> ## Documentation Index
> Fetch the complete documentation index at: https://docs.maski.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy overview

> What Maski encrypts, what it logs, and what an operator can and cannot see.

Maski exists to keep your real address private. This page states plainly how that
works and where the limits are. For the binding terms, see the
[privacy policy](https://maski.dev/privacy) and [security page](https://maski.dev/security).

## What is encrypted

Personal fields are encrypted at rest with AES-256-GCM before they are stored:

* your account email and any secondary email,
* each alias destination address,
* sender addresses,
* message subjects and bodies.

The encryption keys live only in the running application's memory, never in the
database. A stolen database dump on its own cannot be decrypted.

To look these values up without decrypting them, Maski stores a separate keyed hash
(a blind index) for the fields it needs to search on, such as your account email
and alias destinations. The plaintext itself stays unsearchable.

## What is not encrypted

A few fields you set for your own convenience are stored in plain text because they
are never used as search keys and hold nothing about anyone else: your display name
and your chosen default destination label.

Maski does **not** claim full-disk or volume encryption on its servers. The
protection described here is field-level encryption of the data above, not disk
encryption. We would rather be exact than reassuring.

## What is logged

Logs are filtered before they are written. Maski does not log email addresses,
message contents, sign-in tokens, or authorization headers. These are redacted at
the logging layer.

## What an operator can see

The internal admin tools are masked by design. An operator sees a masked email and
an opaque hash, not your address, and never sees message subjects, bodies, or
attachments in plaintext.

There is one deliberate exception. An operator can reveal a single user's plaintext
sign-in email on demand, for example to resolve a support or abuse case. That reveal
is fail-closed on its audit trail: it only succeeds after an audit record is written
saying that it happened and who did it. The audit record never stores the address
itself, and the action requires a deliberate click, never a hover. Message contents
are never revealable.

## Retention

* Mail held in a control-mode inbox expires automatically, after 7 days by default,
  adjustable from 1 to 30.
* Anonymous-mode mail is never retained. It is forwarded and forgotten.
* Retiring an alias stops forwarding immediately, with a 30-day grace period before
  the address is permanently gone.
* Deleting your account removes your data.
* You can export your account data as JSON at any time from your account page.