privacy policy

updated 4 October 2026

operator and contact

Ilja Gwawl operates Vael. Send privacy or account-data questions to contact@vael.email.

account and security data

We store your chosen addresses, account identity, credential verifiers, sessions, app-credential settings, optional two-factor authentication, entitlements, preferences and activity needed to operate the account. Your account key is verified rather than stored as readable text. No recovery email or personal name is required to register.

Sign-in and abuse protection process connection addresses transiently. Short-lived pseudonymous counters expire and are not persisted as a browser identity. Vael does not use advertising analytics, browser fingerprinting or session replay. Infrastructure providers still process connection information needed to supply their services.

mail and encrypted storage

Mail bodies, attachments and headers are stored in the mail service. Search and organization use related metadata. Disks and rolling backups are encrypted, and public connections use TLS. The running server and its operator can decrypt stored mail; this is not end-to-end or zero-access encryption.

Incoming messages can contain tracking content and connection metadata added by other senders. Remote images are blocked by default. If you approve them, Vael fetches them; the remote server can observe those requests. Any local draft recovery you enable also stores draft data in your browser.

payments

OxaPay processes payment assets, networks, addresses and blockchain transactions. Vael stores order identifiers, amounts, payment status and entitlement records for billing and reconciliation. Your secret account key is not sent to OxaPay. Public blockchains can expose transaction information independently of Vael.

service providers

Hetzner supplies the server infrastructure. Cloudflare supplies authoritative DNS for Vael’s domains. The currently configured website and mail hostnames use DNS-only records, so their traffic connects directly to Vael’s server. OxaPay supplies cryptocurrency payment processing. Each provider also processes data under its own policies.

retention, deletion and backups

Mail and account settings remain while your account is active, subject to your deletion and inactivity settings. Security access is revoked when an account is deleted. Primary and random address retirement remains permanent. Minimal deletion records are retained to prevent older backups from reactivating a deleted identity.

Encrypted backups use a rolling seven-day retention window with capacity limits. Deleted content may remain in existing backups until their retention and pruning finish; deletion is not an immediate secure erase of historical storage. Billing, security and deletion metadata have operational retention separate from the live mailbox.

your controls

You can export account data and mail, revoke sessions and app credentials, change image permissions, choose an inactivity policy, or delete your account. Contact us to ask about your data or rights available under applicable law.