Skip to main content
Maski exists to keep your real address private. This page states plainly how that works and where the limits are. For the binding terms, see the privacy policy and security page.

​
What is encrypted

Personal fields are encrypted at rest with AES-256-GCM before they are stored:
  • your account email and any secondary email,
  • each alias destination address,
  • sender addresses,
  • message subjects and bodies.
The encryption keys live only in the running application’s memory, never in the database. A stolen database dump on its own cannot be decrypted. To look these values up without decrypting them, Maski stores a separate keyed hash (a blind index) for the fields it needs to search on, such as your account email and alias destinations. The plaintext itself stays unsearchable.

​
What is not encrypted

A few fields you set for your own convenience are stored in plain text because they are never used as search keys and hold nothing about anyone else: your display name and your chosen default destination label. Maski does not claim full-disk or volume encryption on its servers. The protection described here is field-level encryption of the data above, not disk encryption. We would rather be exact than reassuring.

​
What is logged

Logs are filtered before they are written. Maski does not log email addresses, message contents, sign-in tokens, or authorization headers. These are redacted at the logging layer.

​
What an operator can see

The internal admin tools are masked by design. An operator sees a masked email and an opaque hash, not your address, and never sees message subjects, bodies, or attachments in plaintext. There is one deliberate exception. An operator can reveal a single user’s plaintext sign-in email on demand, for example to resolve a support or abuse case. That reveal is fail-closed on its audit trail: it only succeeds after an audit record is written saying that it happened and who did it. The audit record never stores the address itself, and the action requires a deliberate click, never a hover. Message contents are never revealable.

​
Retention

  • Mail held in a control-mode inbox expires automatically, after 7 days by default, adjustable from 1 to 30.
  • Anonymous-mode mail is never retained. It is forwarded and forgotten.
  • Retiring an alias stops forwarding immediately, with a 30-day grace period before the address is permanently gone.
  • Deleting your account removes your data.
  • You can export your account data as JSON at any time from your account page.