Privacy Policy

HiddenMX collects less data than most account-based email services, but it does not collect nothing. We do not ask for your real name, phone number, recovery email, or identity documents when you register. We still process the information needed to operate an email service.

Some of that information can identify you, especially if you use the clearnet website, contact support from another email address, pay from a traceable wallet, or exchange mail with another provider.

Who is responsible

HiddenMX operates hiddenmx.org and its Tor onion service. Where privacy law uses the term data controller, HiddenMX is the controller of the information described in this policy.

Privacy questions and requests can be sent to support@hiddenmx.org or submitted through our contact page.

Registration and account data

Registration requires a username, password, and CAPTCHA answer. We create a hiddenmx.org email address from the username you choose.

We store:

• Your HiddenMX address and username
• One-way hashes of your password and recovery key
• Account creation and last login times
• Your plan, upgrade history, mailbox quota, and daily recipient count
• Your inactivity deletion setting
• Administrative status, if applicable

We do not store the recovery key shown during registration. We store only a hash used to check it later.

Your account password is stored as a one-way hash in the account database. While you are signed in, the password is also held temporarily in your server-side session so the webmail application can authenticate to the local mail server. It is not placed in the session cookie.

Email and mailbox data

We store the messages in your mailbox, including headers, message bodies, attachments, folders, drafts, and message state.

HiddenMX mail is not end-to-end encrypted by default. Administrators with access to the mail server can technically read stored messages. When mail is exchanged with another provider, that provider may also be able to read the message.

We may inspect stored message headers to investigate abuse reports or troubleshoot delivery and security problems. Headers include the subject, sender and recipient addresses, delivery route, and authentication results. We do not read stored message bodies or attachments for ordinary abuse investigations. Those may be accessed when a valid legal demand requires it.

Incoming senders and mail servers provide us with sender addresses, recipient addresses, message headers, connection information, and message content. Outgoing mail gives similar information to the recipient and their mail provider.

Mail is scanned locally for spam. Suspected spam is placed in the Spam folder rather than deleted because of its spam score.

Remote images are blocked by default. If you choose to load them, your browser contacts the remote image server. That server may receive your IP address, browser information, and the time the image was loaded.

Website connections and security records

When you use the clearnet website, the proxy records connection information such as your IP address, request time, request method, route, response status, browser user agent, and referrer.

Query strings will not be written to access logs. Secret ticket and payment tokens will be removed from logged routes.

Mail and security logs may include connection IPs, HiddenMX addresses, sender and recipient addresses, delivery status, TLS information, queue identifiers, Message-IDs, login results, service errors, and actions taken by abuse controls.

When an administrator requests message headers, we log the administrator ID, delivery record ID, and lookup result. We do not copy the headers into that log. These access records are kept for up to 14 days.

Edge rate limits hold a clearnet source address or Tor circuit label only in volatile server memory. The application converts network and account identifiers to keyed hashes before storing counters that expire. These controls are not used for advertising or user profiles, and Tor circuit labels are not written to access logs.

The onion web server does not keep access logs. Using the onion service does not remove account records, mailbox data, payment records, or mail delivery metadata.

Cookies and sessions

HiddenMX uses one required session cookie named ci_session. It contains a random session identifier, not your password or mailbox contents.

The cookie is host-only, HTTP-only, and uses SameSite protection. Anonymous form sessions expire after 15 minutes even if they remain active. Signed-in sessions expire after two hours without activity. CAPTCHA challenges expire after ten minutes.

Anonymous visits to ordinary public pages do not start a session. Login, registration, password recovery, contact, and authenticated pages require one.

We do not use advertising cookies, analytics cookies, browser fingerprinting, or third-party tracking scripts. Because the only cookie is required to operate the service and protect forms, no advertising or analytics consent banner is used.

Cryptocurrency payments

When you create an invoice, we store the plan, currency, quoted amount, deposit address, address index, payment status, detected amount, confirmation state, and relevant timestamps.

Cryptocurrency does not guarantee anonymity. Blockchain records are outside our control and can be permanent. What is publicly visible depends on the currency and wallet you use.

Bitcoin, Litecoin, and Monero payments are checked using local nodes and wallets. Ethereum and USDT address balances are checked through dRPC and PublicNode. Those providers receive the deposit address being checked, the request time, and the IP address of our server.

CoinGecko provides exchange rates. It receives a server-side request for current coin prices but does not receive your HiddenMX account or invoice details.

Expired invoice addresses remain checked so a late payment is not silently lost. Invoice records remain attached to the account until the account is deleted.

Support and abuse reports

Support tickets store the email address provided, department, subject, messages, replies, status, and timestamps.

Guest tickets use a secret link. Anyone with that link can read and reply to the ticket, so it must be kept private.

Open tickets remain available while they are being handled. Closed tickets are deleted after 30 days. Account deletion also removes tickets linked to that account or address.

A record may be kept longer if it is required for an active abuse or security investigation or by law. It will be removed when that need ends.

How we use information

We process information to:

• Create and operate accounts and mailboxes
• Deliver, store, display, and send email
• Authenticate users and recover accounts
• Process cryptocurrency invoices and activate Premium
• Enforce storage and recipient limits
• Detect spam, abuse, unauthorized access, and service failures
• Answer support and abuse reports
• Maintain the reliability and security of the service
• Comply with legal obligations

Where applicable, the legal bases are performance of our agreement with you, our legitimate interest in operating and protecting the service, and compliance with legal obligations.

Automated rules are used for spam placement, sending limits, mailbox quotas, payment confirmation, the 40-day account lock, and user-selected inactivity deletion. We do not use automated profiling for advertising.

Who can receive information

We do not sell or rent personal information. We do not share it for targeted or cross-context behavioral advertising.

Information may be received by:

• Our server hosting and network providers when needed to operate the infrastructure
• The recipients of messages and their email providers
• Public cryptocurrency networks and the payment services described above
• Service administrators who need access for maintenance, support, security, or abuse handling
• Authorities when we are legally required to respond to a valid request

Email and internet services cross borders. Information may be processed in countries other than the one where you live, and local privacy protections may differ.

Retention

Our standard retention periods are:

• Website access logs: up to 7 days
• Mail, security, and system logs: up to 14 days
• Accepted-recipient quota events: 7 days
• Anonymous form sessions: 15 minutes
• Signed-in sessions: 2 hours without activity
• CAPTCHA challenges: 10 minutes
• Closed support tickets: 30 days
• Account and invoice records: while the account exists
• Mailbox contents: until you permanently delete them or delete the account

Specific records may be isolated and kept longer for an active security incident, abuse investigation, or legal requirement. They are removed when that need ends.

A locked account is not a deleted account. Accounts locked after the initial 40-day period continue to hold their data until the user upgrades, deletes the account, or enables inactivity deletion.

Account and message deletion

Deleting a message moves it to Trash unless it is already there. Emptying Trash or deleting a message from Trash removes it from the mailbox.

You can permanently delete your account from Settings. This removes the account, invoices, and linked support tickets from the database. The mailbox is queued for filesystem removal and is normally removed within minutes.

Operational logs remain until their normal retention period ends. Messages already delivered to another person or provider cannot be deleted from their systems. Public blockchain records cannot be deleted.

You can also choose automatic account deletion after 3, 6, 12, or 24 months without a login.

Your choices and rights

You can view your mail and account settings, change your password, delete messages, empty Trash, enable inactivity deletion, or delete the entire account.

Depending on where you live, you may also have rights to request access, correction, deletion, restriction, objection, or a portable copy of personal information.

To protect account data, we may require a signed-in session, recovery key, ticket token, payment token, or other evidence that you control the account or record. We cannot provide account data to someone whose control we cannot verify.

Requests can be sent to support@hiddenmx.org. You may also complain to the data protection authority where you live.

Tor and the limits of email privacy

The HiddenMX onion service protects the web connection through Tor and prevents the onion web server from seeing your normal source IP address. Tor onion traffic is authenticated and encrypted between Tor Browser and the onion service.

Tor does not make ordinary email end-to-end encrypted. Mail sent to another domain leaves the HiddenMX onion service and is delivered through normal email systems. HiddenMX and the receiving provider may still process the message and its metadata.

Do not assume that a HiddenMX account, Tor, or cryptocurrency makes you untraceable.

Age requirement

HiddenMX is for people who are at least 18 years old. We do not ask for or verify a date of birth.

If you believe someone under 18 has provided information through HiddenMX, contact support@hiddenmx.org.

Changes to this policy

We will update this page and its date when the policy changes. If a change materially affects existing accounts, we will also provide an account notice or email when practical.

We will update this policy before introducing advertising, analytics, third-party tracking scripts, or a materially different use of account data.