Last updated: June 2026
This threat model outlines what [@fuck.it] protects you from - and what we don’t. We believe in honesty, not false promises.
1. What We Protect Against
- Email interception via insecure protocols (we use TLS)
- Unauthorized access to your inbox (we enforce strong login security)
- Spam, phishing and account abuse (through Open-Xchange’s (OX) advanced filtering and our internal abuse response systems)
- Server-side attacks (we harden our infrastructure)
- Metadata collection by advertisers (we don’t use ads or trackers)
- Unauthorized access to stored files in OX Drive
- Disruptions from regional outages (via geo-redundant hosting across data centers)
2. What We Don't Protect Against
- Stupid passwords (use a password manager, please)
- Local malware or keyloggers on your device
- Your friend peeking over your shoulder
- Governments with access to your unlocked device
- The consequences of emails you send
3. End-to-End Encryption
On supported plans, we offer optional end-to-end encryption via OX Guard, covering emails, attachments and cloud storage. Users can activate and manage encryption settings as needed. Outside of that, data is still encrypted in transit (TLS) and at rest, and we don't access it for ads, profiling or routine operations.
That said, end-to-end encryption is not enabled by default and must be actively used for each message. We don't read, scan or access your mail - not for support, not for any routine reason. But without OX Guard your messages are not zero-knowledge: they're encrypted in transit and at rest, yet content could in principle be compelled from our infrastructure operator by a valid legal request. If privacy is paramount, we strongly encourage using OX Guard - or your own PGP/compatible tools in your local environment - so that no key exists on our side that could decrypt your messages.
Note: As the underlying platform, OX may retain temporarily recoverable message states for disaster recovery or undelete functionality. While deleted messages are generally removed, edge cases exist where partial recovery is technically possible within short timeframes.
4. Legal Access
We comply with valid legal requests. If we’re allowed, we’ll notify you. We do not build backdoors or offer mass access to anyone.
5. Third-Party Services
We work with a hosting company and payment provider. These services only have the data needed to do their jobs. We vet their security but can’t guarantee perfection.
We use Open-Xchange (OX) as our core infrastructure provider. They are GDPR-compliant, ISO-certified and operate under strict access controls. For more, see our Privacy Policy.
6. What You Can Do
- Use a strong password (and don’t reuse it)
- Enable any optional security features
- Encrypt sensitive messages manually
- Log out on shared devices
- Enable two-factor authentication if we offer it
7. Security Philosophy
Security isn’t a product - it’s a posture. We do our part. You do yours. Together, it works.
No bullshit.
No guarantees.
Just good security sense.