Privacy policy.

Who runs xail.me

xail.me is a Netquirk service. The sign-in and billing surface for every Netquirk service is my.netquirk.com. This page covers the xail.me-specific surface: the mailbox web client, the storage of your mail, and the sign-in bridge between the two.

What we collect

• Account identity. The my.netquirk.com account you use to sign in. xail.me receives the same identity on every sign-in.
• Routing metadata on stored mail. The sender and recipient addresses, the time a message arrived, the folder and flags the inbox needs to render correctly, and the byte length of the envelope. The full list is on the security model page.
• Account preferences. Your signature, away auto-reply, two-factor enrolment, and per-recipient junk and block rules — anything you set from the /settings page.

What we store

• The sealed envelopes of your messages and attachments. xail.me stores the bytes; it does not have the key to open them. The encryption shape is described on the encryption page.
• The routing metadata listed above, alongside the sealed envelope.
• The salt and parameters the browser needs to derive the key from your password. The key itself is never sent to xail.me.

What we do not collect

• The plaintext body, subject, or attachment bytes of any stored message.
• The decryption key derived from your password.
• Tracking pixels, advertising identifiers, or third-party analytics on the xail.me domain.

What we share

xail.me does not sell or rent account data. The service shares account data in three narrow cases:

• With you. The web client shows you the data on every page you can see.
• With my.netquirk.com. The sign-in and billing surface sees the same identity and the same plan you have on xail.me, and the billing events your plan produces.
• With law enforcement, when required. xail.me responds to legally binding requests from the authorities in the jurisdictions the service operates in, to the extent the service can respond. The service cannot produce the plaintext of stored mail because the plaintext is not on the service.

How long we keep your data

• Stored mail and routing metadata are kept for as long as your xail.me account is open.
• Closing the account from the /settings page deletes the account and the stored mail.
• Routing metadata in service logs (the audit log of the mail-handling pipeline) is retained for the short window needed to operate the service and is then deleted.

How to ask for changes

• Edit your account preferences from the /settings page — signature, away message, two-factor, contacts.
• Close your account from the close-account control on the same page.
• Email privacy questions to the address published on my.netquirk.com.

Changes to this policy

Material changes to this policy are reflected by updating the "Last updated" date above. Continued use of xail.me after a change means you have read the updated policy.