Version 1.1, effective 13 October 2026.
Privacy policy
Freehold Mail is an email service. You use it to store and send some of the most private things you have, so this page says exactly what we keep, why, for how long, and who else is involved. In short: we don't read your mail, we don't show ads, we don't track you, and you can take everything with you at any time.
Who is responsible
Freehold Mail is run by Thomas van Otterloo, Libanonstraat 12, Delft, the Netherlands ("we"). We are the controller for the personal data described here.
Questions or requests about your data: privacy@freeholdmail.com. Abuse reports: abuse@freeholdmail.com.
If you use Freehold Mail for a business and the mail you store contains other people's personal data, you are the controller for that data and we process it for you; see our data processing agreement.
What we store, and why
| Data | Why | Legal basis (GDPR art. 6) | How long |
|---|---|---|---|
| Your account: contact email address (if Freehold Mail is your first email address, this is your Freehold address), your name if you add one (shown to the people you email), account status, dates | To run your account and contact you about it | Contract (b) | Until your account is closed and your data is deleted (see "Leaving") |
| Invitation requests from the website: your name, email address and anything you wrote in the note; and, if you came from one of our ads or links, its short label (like "gads-private"), which is part of the link itself, not a cookie | To send you an invitation; the label only to count which of our ads bring requests | Steps at your request before a contract (b); the label: legitimate interest (f) | Deleted six months after the request |
| Your mail: messages, folders, contacts, calendars, filter rules | That is the service | Contract (b) | Until you delete it (Trash and Junk are emptied after 30 days), or 30 days after you close your account |
| Your addresses, their routes (local, forward target, relay server) and your domains | To deliver your mail where you want it | Contract (b) | Addresses are kept (disabled) after closing so they are never given to someone else; forwards you chose to keep stay active |
| DNS check results for your domains | To show you what is set up correctly | Contract (b) | The most recent checks only |
| Sign-in data: passkey public keys, session and API tokens (stored only as hashes), the browser and system name of each session (like "Firefox on Linux"), and emailed sign-in links (stored only as hashes) | To let only you in, and show you where you're signed in | Contract (b) | Sessions expire after 30 days; sign-in links after 15 minutes and are deleted after 7 days; passkeys and API tokens until you remove them or close your account |
| If you choose them: your password (stored only as a slow, salted Argon2id hash, never readable), the secret of your authenticator app (stored encrypted), your recovery codes and account recovery key (stored only as hashes), and a count of recent failed sign-ins | To let only you in, and to stop people guessing your password | Contract (b) | Until you remove them or close your account; failed sign-in counts are reset when you sign in, and the lock after too many failures lasts 15 minutes |
| Delivery logs: sender, recipient, server addresses, times, delivery result (never message content) | To deliver mail, investigate delivery problems and abuse | Legitimate interest (f) | 30 days |
| Web server logs: IP address, page, browser type, time | Security and fixing problems | Legitimate interest (f) | 30 days |
| Sending statistics: per day, how many messages you sent, how many bounced, spam complaints | To protect our shared mail servers from spam (see "Automated decisions") | Legitimate interest (f) | Up to 1 year |
| Audit log: account and route changes, administrative actions, who did them and when | Security and accountability | Legitimate interest (f) | Up to 2 years |
| Export archives you request | So you can download your data | Contract (b) | 7 days, encrypted |
| Backups of all of the above | To recover from failures | Legitimate interest (f) | Up to 5 weeks (7 daily + 4 weekly copies) |
We do not collect analytics, use tracking pixels or third-party scripts, sell or share data for advertising, or build profiles. Our websites load nothing from other companies.
Your mail content
Incoming mail is checked automatically by our own mail server for spam and malware (sender authentication, content scoring, block lists). This happens on our server only, and only to protect you and the service. We never use your mail for advertising or anything else.
Nobody at Freehold Mail reads your mail. If we ever need to look into a mailbox (only when you ask for support that requires it, or to investigate a serious security or abuse incident), we write the reason down in our audit log before doing so.
Your mail is stored on an encrypted disk, and all connections to and between our servers are encrypted.
Who else is involved
We use a small number of providers (sub-processors). Each only gets what it needs:
| Provider | What for | Where | What they can see |
|---|---|---|---|
| Hetzner Online GmbH, Gunzenhausen, Germany | Our servers and data centre | Germany | Encrypted disks; they have no access to your data in normal operation |
| Cloudflare, Inc. | DNS for freeholdmail.com, and passing through the small public files mail apps use for automatic setup and for mail security policies | Global network | DNS lookups; the email address a mail app sends when it asks for setup instructions. Never your mail or your sign-in. |
| Internet Security Research Group (Let's Encrypt) | Website and mail server certificates | United States | Our domain names only, no personal data |
Cloudflare is a US company. Transfers are covered by the EU-US Data Privacy Framework, under which Cloudflare is certified, and by the Standard Contractual Clauses in Cloudflare's data processing terms.
Mail you send obviously goes to the recipients' mail providers, and mail you forward goes to the forward address you chose.
Automated decisions
To keep our shared mail servers off spam block lists, sending from an account is paused automatically when, within one day, more than 5% of its messages bounce, more than 0.3% are reported as spam (at least 50 messages), or it repeatedly hits sending limits. Receiving mail, reading it and exporting keep working. We tell you by email, and a person reviews the account if you ask: write to abuse@freeholdmail.com. You can contest the decision.
Your rights
You can, at any time:
- see and download all your data: the export in your account settings gives you everything in standard formats (mbox or Maildir, vCard, Sieve);
- correct your data in your account settings, or by asking us;
- delete your data: use "Leave Freehold Mail" in your account, or ask us;
- object to processing based on legitimate interest, and ask us to restrict processing;
- complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Write to privacy@freeholdmail.com; we answer within one month.
Leaving
When you leave, we first give you a complete export. After you confirm you have it, your account is closed and your mailbox data is deleted 30 days later (we remind you a week before). It disappears from backups within a further 5 weeks. Addresses on freeholdmail.com that you set to forward keep forwarding, which means we keep that address and its forward target.
Cookies
The website (freeholdmail.com) sets no cookies at all. The account app (app.freeholdmail.com) uses two, both strictly necessary: one keeps you signed in (up to 30 days, until you sign out), the other protects its forms against forgery (until you close the browser). Neither is used for anything else, so no consent banner is needed.
Children
Freehold Mail is not meant for anyone under 16.
Changes
We'll email you at least 30 days before a change that affects you, and the version and date of this policy are shown below.
Version 1.1, effective 13 October 2026.