Privacy policy for sarebamail

What sarebamail stores in detail

• E-mails, events, contacts, tasks and notes are kept on the mail server. sarebamail displays them and does not keep its own copy of this content in its database.
• Stored encrypted: your mail server password and your mail server session, chat messages and the names of groups, teams, channels and chat folders. This is encryption at rest, not end-to-end encryption: the service processes chat messages in plain text for delivery.
• End-to-end chats: only ciphertexts created by the browsers of those involved (also stored encrypted like every chat message), the sender’s signature, the header signed by the creator listing the members, and the conversation key wrapped for the members’ keys and their organisations’ recovery keys – not for sarebamail. Group name, reactions and announced file names are not end-to-end there.
• Added sarebamail mailboxes: no password, only a check value derived from the stored password hash of the mailbox. It shows whether the password has changed since; the password cannot be derived from it. Adding the mailbox appears in its sign-in log, with the address of whoever added it.
• Sending from a sarebamail mailbox: the IP address you send from stays with the message in the outbox until it is delivered and goes to mailsecurity by sareba with the check – so mailsecurity by sareba checks where your message comes from, not just our server. Afterwards sarebamail deletes it; mailsecurity by sareba keeps its check log for 90 days.
• Stored unencrypted: who wrote in which conversation and when, the call log (time, duration, participants, outcome), signatures, sign-ins and sign-outs with IP address and browser identifier, and an event log per mailbox (such as “message sent” with the number of recipients – without addresses, subject or content).
• Paired devices: name, time of pairing and of the last request; the agent’s access token only as a checksum. Pending pairing codes are deleted after one hour at most. What the agent has already been notified of is kept in memory only. The mobile app counts as a device with its kind (Android, iPhone); for an iPhone also, encrypted, the identifier under which Apple wakes the phone (APNs token). The wake-up itself is empty – no sender, no content; Apple only sees that and when a phone is woken.
• System emails (welcome, new device, notice to the operators): a send log with time, template, recipient address and the template subject, the last 1000 entries. The mail server password for sending is stored encrypted.
• Views of the public pages (home, download, updates, help, sign-in): page, source (such as “google.at”), kind of source and device type – without IP address, without cookies and without browser identifier, for 90 days. Anyone setting “Do Not Track” or GPC is not counted.
• Credentials for Google Search Console, Bing and Yandex Webmaster used for search statistics are stored encrypted; only totals for queries and pages are fetched.
• The plan per organisation and values that differ from it; per user a counter of messages sent today (only the number, 90 days). Operator announcements with title, text and period. Headlines are not stored, only kept in memory for 15 minutes.
• The chosen ringtone (one row per user).
• Mailboxes on the sarebamail mail server: messages stored encrypted (header and content separately), not end-to-end. Not encrypted: size, time of arrival, folder and flags such as read or flagged. In the trash, your plan’s period applies from the time of deletion; after that the message is deleted for good.
• Not stored: video and audio of calls and the connection data of call setup. Whether someone is online, away, in a call or in a meeting is worked out by the server in memory only; from the calendar only the end of a running meeting is sent for this, never its subject, place or attendees.
• Calendar and contacts from apps (CalDAV, CardDAV): besides title, times, place, names and addresses, sarebamail stores the original last sent by the app for an appointment or contact, encrypted – so that attendees, photos and other details sarebamail does not show are not lost when syncing. Only the file name given by the app (usually a random identifier) remains in plain text. Both are deleted together with the appointment or contact. Sign-ins by apps appear in the sign-in log without the password.
• Mail apps (IMAP, SMTP): for this sarebamail stores only one marker per message (marked for deletion); contents stay encrypted and are decrypted only when your app fetches or searches a message. Sign-ins by apps appear in the sign-in log at most once per hour and app password, without the password; failed attempts every time.
• Attachments you send are kept in memory only while sending and then go to the mail server.
• Agent window: the sign-in, cookies and page cache are stored on your device in the agent’s program folder (Windows: %LOCALAPPDATA%\sarebamail-agent\webansicht, macOS: WebKit’s data store for the agent) – as with a browser, not with us.
• Sending from a sarebamail mailbox: until a message is delivered to other servers (at most 5 days) it lies encrypted in the queue; afterwards its content is deleted there. Address, time and result of the delivery are kept for 30 days as a log. The copy in “Sent” stays as long as you keep it.
• Self-registration: the contact address is stored encrypted (with key version) and additionally as a keyed hash so the same address cannot be used any number of times. Also stored are the times of creation, confirmation, approval and blocking. The IP address is not stored, only a keyed hash of it for the limit per connection, which is deleted after at most 25 hours. Links from system mails exist only as a checksum. If the spam filter rejects one of your messages, the time and reason (such as the score) are kept for 30 days, without content and without recipients; likewise the start and end of a pause.
• Aliases: the address, which mailbox it belongs to and when it was created. A deleted alias remains with its deletion time for 180 days so nobody else takes over the address and receives mail meant for you. Creating and deleting are recorded in the account log.
• Pro organisation: who is a Pro admin and who appointed them, the number of booked Pro seats and every change to it with time and acting person (basis for billing, not deleted).
• Add-on packages: which packages an organisation has booked, how many, and every change with old and new value, price, time and acting person (basis for billing, not deleted).
• Filter rules of sarebamail mailboxes: name, conditions (such as sender addresses or subject words) and actions, in plain text as a setting of the mailbox – they are evaluated when mail arrives.
• Sender lists (always allow, always block): per mailbox the address or domain, the kind, when and by whom it was added – in plain text as a setting, like filter rules.
• Files in chat: the server stores no content. It knows name, size, type and checksum (encrypted like a message) and who has the file on a device. It only passes on the signals for setting up the connection, without storing them. The content is on the devices of those involved.
• Background in video calls: your choice and your own background images are kept only in this browser (local storage), not on the server. sarebamail serves the detection model itself; the camera image is processed on the device.
• Status: what you choose yourself (status, status message encrypted, until when) and when you were last online, to the minute, with your setting whether others may see it. “Offline since” is only shown roughly (5 minutes, hour or day). How long someone has been away comes from the last input in a window or – reported by the agent, only as the number of seconds since the last input on the computer – on the computer (in memory only) or from when the status was chosen, and is shown just as coarsely.
• Read state in chat: per conversation and participant only up to which message something was delivered and read, plus your read-receipt setting. Disappearing messages are deleted after their period together with call entry and file description; messages written before stay.
• Own calendar: title, place and description encrypted; in plain text start, end, time zone, series rule, exceptions of a series and the reminder (minutes before), plus for two days which reminder was already sent. Out-of-office note of own mailboxes: the text encrypted; so nobody gets a reply twice, only a check value of the sender address and the time, for 7 days. Own contacts, tasks and notes: the whole entry encrypted; in plain text only whose it is and when it was created and changed.
• Meetings: title encrypted; in plain text start, end, time zone, organiser, who accepted or declined and the addresses of external invitees (otherwise no invitation or cancellation could be sent). A link for guests is stored encrypted.
• Guests via link: the name, the state in the waiting room and the access are kept only in the server’s memory (the access only as a checksum) and expire as soon as the guest leaves, stops responding or the meeting is over. Guests do not appear in the call log. What a guest writes in the chat stays in the history like any chat message – name and text encrypted together, without an account.
• Reactions: who reacted to which message with which emoji – the emoji encrypted. GIFs: the GIF details (Wikimedia Commons id, title, author, license) encrypted like a message; sarebamail does not store the image itself, it fetches it from Commons when needed. Wikimedia sees the sarebamail server and the search term, not your address.
• Editing and deleting: when editing, the new text replaces the old one (encrypted); only the time of the last edit is stored – the old text is not kept. A deleted message remains as a placeholder with sender and time; its content is deleted.
• Legal notice, privacy policy, terms and the texts of the system emails: every saved version with time and the account that saved it. That keeps traceable which text applied when; earlier versions are not deleted.
• Outbound check (mailsecurity by sareba): to check it, mailsecurity by sareba receives the content of every message you send from the sarebamail mail server, including messages to sarebamail addresses. mailsecurity by sareba processes the content only for the check; its log records sender, number of recipients, result and score.
• Mailing lists (Pro): the members' addresses and one unsubscribe link per member. Messages waiting for approval are stored encrypted with us until a Pro admin approves or rejects them; the organisation's Pro admins see the sender address. Approvals and rejections are logged with time and acting person in the organisation's log. With the archive switched on, every distributed message is stored encrypted with us until a Pro admin deletes it – never automatically; members with a sarebamail mailbox and the organisation's Pro admins can read it.
• Shared mailboxes and forwarding (Pro): who has access and whether read only; for forwarding, who last changed it.
• My files (Pro): the content is stored in encrypted blocks on separate storage in the EU, each file with its own key, which in turn is stored encrypted with us; file and folder names are encrypted too. Size, times and which file is in which folder remain in plain text. Only what you delete yourself is deleted – from the trash after your plan's period; an interrupted upload is discarded after 24 hours. For sharing we store who shares which folder or file with whom, with which permission and since when – without names or content; the share disappears with the item or the user. Earlier versions of a file are stored encrypted just like the current one, with time, size and who uploaded them. App passwords: only a check value (SHA-256), the device name, when it was created and last used; every drive sign-in, every failed attempt and every creation or revocation is in the sign-in log. Links for outsiders: only a check value of the link (SHA-256), a password only as an Argon2id hash, expiry, maximum and number of downloads – nothing about downloaders, no IP and no program. The link sits behind # in the address and therefore reaches no server and no log. Expired links are removed after 30 days, the file stays.
• Secure mail: the public part of your key, and the key itself only locked – per lock (passkey, passphrase, recovery code) one encrypted copy with type, name, time of creation and last use, for a passkey its identifier. Passphrase, recovery code and the unlocked key do not reach sarebamail. Setting up, adding and removing appear in the sign-in log. Of the organisation recovery key only the public part, who set it when, and its signature; earlier ones remain as replaced. Per secure message in plain text: sender, recipients, time, size and whether read; subject and text only encrypted, plus the wrapped message key per participant and the signed header. Per user the number of secure messages sent per month. Attachments of secure messages: only encrypted blocks in the storage of “My files”, plus size, number of blocks and checksums of the ciphertexts. Recipients via link: their address, expiry, number of wrong attempts and when opened; of the link and of the passphrase check value only checksums (SHA-256), never the passphrase itself. Secure mail log per organisation (who, whom, when, which message – never contents), consent to deputising and recovery requests; never deleted automatically.
• Secure mail drafts: only encrypted for your key (recipients, subject and text together); in plain text only who owns the draft, when it was changed and its size. At most 200 drafts, no expiry; they are deleted by you or when sending.
• Unlocked key for secure mail and encrypted chats: for at most 12 hours, encrypted in the browser (IndexedDB) with a browser key that cannot be read out; “Lock” and signing out delete it. It never goes to sarebamail.
• Problem reports: only when you choose “Report a problem” or “Send problem report…” yourself. Stored are your description and the log shown (error messages, failed requests with path and status code only, version, browser or system; for the agent the end of its log) – encrypted, plus account, time, program and size. Only the operator can read them; they are deleted after 90 days. At most 20 reports a day. sarebamail also creates an entry in the sarebamail team’s internal ticket system (Issue Tracker by sareba, visible to the team only): description, system, version and time, the log as an attached file – not your address, which stays with the report in sarebamail.
• Sharing of calendar and address book: who gave whom which level, with the time – no content. Every change is recorded in the owner’s sign-in log. For free/busy and private events the server only sends the time, never title, location or text.
• Search at the top: nothing is stored, there is no search index. The mail server searches mail, the server decrypts file names only for that request, and your browser compares everything else with the lists it shows anyway.
• Editing at the same time: for the drive, sarebamail only remembers per device (app password) and file which version the device last read or saved – identifiers, no content; the row disappears with the app password or the file. The server log records writes through the drive with file identifier, size and kind (new, version, merged), without names or content.
• Editing together live: changes travel through our server to the others who have the file open and are only kept in memory there while someone has the file open – never on disk and never in the log. They are not end-to-end encrypted (like the Office add-on). Nothing is saved until “Save”, which creates a new version as usual.
• Backup and restore: a downloaded backup is created while downloading and not stored by us; neither is its password. For restoring, the uploaded file is only kept temporarily on the server (at most 24 hours, does not count towards storage), as is the state saved before a reset. The chat archive stores restored conversations encrypted only for you until you remove an entry. Creating and restoring appear in the sign-in log (which areas, size, never contents).
• Automatic backup: per account a public backup key and the private key only locked with your backup password – without the password sarebamail cannot open any of your backups. Plus schedule, retention, time and size of the last backup and an error note (such as “storage full” with the numbers). The backup files themselves are stored in “My files” like any file.
• Organisation backup: the file is created while downloading and is not kept on the server; per member a temporary file briefly exists on the server and is deleted right after. For restoring, the uploaded file stays on the server as a temporary copy for at most 24 hours, as for your own account. The sign-in log records backup and restore for the Pro admin and for the member concerned.
• Backup by sareba: backups are kept in a separate area of sareba’s backup box (apart from “My files” and from the server backup), in blocks and fully encrypted with your backup key or the organisation’s key, whose private part only your password unlocks. Stored alongside: time, size and kind of each backup, plus schedule and retention.
• Backup with a connected mail server: to back up, sarebamail signs in to that server with your stored password (as when reading your mail); nothing additional is stored for this. The content is then only in the backup file.
• Blocking: who blocked whom in the chat, with time – until it is undone.
• Reports from the chat: addresses of the reporting and reported person, conversation, time; reason and excerpt encrypted. Only the operators see them; resolved reports are deleted after 180 days.
• Account deletion: during the 30 days the scheduled time and who requested it. After the final deletion only one line with address, type and times remains for a year (for queries); the address stays reserved for others for 180 days. Messages to others stay with the recipients; the server backups contain the data until they rotate.