Privacy Policy

1. Introduction

FormidMail Ltd. ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our encrypted email service ("Service").

Our company is incorporated under the laws of the Cayman Islands, and our servers are located exclusively in the Cayman Islands. This means your data is protected under Cayman Islands law, which respects privacy and does not participate in invasive surveillance programs.

2. Our Privacy Principles

We are fundamentally committed to:

• Zero-Access Architecture: Your emails are encrypted with your keys, which we do not have access to
• Minimal Data Collection: We collect only what is necessary to provide the Service
• No Tracking: We do not track your browsing activity or log your IP address
• No Third-Party Sharing: We never sell or share your data with advertisers or data brokers
• Strong Jurisdiction: Protected by Cayman Islands privacy laws

3. Information We Collect

3.1 Account Information

When you create an account, we may collect:

• Email address (optional - you can use anonymous addresses)
• Payment information (processed by third-party payment processors)
• Account recovery information (if you choose to provide it)

3.2 Email Content

All email content is end-to-end encrypted. This means:

• Email messages are encrypted on your device before being sent to our servers
• Only you and your intended recipients can decrypt and read the messages
• We cannot access the content of your emails
• Even if compelled by legal authority, we cannot provide email content as we cannot decrypt it

3.3 Metadata

We collect minimal metadata necessary for email delivery:

• Sender and recipient email addresses (encrypted at rest)
• Email subject lines (encrypted at rest)
• Timestamp of when emails are sent and received
• We do NOT log IP addresses or device information

4. How We Use Your Information

We use the information we collect only for:

• Providing and maintaining the Service
• Processing your payments and managing your subscription
• Communicating with you about the Service
• Improving and optimizing the Service
• Preventing fraud and abuse
• Complying with legal obligations (to the extent required under Cayman Islands law)

5. Data Storage and Security

5.1 Data Location

All user data is stored on servers located in the Cayman Islands. We do not use servers in jurisdictions with invasive surveillance laws or mandatory data retention requirements.

5.2 Encryption

We implement multiple layers of encryption:

• End-to-End Encryption: Email content is encrypted with your public key
• At-Rest Encryption: All data on our servers is encrypted
• In-Transit Encryption: All connections use TLS 1.3 or higher
• Zero-Knowledge Architecture: Encryption keys are generated on your device

5.3 Security Measures

We implement industry-standard security measures including:

• Regular security audits and penetration testing
• Secure key management practices
• Two-factor authentication (2FA) support
• Automated security monitoring and alerting
• Strict access controls for our infrastructure

6. Data Sharing and Disclosure

6.1 No Third-Party Sharing

We do not sell, rent, or share your personal information with third parties for their marketing purposes. We will never share your email content as we cannot access it due to end-to-end encryption.

6.2 Service Providers

We use trusted third-party service providers for:

• Payment processing (encrypted and tokenized)
• Infrastructure hosting (Cayman Islands only)
• Customer support tools (with minimal data access)

These providers are contractually bound to protect your data and use it only for specified purposes.

6.3 Legal Requests

We will only disclose information in response to valid legal process under Cayman Islands law. Due to our zero-access encryption, we cannot provide email content even if legally compelled. We would only be able to provide limited metadata, and we will challenge overly broad or unjustified requests.

7. Your Rights and Choices

7.1 Access and Control

You have the right to:

• Access your account information at any time
• Export your email data
• Delete your account and associated data
• Opt out of promotional communications

7.2 Data Retention

We retain your data only as long as necessary to provide the Service:

• Active accounts: Data retained for the duration of your subscription
• Cancelled accounts: Data retained for 90 days to allow reactivation
• Deleted accounts: All data permanently deleted within 30 days
• You can request immediate deletion at any time

8. Cookies and Tracking

We use minimal cookies necessary for the Service to function:

• Authentication cookies (to keep you logged in)
• Security cookies (to prevent fraud)
• Preference cookies (to remember your settings)

We do NOT use advertising cookies, analytics cookies, or third-party tracking scripts. We do not track your browsing behavior across websites.

9. International Data Transfers

As all our servers are located in the Cayman Islands, there are no international data transfers. Your data remains within Cayman Islands jurisdiction and is protected by local privacy laws.

10. Children's Privacy

The Service is not intended for individuals under 16 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through a notice in the Service. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: