# Hide My Email privacy rating

Apple iCloud+ feature that creates random email addresses which forward to a personal inbox. Also used by Sign in with Apple.

## Summary

Hide My Email scores 44 out of 100 (grade D) on the email forwarding and aliases criteria. It meets 7 of 16 criteria: no trackers or telemetry, no ads or data sales, transparency report, tells users about requests, TLS configuration, security headers and no stored mail. It does not meet open source, independent audit, end-to-end encryption, open protocols, custom domains, sign up without personal data, mail transport security, Sender Rewriting Scheme and ARC sealing. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.

- Website: https://support.apple.com/en-us/102548
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Home page trackers: none found
- Category: [Email forwarding and aliases](https://privacyratings.com/email-forwarding/)
- Also rated: [iCloud Mail](https://privacyratings.com/email-providers/icloud-mail/) (Email providers), [Apple Mail](https://privacyratings.com/email-clients/apple-mail/) (Email clients), [Safari](https://privacyratings.com/browsers/safari/) (Browsers), [Apple App Store](https://privacyratings.com/app-stores/apple-app-store/) (App stores), [Apple Passwords](https://privacyratings.com/password-managers/apple-passwords/) (Password managers), [FileVault](https://privacyratings.com/file-encryption/filevault/) (File encryption), [iMessage](https://privacyratings.com/messengers/imessage/) (Messengers), [FaceTime](https://privacyratings.com/video-calls/facetime/) (Video calls), [iOS](https://privacyratings.com/mobile-operating-systems/ios/) (Mobile operating systems), [macOS](https://privacyratings.com/desktop-operating-systems/macos/) (Desktop operating systems), [Spotlight](https://privacyratings.com/launchers/spotlight/) (App launchers), [Apple Notes](https://privacyratings.com/notes/apple-notes/) (Notes), [Apple Journal](https://privacyratings.com/journaling/apple-journal/) (Journaling apps), [Apple iWork](https://privacyratings.com/office-suites/apple-iwork/) (Office suites), [QuickTime Player](https://privacyratings.com/screen-recording/quicktime-player/) (Screenshots and screen recording), [Apple Books](https://privacyratings.com/ebook-readers/apple-books/) (Ebook readers), [Apple Dictation](https://privacyratings.com/speech-to-text/apple-dictation/) (Dictation and transcription), [iCloud Drive](https://privacyratings.com/cloud-storage/icloud-drive/) (Encrypted cloud storage), [Apple Maps](https://privacyratings.com/maps/apple-maps/) (Maps and navigation), [SwiftUI](https://privacyratings.com/app-frameworks/swiftui/) (Cross-platform app frameworks), [Apple Home](https://privacyratings.com/smart-home/apple-home/) (Smart home), [Apple Watch](https://privacyratings.com/wearables/apple-watch/) (Wearables and health), [Apple Health Cycle Tracking](https://privacyratings.com/period-trackers/apple-health-cycle-tracking/) (Period trackers), [Apple Music](https://privacyratings.com/music-streaming/apple-music/) (Music streaming), [iCloud Photos](https://privacyratings.com/photo-management/icloud-photos/) (Photo management)
- Grade: D (44/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | Yes | Analytics are only shared with Apple with consent, and iCloud.com loads no third-party trackers. | https://www.apple.com/legal/privacy/data/en/device-analytics/ |
| No ads or data sales | Yes | Included with the paid iCloud+ subscription. Apple states that it does not sell personal data. | https://www.apple.com/legal/privacy/en-ww/ |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | Yes | Apple publishes counts of government and private party requests twice a year. | https://www.apple.com/legal/transparency/ |
| Tells users about requests | Yes | Apple notifies customers when their account information is sought, unless prohibited by law or in emergencies. | https://www.apple.com/legal/privacy/law-enforcement-guidelines-us.pdf |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=www.icloud.com&hideResults=on |
| Security headers | Yes | Grade A+ (130/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.icloud.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encryption | No | Not supported. Forwarded mail is not encrypted end to end. |  |
| No stored mail | Yes | Messages are deleted from the relay servers after delivery, usually within seconds, and their content is not processed beyond spam filtering. | https://support.apple.com/en-us/102548 |
| Open protocols | No | No IMAP or SMTP access for aliases. Mail is forwarded to an existing inbox. |  |
| Custom domains | No | Not supported for Hide My Email addresses. Custom email domains are a separate iCloud Mail feature. |  |
| Sign up without personal data | No | An Apple Account is required, and creating one asks for a phone number and an email address. | https://support.apple.com/en-us/108647 |
| Email security standards | Not tested yet | Not tested yet. |  |
| Mail transport security | No | Passes: SPF, DMARC quarantine. Missing: MTA-STS missing, TLS-RPT, DNSSEC, DANE none. |  |
| Sender Rewriting Scheme | No | No published documentation on SRS for forwarded mail. |  |
| ARC sealing | No | No published documentation on ARC signing or validation. |  |

Source: https://privacyratings.com/email-forwarding/hide-my-email/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-forwarding/hide-my-email.md