applies to all of it, wherever you live.
Encrypted in transit and at rest
Connections use TLS, including between mail servers where the other side supports it. Disks and object storage are encrypted. Our own domains publish MTA-STS so senders must encrypt.
No ads, no profiling
Subscriptions pay for the service. We do not show ads, build advertising profiles or sell data. This website runs no analytics or tracking scripts.
Account security
- Two-factor authentication with an authenticator app (TOTP)
- Passkeys (WebAuthn) for phishing-resistant sign-in
- Recovery codes, and a recovery address outside your own domains
- App passwords for mail apps, each limited to IMAP, SMTP or calendars, showing when it was last used
- A list of active sessions and recent sign-ins, and a notice when a new device signs in
- API keys with scopes and expiry dates
Your data, your call
- Export everything: mail as mbox or EML, calendars as ICS, contacts as vCard
- Delete your account, with a clear timeline for when data is gone
- A data processing agreement (DPA) if you need one
- A published policy for law enforcement requests, and a transparency report
- Found a vulnerability? Write to security@eoinbox.com (see security.txt)
Why eoinbox does not use end-to-end encryption
Some mail services encrypt your stored mail with a key only you hold. We decided not to, and we want to be upfront about it: our servers can read your mail. We process it only to run the service (delivery, spam filtering, search), and the privacy policy sets out exactly when anything more could happen. But technically, it is possible.
Here is why we made that choice:
- Full search. Searching every word in years of mail, quickly and from any device, needs a server-side index of the content.
- Filters and rules that just work, on every message, even when no device of yours is online.
- Open standards. IMAP, JMAP and every normal mail app work without special bridges or plugins.
- AI assistants can search and draft for you through MCP, which is impossible if the server cannot read anything.
- Most mail is not end-to-end encrypted anyway. When someone sends you an ordinary email, it travels between ordinary mail servers. End-to-end encryption only covers messages between people who both use it.
If you need content that even your provider cannot read, for example as a journalist protecting sources, use a tool built for that, such as an end-to-end encrypted messenger or PGP on top of your mail. You can still use PGP with eoinbox in a mail app that supports it; we just do not build it into the service.