# Plunk privacy rating

Open-source email platform for transactional email, campaigns and automations, hosted in the EU or self-hosted with Docker.

## Summary

Plunk is not graded yet: 50% of its criteria have evidence, and 60% is needed. It meets 4 of 12 criteria: open source, no trackers or telemetry, no ads or data sales and EU data location. It partly meets TLS configuration. It does not meet security headers. Still needing evidence: independent audit, transparency report, tells users about requests, message content deleted after delivery, open and click tracking off by default and encrypted delivery can be enforced. Automated tests: SSL Labs grade B and Mozilla HTTP Observatory grade D.

- Website: https://www.useplunk.com
- Source code: https://github.com/useplunk/plunk
- License: AGPL-3.0
- Home page trackers: none found
- Category: [Email sending services](https://privacyratings.com/email-sending/)
- Grade: Not graded (50% evidence)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | AGPL-3.0. | https://github.com/useplunk/plunk/blob/main/LICENSE |
| No trackers or telemetry | Yes | The privacy policy states no Google Analytics, Meta pixel or other third-party tracking scripts are used, with only a login cookie. | https://www.useplunk.com/privacy |
| No ads or data sales | Yes | Funded by per-email pricing. The privacy policy states data is never sold. | https://www.useplunk.com/privacy |
| Independent audit | Unknown |  |  |
| Transparency report | Unknown |  |  |
| Tells users about requests | Unknown |  |  |
| TLS configuration | Partial | Grade B | https://www.ssllabs.com/ssltest/analyze.html?d=useplunk.com&hideResults=on |
| Security headers | No | Grade D (30/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=useplunk.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| Message content deleted after delivery | Unknown |  |  |
| Open and click tracking off by default | Unknown |  |  |
| Encrypted delivery can be enforced | Unknown |  |  |
| EU data location | Yes | The hosted service stores data with Hetzner in Germany and sends mail through Amazon SES. Self-hosting is also supported. | https://www.useplunk.com/privacy |

Source: https://privacyratings.com/email-sending/plunk/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-sending/plunk.md