In short: sxMail is a mailbox, not a data collector. I, Dennis Parsch, run the service alone on my own hardware in Germany, I do not analyse your mail, I sell nothing on, and there is no tracking. Everything else is below, ordered by what you actually use. What exactly runs behind it is shown on the page Technology explained openly.
Last updated: 10 September 2026
1. Who is responsible
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Dennis Parsch
Pater-Frey-Ring 67
86698 Oberndorf
Germany
Email: info@sxmail.de
I have no data protection officer; I am not required to appoint one. For any question about data protection, write to me directly.
2. The principles
- Own servers in Germany. All data lives on servers I operate myself, in data centres in Germany. No cloud provider has access.
- No analysis. I do not read your mail, do not mine it and build no profiles. The only automatic processing of mail content is the spam filter (see section 5). Technically, as the operator, I have access to the servers; I only look into a mailbox when you explicitly ask me to (see "Help with errors" in section 5).
- No sharing. I do not pass data to third parties unless the law obliges me to or it is technically necessary for a mail to reach its recipient.
- No tracking. No analytics tools, no advertising cookies, no third-party scripts, no external fonts.
- Encrypted connections. Every connection to sxMail is TLS-encrypted.
3. When you visit the website
Server logs
Whenever a page is opened, the web server automatically records: the address requested, date and time, the amount of data transferred, browser and operating system, the previously visited page (referrer) and your IP address. Session tokens are stripped from the logs before they are written.
Purpose: operation, troubleshooting and defence against attacks. Legal basis: legitimate interest, Art. 6 (1) (f) GDPR. Retention: at most 7 days, then the logs are deleted. Only if a specific attack has to be investigated do I keep the entries concerned until it is resolved.
Cookies and local storage
The website sets exactly one cookie: sxmail_lang with the language you chose, so the server can deliver pages in the right language straight away. It contains nothing that identifies you. Besides that, the app uses your browser's local storage (localStorage and IndexedDB) for settings, the sign-in state, the mail list cache and a referral code you brought along. That stays on your device, is not transmitted to third parties and you can delete it at any time in your browser settings. Legal basis: section 25 (2) no. 2 of the German TDDDG, because it is strictly necessary for the service you asked for.
What does not happen
No audience measurement, no social media plugins, no ad networks, no fonts or scripts from foreign servers. The website loads nothing from third parties.
4. When you write to me
Through the contact form or by email to info@sxmail.de, your details (email address, message, and for an account request a referral code) land in my mailbox. I use them solely to reply to you and handle the request. The contact form is guarded by a home-built proof-of-work captcha without an external service; your IP address is briefly checked against a sending limit but not stored. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual request) and (f) (spam defence). Retention: until the request is settled; I delete settled requests after two years at the latest.
5. When you have a mailbox at sxMail
Your data in the mailbox
Your mailbox holds your emails, calendars, contacts, notes and files. They are yours. I process them only to provide the service: storing, delivering, synchronising, displaying. Legal basis: Art. 6 (1) (b) GDPR (contract of use). Added to that are the account data: email address, password (stored only as a hash), the display name you entered and optional details such as a recovery address, your sxMail ID and your referral code.
Sessions and devices
Signing in creates a session. For it I store a random token, the time of sign-in and of last use and the IP address, so you can see in the settings where you are signed in and end foreign sessions. Your credentials stay on the server; the browser only gets the token. Legal basis: Art. 6 (1) (b) and (f) GDPR. Retention: until you sign out or the session expires.
Spam filter
Incoming mail is checked automatically by the spam filter (rspamd) for signs of spam, phishing and malware. It learns from your own "spam" and "not spam" markings. This is the only automatic analysis of mail content, and it serves your protection alone. Legal basis: Art. 6 (1) (b) and (f) GDPR. No automated decision with legal effect within the meaning of Art. 22 GDPR takes place.
Mail to other providers
When you send a mail to a foreign address, it has to reach the recipient's server. That transmission is the purpose of the service; whether the recipient sits in the EU is determined by the address you choose. Wherever possible, transport is encrypted (TLS).
External accounts you connect
You can add mailboxes from other providers to sxMail. The server then stores the credentials or OAuth tokens needed for it and fetches mail, calendars and contacts from that provider on your behalf. With Google and Microsoft, sign-in runs through their OAuth procedure; I never learn your password. This processing only happens when you add the account yourself and ends when you remove it. Legal basis: Art. 6 (1) (b) GDPR.
Images in mail
Images in foreign mail are fetched by a proxy on my server, not by your browser. The sender therefore sees neither your IP address nor your browser. The proxy only passes the images through and does not store them; your browser may cache them for up to one hour.
Help with errors
Sometimes an error can only be traced inside your mailbox. Then I ask you, and only if you explicitly agree do I sign in to your mailbox. I limit myself to what the troubleshooting needs, copy nothing and tell you when I am done. You can withdraw the permission at any time. Legal basis: your consent, Art. 6 (1) (a) GDPR.
Push notifications
If you enable notifications in the browser, a hint about new mail travels through the push service of your browser vendor (for example Google, Mozilla or Apple). The hint is end-to-end encrypted; the push service only sees that a message is coming, not its content. This is the one place where a third party is technically involved, and it is voluntary: without your consent in the browser, nothing happens. Legal basis: Art. 6 (1) (a) GDPR, revocable at any time in the browser or app settings.
AI features
Summaries, reply suggestions, dictation and read-aloud run on my own hardware with self-hosted models. There is no connection to external AI providers. An AI feature processes only the mail or text you hand it at that moment, and only when you explicitly trigger it. Nothing of it is stored or used for training. Legal basis: Art. 6 (1) (b) GDPR.
Referrals
Every mailbox has a referral code. Whoever reaches sign-up through your link sees your name or your sxMail ID; you can switch that off in the settings. If an account is created through your code, I see that link, and you see in your settings which accounts came through you. The purpose is protection against abuse at sign-up. Legal basis: Art. 6 (1) (f) GDPR.
Error reports
If an error occurs in the app or on the server, a technical report goes to my own error database (errors.sxmail.de), not to a third party. It contains the error message, the place in the code, browser and version, but no mail content, no passwords and no deliberately collected personal data. Legal basis: Art. 6 (1) (f) GDPR. Retention: until the error is fixed, at most 90 days.
Forgotten password
For recovery you can store a second email address. It is used only to send a recovery link. The link is single-use and valid for a short time.
How long I keep your data
For as long as you have your mailbox. Mail you delete is gone once the trash is emptied. If you cancel your account, I delete the mailbox and account data completely within 30 days, unless a statutory retention obligation stands in the way. Save what you want to keep beforehand.
6. The desktop and Android apps
The desktop app and the Android app show the same application as the browser and talk exclusively to my servers. The desktop app checks for an update at start; only the version number is requested. System notifications are generated locally on your device.
7. Donations
The donation link leads to PayPal. Only when you click it do you leave sxMail; from then on PayPal's privacy policy applies. All I learn from PayPal is that and how much was donated.
8. Recipients and third countries
Within sxMail only I have access to the systems. I use no processors. Data leaves the EU only in the cases you trigger yourself: a mail to a recipient outside the EU, an account you connected at a provider outside the EU, push notifications through your browser vendor's push service, or a click on the donation link. Authorities receive data only where I am legally obliged (Art. 6 (1) (c) GDPR).
9. Your rights
Towards me you have the right to:
- access the data I process about you (Art. 15 GDPR),
- rectification of inaccurate data (Art. 16 GDPR),
- erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR): you can fetch your mail, calendars and contacts yourself at any time over IMAP, CalDAV and CardDAV with any program,
- object to processing based on legitimate interest (Art. 21 GDPR),
- withdraw consent you have given, with effect for the future (Art. 7 (3) GDPR),
- complain to a supervisory authority (Art. 77 GDPR). The one responsible for me is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
Write to info@sxmail.de, preferably from your sxMail mailbox: that way I know the request really comes from you, because I only give information about a mailbox to its owner. If the request comes from a foreign address, I ask for proof. You can also download your account data yourself at any time as a file in the settings under "Behavior", card "My data"; mail, calendars and contacts you fetch over IMAP, CalDAV and CardDAV with any program. You are not obliged to give me any data; without an email address, however, I cannot set up a mailbox for you or reply.
10. Changes
If something about the service changes that affects this statement, I adapt it and update the date above. For changes that affect you, I inform you by email.