In short. Email metadata is information about a message rather than its text: who, to whom, when, from where, and how large. Encrypting the content does not hide it: mail cannot be delivered without addresses. Metadata from email alone can reveal who someone talks to, their daily routine and the places they write from.
What email metadata includes
Every message carries technical headers [1]. The most important ones:
- From and to (From, To, Cc): the sender’s and recipients’ addresses.
- When (Date): the time sent, to the second, with the time zone.
- Subject (Subject). Classic OpenPGP and S/MIME do not encrypt it [2].
- The route (Received). Every mail server on the way adds a line about itself [3]. Some providers record the sender’s IP address there too [4].
- What sent it (User-Agent or X-Mailer): the app, sometimes with its version.
- Message size and attachment names.
Beyond the headers, the mail servers themselves see which IP address you sign in from, and when.
What it reveals
One message says little. Many messages say a lot [5]:
- who you talk to, and how often;
- when you are awake and when you work, from the times you send;
- where you go, from the IP addresses you sign in from;
- which organizations you deal with, from the domains of the addresses: a doctor, a lawyer, a bank.
That is why NIST’s glossary, when defining end-to-end encryption, notes that routing information remains visible [6].
Why metadata is so hard to hide
- Delivery needs addresses. Servers have to know where a message comes from and where it goes.
- Servers see connections. Who connects, and when, is visible at the moment of delivery.
- Subject protection is only arriving. A standard for protecting headers was published in 2025 [2], but not every app supports it yet.
What an email provider can do
Email cannot work with no metadata at all, but it can be kept in different ways. A good provider:
- stores the senders and recipients of stored messages encrypted;
- does not keep the exact time a message arrived where a date will do;
- does not put your IP address into message headers [4];
- keeps technical logs briefly, and says what is in them.
What you can do
- Don’t put anything in the subject line you would not want shown: mail servers can see it.
- If hiding your IP address matters, sign in to your email over Tor [7]. More: what Tor hides and what it doesn’t.
- Strip hidden data from attachments before sending: location in photos, the author in documents.
- Use different addresses for different purposes, so your contacts are harder to link into one picture.
- Remember that the recipient’s email provider also sees your message’s metadata.
How Methmail will handle metadata
We will not keep a record of who writes to whom: senders and recipients will be stored encrypted along with the message. Logs of incoming mail will keep the minute, the domain and a hash of the rest of the address for 7 days, under a key that will be destroyed after 7 days. The sending log will keep, for 7 days, the minute and pseudonyms instead of the mailbox and the recipient, under a key that will change every day and never be written down: within a day they will show that one mailbox wrote to one address several times, but not who. While the key exists, a hash could be checked against a guess, including our own users’ addresses. Mail to an external address will wait in the send queue for up to 48 hours, and the database change archive will keep the exact time messages were written for 24 to 48 hours. At the moment of delivery the server will see who is writing to whom; a court will be able to order us to start recording it and to hand over the last 7 days of logs. The limits of this protection are under What Methmail won’t be able to do.
For the message itself, we will keep the date it arrived only to the day. The exact time will remain only in delivery logs (7 days) and in the database change archive (24 to 48 hours). By default we won’t store your IP addresses, in logs or in databases. Technical logs will contain only pre-approved fields, with none of your IP addresses and no message content; the fields and retention period of each log are in the inventory. A court or authority in the USA, where the company is registered, in the country where our servers are, or where members of our team live, will be able to order us to start recording the IP addresses of a specific account; this cannot be done retroactively. What else we can be ordered to do is on the Privacy page.
Sources
- RFC 5322: Internet Message Format. IETF, October 2008. https://www.rfc-editor.org/rfc/rfc5322
- RFC 9788: Header Protection for Cryptographically Protected Email. IETF, August 2025. https://www.rfc-editor.org/rfc/rfc9788
- RFC 5321: Simple Mail Transfer Protocol. IETF, October 2008. https://www.rfc-editor.org/rfc/rfc5321
- Privacy Guides: Email Services, Criteria section (updated June 28, 2026). https://www.privacyguides.org/en/email/#criteria
- EFF, Surveillance Self-Defense: Why Metadata Matters (last reviewed by EFF in July 2024). https://ssd.eff.org/module/why-metadata-matters
- NIST SP 800-12 Rev. 1, CSRC glossary: end-to-end encryption. https://csrc.nist.gov/glossary/term/end_to_end_encryption
- EFF, Surveillance Self-Defense: How to Use Tor. https://ssd.eff.org/module/how-to-use-tor