Privacy Policy

Last updated: October 17, 2026

Draft prepared with AI assistance. It has not yet been reviewed by a licensed attorney. It is meant to describe accurately what Xatheryn Wire collects and does today.

This policy explains how Xatheryn LLC ("Xatheryn," "we," "us") handles information in Xatheryn Wire at mail.xatheryn.com (the "Service"). It is part of our Terms of Service.

The short version. Your mail is stored on servers we run ourselves in the United States. Our scam protection is our own; it runs on those servers, and your mail is not sent to Google or any other company to be scanned. We don't sell your information, we never use your mail to pick ads, and your inbox never shows ads.

1. What we collect

Account details: your first and last name, your chosen address, and the email address you gave us to confirm your account.
Age: you give your date of birth at sign-up. We use it once to check your age and keep only whether you are under or over 18, never the date itself.
Passkeys: only the public key and non-secret details needed to check your sign-in. We never receive your passkey's private key, and there are no passwords.
Recovery code: a 24-digit code we generate for you and show once. We keep only a one-way fingerprint (a hash) of it, so nobody at Xatheryn can read it or show it to you again.
Your mail: messages you receive and send, including attachments, and their headers (such as sender, recipients, dates and delivery details).
Connect link: if you link Xatheryn Connect, or sign up with it, we store your Connect account ID and username. If you sign up with it, we also receive your name and date of birth, so you do not type them. We use the date of birth once, to check your age, and keep only whether you are under or over 18, never the date itself. We ask Connect whether it has verified you. If it has, we receive your legal name and whether you are 18 or older, as Connect holds them, and they replace the name and age you gave us. We don't receive your ID documents.
Profile photo (Connect members): if you link Xatheryn Connect and have a profile photo there, we keep a small copy of it so it can appear beside your name in your own Wire. Only you see it, in your own app; it is not attached to the mail you send. We refresh it when you change it on Connect, and delete it when you remove it there, unlink Connect or delete your account.
Notification settings: if you turn on notifications, then for each device we keep the address its push service gave us, two keys used to encrypt notifications for that device, a device name such as "iPhone", when it was added, and what you chose to be told about.
Technical details: IP addresses, used to limit sign-up and sign-in attempts and to stop abuse, and sign-in session records.
Your choices: senders you have reported as spam or marked as safe, and your settings.

2. How we use it

We use it to run the Service: to deliver, store and show your mail, sign you in, decide whether you can send, show how you appear to others, protect you and others from scams and abuse, answer you, and meet our legal obligations. We don't sell personal information or use your mail for advertising.

3. Scam and spam protection

Every message is checked automatically by our own scam protection on our own servers. To do that, it reads the message, including its text, links, phone numbers, attachments and sender details. It also keeps short records drawn from genuine mail that proves where it came from, such as which domains, links and phone numbers a company really uses, so it can recognise fakes later. These records are about senders, not about you.

Scams are kept out of your inbox and held on your Scams page, where only you can read them (as plain text), move one back with "Not a scam", or delete it. We keep a copy for 30 days as evidence, then delete it. Our team may see that copy only to review a report or a mistake.
Reports. When you report spam or a scam, the sender's address and domain, and the links and phone numbers in the message, are added to a shared list that protects every Xatheryn user, including Xatheryn Connect. We record which account reported, so that one person can't block a sender for everyone.
Pictures in emails. A sender's picture loading in your browser is how they learn when, and from where, you opened a message, so that never happens. For mail from a sender we can verify, our own server downloads the pictures when the message arrives and shows you the copy it keeps, so the sender can't tell whether or when you read it, or where you are. (They can tell that the message arrived.) The copies are kept with the message and deleted when it is deleted. Mail from a sender we can't verify, and anything that looks suspicious, never loads a picture.

4. Who we share it with

Cloudflare receives mail sent to xatheryn.com addresses and passes it to us. If our servers are briefly unreachable, it may hold the message for a short time until delivery succeeds.
Cloudflare Turnstile checks that a person, not a bot, is signing up. Cloudflare sees your IP address and basic browser details for that check.
Our own mail servers send the mail you write to outside addresses, and our own system emails, such as sign-up confirmations. We do not use an outside company to relay it. The receiving provider sees the message and the address it came from, as with any email. Mail between Xatheryn addresses never leaves our servers.
Your device's push service (Apple, Google, Mozilla or Microsoft, whichever your device uses), only if you turn on notifications. When mail arrives that you asked to hear about, we send it a small notification for your device. What the notification says is encrypted so that only your device can read it: the push service can tell that a notification was sent to your device, and when, but not what it says. It also carries the number of unread emails, for the number on Wire's icon. A notification for a verification code never includes the code or the subject, and if you turn off "Show the sender and subject" it only says "New email".
The people you write to see your address and the name you chose to appear by.
Xatheryn Connect, only if you link it, as described in Section 1.
Law enforcement and authorities. If a person on our team confirms that an account sent a scam, fraud, extortion, or mail that endangers a child, we may report it with the messages involved and the sender's identity details held by Connect, as described in Section 8 of the Terms. We also respond to valid legal requests. We may share information to protect someone's safety.
NCMEC. When the law requires, we report apparent child sexual abuse material and attempts to lure or extort a child to the National Center for Missing & Exploited Children, with the email involved and what we know about the sender.
A buyer or successor if Xatheryn's business is transferred, under this policy or one we tell you about.

5. Advertising and cookies

We use one cookie that keeps you signed in. It's required and isn't used for tracking. Pages you see while signed out may show ads from Google AdSense. Google and its partners use cookies to serve ads based on your visits to this and other websites, and you can turn off personalized ads in Google's Ads Settings. Signed-in pages, including your inbox, never load ad code, and the content of your mail is never used for ads.

6. How long we keep it

Your mail stays until you delete it or delete your account.
Spam is deleted after 30 days. Hidden scam copies are deleted after 30 days, unless a person on our team is holding them for a report or a legal requirement.
Accounts that never confirm their email are deleted after 7 days.
An email reported for child safety is kept, apart from your mailbox, for at least one year from the report (and one year from any report we file with NCMEC). Deleting the email or an account doesn't remove it.
Sign-in sessions and rate-limit records are deleted when they expire.
A device that gets notifications is forgotten when you remove it or turn notifications off, when its push service tells us it no longer exists, or when it stops answering. The copy of your Connect profile photo is deleted when you remove the photo on Connect, unlink Connect or delete your account.
When you delete your account, your mail and account details are deleted. Your address is kept only as a retired name, so it's never given to someone else.
Entries in the shared scam list (addresses, domains, links and phone numbers of reported senders) may be kept as long as they help protect users.

7. Security

We use passkey sign-in, signed and checked mail (DKIM), sessions that can't be used from other sites, blocked remote content in emails, and limits on sign-in attempts. No system is perfectly secure, and we can't guarantee it.

8. Your choices and rights

You can change how you appear in Settings, turn notifications on or off, unlink Connect, remove passkeys, and delete your account. Depending on where you live, you may have the right to access, correct, delete or get a copy of your information. To ask, write to us at the address below.

9. Children

The Service isn't for anyone under 15, and we don't knowingly collect information from children under 13. If you believe a child under that age has an account, contact us and we will delete it.

10. Where your information is kept

The Service is run from the United States, and your information is stored and processed there.

11. Changes

We will update the date at the top when this policy changes. When a change is material, we'll ask you to accept it before you continue.

12. Contact

Privacy questions or requests: legal@xatheryn.com.