# PrivateMail privacy rating

Paid email service from PrivateMail LLC in the United States, made by the team behind TorGuard VPN, with OpenPGP encryption in the browser and apps and encrypted file storage.

## Summary

PrivateMail scores 19 out of 100 (grade F) on the email providers criteria. It meets 1 of 18 criteria: TLS configuration. It partly meets no ads or data sales, modern web standards, end-to-end encryption, open protocols and custom domains. It does not meet open source, no trackers or telemetry, independent audit, transparency report, tells users about requests, security headers, encrypted mailbox storage, sign up without personal data, email security standards, mail transport security, Sender Rewriting Scheme and ARC sealing. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A, Mozilla HTTP Observatory grade D, Internet.nl website score 75% and Internet.nl email score 69%.

- Website: https://privatemail.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web, Android, Windows, macOS, Linux
- Home page trackers: Google Fonts (not scored), LiveChat
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Grade: F (19/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | No source code is published. The site says it uses open-source encryption libraries. |  |
| No trackers or telemetry | No | The website loads the LiveChat widget, and the privacy policy describes Google Analytics and cookies from third-party analytics providers. | https://privatemail.com/privacy.php |
| No ads or data sales | Partial | Funded by paid plans, with no ads in the mail service and no sale of personal data. The privacy policy allows interest-based advertising of Private-Mail on other websites. | https://privatemail.com/privacy.php |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | The privacy policy states that personal information is disclosed without notice when required by law or legal process. | https://privatemail.com/privacy.php |
| TLS configuration | Yes | Grade A | https://www.ssllabs.com/ssltest/analyze.html?d=privatemail.com&hideResults=on |
| Security headers | No | Grade D (30/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=privatemail.com |
| Modern web standards | Partial | Score 75% | https://batch.internet.nl/site/privatemail.com/22660000/ |
| End-to-end encryption | Partial | OpenPGP is built into the webmail and apps, with keys generated and kept on the device. It must be turned on and recipients' public keys imported, so it is not on by default. | https://privatemail.com/openpgp-encryption.php |
| Encrypted mailbox storage | No | Only messages encrypted with OpenPGP are documented as unreadable on the server. Encryption of other stored mail is not documented. | https://privatemail.com/openpgp-encryption.php |
| Open protocols | Partial | POP3, IMAP and SMTP are listed only on the Business plans. The Standard and Pro plans are webmail and app only. | https://privatemail.com/business.php |
| Custom domains | Partial | Only on the Business plans. | https://privatemail.com/business.php |
| Sign up without personal data | No | Paying with cryptocurrency needs no name or billing address, but an existing email address is required. | https://privatemail.com/anonymous-email.php |
| Email security standards | No | Score 69% | https://batch.internet.nl/mail/privatemail.com/22855405/ |
| IMAP support | Not tested yet | Could not test: No server found (set a host in the rating file or publish RFC 6186 SRV records) |  |
| POP3 support | Not tested yet | Could not test: No server found (set a host in the rating file or publish RFC 6186 SRV records) |  |
| SMTP submission | Not tested yet | Could not test: No server found (set a host in the rating file or publish RFC 6186 SRV records) |  |
| Mail transport security | No | Passes: SPF, DMARC reject. Missing: MTA-STS missing, TLS-RPT, DNSSEC, DANE none. |  |
| Sender Rewriting Scheme | No | No published documentation on SRS for forwarded mail. |  |
| ARC sealing | No | No published documentation on ARC signing or validation. |  |

Source: https://privacyratings.com/email-providers/privatemail/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/privatemail.md