Everything we will keep about you will fit on one short list. We will publish it before launch. We call that list the inventory. Today its first rows are printed: they are on Inventory: what we will keep about you. The rest is printing, as the home page says. This note is about what is printed, what isn’t yet, and why.
What is printed
The inventory has four parts:
- what we will keep, why and for how long;
- what we will see but not keep;
- what others will get, such as the recipient’s email provider;
- what we can be made to do, and what we can’t.
Every row about storage follows the same pattern: what, why and for how long. Here is one:
The date received: the day only, no hours or minutes. The exact time will remain only in technical logs (7 days) and in the database change archive (24 to 48 hours). Why: to show messages in order. How long: as long as the message exists.
The row that matters most to us is in the second part. We will not keep a record of who writes to whom: senders and recipients will be stored encrypted along with the message. The caveat is in the same row: what delivery logs will keep and what the server will see at the moment of delivery.
What is still printing, and why
We print a row only once it is decided how the thing it describes will work, so some rows are still ahead. Printing a row early would mean promising something that doesn’t exist yet: if the design changed later, the row would stop being true. For example, there are no rows yet about email on your own domain or about an auto-reply that runs on the server: not everything about them is decided yet.
The remaining rows will appear once we finish designing storage and check that the code does what the inventory says.
How the inventory will live
- Every row about storage has three fields: what we keep, why, and for how long.
- A row that stops being true will count as a bug, and we will fix it as a priority.
Every change to the inventory will be published with a date and a reason. Earlier versions will stay public.
What this doesn’t prove
The inventory describes what we will do. While the product is being built, it remains a promise. Once the product is built, we will check that it does what the inventory says: what data goes where, what ends up in logs and what is stored. There has been no independent audit yet.
The limits the inventory doesn’t lift are listed under What Methmail won’t be able to do.
What’s next
Once the last rows of the inventory are printed, we will say so in a separate note.