When you visit
There are no analytics, advertising SDKs or third-party trackers. Three.js, fonts and images load from this domain. Visiting alone does not set an account cookie.
The server sees an IP address to make the connection. Website access logging is disabled; that does not mean the server or network operator can never observe connection information.
When you create an address
Your username, password and early-registration acknowledgement travel to the server over TLS. A phone number, full name or another email address is not required.
The server stores the username/address and creation time. A randomly salted scrypt hash is stored instead of the password itself. A hash of the random request identifier supports safe retries. This is not a promise of anonymity or E2EE.
Sign-in and security
After authentication, a Secure, HttpOnly, SameSite=Strict cookie is used only for your session. The server stores a hash of its secret. Sessions last 30 minutes; expired records are removed by a ten-minute cleanup cycle during normal operation.
To limit abuse, a daily keyed HMAC derived from the IP address is held in process memory. Request bodies, passwords, cookies and address lists are not written to application logs. Rate counters are not used to build tracking profiles.
When you delete your account
In the app, Settings → your us2usmail.com account → Delete my account opens the website’s password-confirmed deletion flow. Removing an account from this device is different from permanently deleting the server account.
The account, password hash and web sessions are deleted; the account’s server mail and device records enter the deletion process. A one-way address hash and allocation/deletion times remain to prevent someone else receiving the same address later. This protection has no automatic expiry.
Operational backups may contain earlier records; access is restricted to the server administrator. Deleting a mailbox at an external provider and revoking its OAuth grant are separate actions.
Email and encryption
Real mail connections in the macOS, iOS and Android apps require the operating-system key store and encrypted local storage. Persistent account, password/token and mail data are protected on the device using SQLCipher. Screen lock invalidates open content and pending operations.
External IMAP/SMTP accounts connect directly to their provider. Their sign-in credentials and mail are not routed through the us2us Mail server. Ordinary email is not end-to-end encrypted; providers and delivery mail servers can process its content.
End-to-end encryption between us2usmail.com accounts requires separate device and key verification. It is not generally available until independent verification and review requirements are satisfied. Unverified keys never silently fall back to ordinary SMTP. A web password is not a content key.
The us2usmail.com mail service
When you send and receive ordinary external mail using our address, the service processes your address, random account/device identifiers and authorisation records, message headers, senders/recipients, subject, body and attachments to provide email. Public keys and device approvals may be stored; a device’s private key is not given to the server.
Ordinary external mail is encrypted at rest on the server, but the SMTP gateway can process its content. Amazon SES is the external delivery provider and processes messages and delivery metadata. This flow is not end-to-end encrypted. The 1 GB per-mailbox quota applies only to us2usmail.com accounts; data is retained as part of the service until you delete it or close the account.
We do not use account or mail data for advertising, tracking profiles or data sales. You select files using the system picker; photo, audio and document attachments follow the same ordinary email processing rules.
Google and Microsoft data
You grant OAuth access on the provider’s own screen. Gmail IMAP/SMTP requires the https://mail.google.com/ scope. This is broad permission to read, send and delete mail, not a headers-only permission. Google testing grants expire after 7 days; public release approval is still pending.
The app uses your address, folders, message headers, flags and selected message content only for the mail actions you request. Bodies for up to 50 messages on the first page are prepared in bounded session memory and cleared on lock. Attachments are not downloaded automatically. Mail connections run only while the app is in the foreground and unlocked. There are no notifications or background mail checks.
Persistent tokens, account data and mail copies are encrypted in an on-device SQLCipher store; its key is protected by the operating-system key store. These external accounts’ OAuth tokens and fetched mail are not transmitted to the us2us Mail server. Messages you send go through your provider to your chosen recipients. Local encryption does not hide mail from its provider.
us2us Mail’s use and transfer of Google user data adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google data or use it for advertising, marketing profiles or training general-purpose machine learning models.
Removing an account in the app removes its local account data; it does not delete mail at the provider. You can revoke Google access using the app’s provider-revocation action or your Google account’s app permissions. Disconnecting locally alone does not revoke the remote grant.
Remote message content
Message HTML opens in a protected view without JavaScript. Remote images do not load automatically. Permitted images are fetched directly from your device only after you accept the warning and choose to load them for that message.
The remote server can see your connection IP address and any unique identifier in the image URL, which can reveal that you opened the message. Opening a link in your browser also connects to its destination. Signatures contain no tracking images.
Contact suggestions
Senders in the message lists you load are saved only in that account’s encrypted local storage, up to 10,000 contacts per account. They appear as recipient suggestions and are not copied to your system address book or other accounts. These entries do not verify a sender’s identity.
App version checks
While the desktop app is in the foreground and mail is unlocked, opening or returning to the app automatically checks public version information on Amazon S3 at most once an hour. You can also check manually in settings.
The request sends no account address, password, token or mail content. Amazon can see the connection IP address and a generic app client header. Notices appear only inside the app; there are no system notifications. You start downloads and installation yourself.
Contact
Contact us at us2usmail-support@googlegroups.com. Don’t include passwords, recovery secrets or private email content. This page is not a regulatory compliance certificate or independent security audit.