# Purelymail privacy rating

Low-cost email hosting from the United States with custom domains, standard protocols and mail stored encrypted with the user's password.

## Summary

Purelymail scores 55 out of 100 (grade D) on the email providers criteria. It meets 8 of 19 criteria: no trackers or telemetry, no ads or data sales, TLS configuration, encrypted mailbox storage, open protocols, custom domains, sign up without personal data and IMAP support. It partly meets security headers, POP3 support, SMTP submission and mail transport security. It does not meet open source, independent audit, transparency report, tells users about requests, end-to-end encryption, Sender Rewriting Scheme and ARC sealing. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade B+.

- Website: https://purelymail.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Home page trackers: none found
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Grade: D (55/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | Yes | The privacy policy lists only diagnostic and billing data, and the website loads no third-party trackers. | https://purelymail.com/privacy |
| No ads or data sales | Yes | Funded by paid plans. Purelymail states it will never sell or monetize user data. | https://purelymail.com/docs/security |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A | https://www.ssllabs.com/ssltest/analyze.html?d=purelymail.com&hideResults=on |
| Security headers | Partial | Grade B+ (80/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=purelymail.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encryption | No | Not supported. Purelymail suggests S/MIME in the mail client. | https://purelymail.com/docs/security |
| Encrypted mailbox storage | Yes | Mail is encrypted with a key derived from the user's password when password reset is turned off. Search indexes may hold partial content. | https://purelymail.com/docs/security |
| Open protocols | Yes | IMAP, POP3 and SMTP work with any client. | https://purelymail.com/docs/setup/technical |
| Custom domains | Yes | Unlimited custom domains at no extra charge. | https://purelymail.com/docs/features |
| Sign up without personal data | Yes | Recovery email and phone are optional for paid sign-ups. Only the free trial needs an SMS-capable phone. | https://purelymail.com/signup/ |
| Email security standards | Not tested yet | Not tested yet. |  |
| IMAP support | Yes | imap.purelymail.com:993 (implicit TLS). IMAP4rev1 advertised with IDLE. |  |
| POP3 support | Partial | pop3.purelymail.com:995 (implicit TLS). CAPA: PIPELINING, USER, STLS. |  |
| SMTP submission | Partial | smtp.purelymail.com:465 (implicit TLS). Missing: SMTPUTF8. |  |
| Mail transport security | Partial | Passes: SPF, DMARC reject, MTA-STS enforce, TLS-RPT. Missing: DNSSEC, DANE none. |  |
| Sender Rewriting Scheme | No | No published documentation on SRS for forwarded mail. |  |
| ARC sealing | No | No published documentation on ARC signing or validation. |  |

Source: https://privacyratings.com/email-providers/purelymail/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/purelymail.md