Tortu Mail

Privacy Policy

Last updated: 2026-07-08

1. What we collect

Upon registration we store only:

• Username (login)
• Password hash (SHA-512-CRYPT, one-way)
• Random salt for encryption key derivation

We do NOT store: real names, IP addresses, phone numbers, or tracking cookies.

2. Message encryption

Messages in our secure storage are encrypted with AES-256-CBC. The key is derived from your password via PBKDF2-SHA256 (100,000 iterations + unique salt). We physically cannot read your messages — we never have your key.

3. Logs and metadata

• Nginx: access logs disabled
• Dovecot: logging disabled
• Postfix: identifying headers (IP, User-Agent) stripped from outgoing mail

4. Third-party data sharing

We never sell, trade, or transfer your data to third parties. Ever. Under any circumstances.

5. Law enforcement requests

We do not cooperate with law enforcement. Since we keep no logs and don't know your IP, we have nothing to provide even if asked.

6. TOR

We recommend using our onion address for complete anonymity. Tor hides your IP even from us.

7. Contact

support@tortu.cyou