Usually an email service gets built first, and the privacy policy gets written afterwards. We decided to do it the other way round: first we write down what we will keep about you, then we build so that it stays true.
The decision
Everything we will keep about you will fit on one short list. We call it the inventory. We will publish it before launch, and the first rows are already printed on the Privacy page.
The inventory will have four parts:
- What we will keep. Which data, why and for how long, including what you turn on yourself.
- What we will see but not keep. What passes through the server at delivery and is kept nowhere, except in the send queue and in certain fields of technical logs, for a limited time.
- What others will get. Who outside Methmail will see something about you: for example, the recipient’s email provider and the payment provider.
- What we can be ordered to do. What a court can require of us, and what it cannot.
Every row will have three fields: what we keep, why, and for how long.
Why this way
“We care about your privacy” is worth nothing: there is no way to check it. A list is concrete: every row can be argued with, and a false one can be caught.
The list also works on us. Every “we will keep” has to be justified in the “why” field. When there is no justification, the row goes, and we won’t keep that data. So the inventory decides not only what we say, but what we build.
What it costs us
- The inventory binds the product to it. A row that stops being true will count as a bug, and we will fix it as a priority. Every change will be published with a date and a reason.
- Some conveniences get harder to build. Whatever is not on the server has to work on your device. For example, the search index will be built only there: a new device will build its own. More on that in later notes.
- We will be judged by the list before the product. The inventory comes out before launch, so people will argue with it before the first mailbox exists. We think that is the right order.
What comes next
The first rows are already on the Privacy page, together with their caveats. We will print the rest once the decisions they depend on are made and checked against the architecture. What Methmail won’t be able to do is listed on the Security page.