Privacy notice

Your data at neomail.pro

Short version: we store as little as possible, and what we must store about you is encrypted with a key that only your password or your recovery key can unlock.

Who is responsible

neocor cloud UG (haftungsbeschränkt), Kleinbocka 21a, 07589 Bocka, Germany, represented by its managing director Heike Günther. Contact details are in our legal notice.

What we store, and how

• Your address and display name: encrypted with your mailbox's public key. To find your account at sign-in we keep a keyed hash (HMAC) of the username, which cannot be turned back into the name without a secret key kept outside the database.
• Your messages (inbox and sent): sender, recipients, subject, text and attachments are encrypted the moment they are stored. Only your password or your recovery key unlocks them. We cannot read them and cannot hand readable copies to anyone.
• Your password is never stored. It only derives (Argon2id) the key that unlocks your mailbox key. Your recovery key works the same way.
• Unencrypted, because the service cannot work otherwise: when the account was created, when messages arrived, their size, whether they are read, and how many messages you sent today (kept two days, for the daily limit).
• Abuse protection: failed sign-ins and new registrations are counted per network address and per username, stored only as keyed hashes and deleted after two days at the latest.

Sending and receiving

Mail to another @neomail.pro address never leaves our server. Mail to other providers is handed over over the internet, encrypted in transit (TLS) wherever the receiving server supports it. From there on, the recipient's provider processes it under its own terms. Our mail server writes a log of deliveries (time, sender and recipient address, status), which is needed to operate the service and fight abuse; it is deleted after 14 days.

Web server logs and cookies

Like every web server, ours logs requests with your IP address for security and troubleshooting; these logs are deleted after 14 days. When you sign in, two strictly necessary cookies hold your session: one identifies it, the other holds the key that decrypts your session on our server, so neither is useful alone. There are no analytics, no ads, no third-party scripts, fonts or images. Images in HTML messages from other servers are blocked so senders cannot track you.

Legal basis

We process your data to provide the mailbox you signed up for (Art. 6 (1) (b) GDPR) and to keep the service secure and free of abuse (Art. 6 (1) (f) GDPR, our legitimate interest in a reliable service).

Processors

Our servers are operated by Contabo GmbH, Germany, under a data processing agreement. Because your data is encrypted, the hosting provider has no access to readable content either.

How long

Your account and all messages stay until you delete them. Deleting your account in the settings removes the account and every message immediately and for good. The address itself is kept as a hash so that it is never assigned to someone else.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). Most of it you can do yourself in the settings. You may also lodge a complaint with a supervisory authority, for example the Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit (TLfDI).

As of 8 November 2026