Privacy and security
A plain description of how Ostrae.email handles your sign-in, your mail and the few things that leave the inbox. The binding texts are the Privacy policy and Terms in Ostrae Account.
Updated October 2026 · Describes the product as it is today.
Signing in
You sign in with your Ostrae Account on account.ostrae.tech, using an authorization flow with PKCE, and you confirm access for Ostrae.email explicitly. Your password is never entered on ostrae.email.
Your session
Ostrae.email keeps you signed in with an opaque cookie that scripts cannot read and that is only sent over secure connections to this site. It lasts up to 12 hours or until you sign out. The access tokens from your Account are stored encrypted, and your Account permissions are checked again on private requests.
Access to your mail
Every mailbox request uses your own Account authorization; the browser cannot ask for another person's mailbox. Changes such as sending, moving or deleting are only accepted from this site itself. Sending availability and limits are enforced on the server.
Reading mail
HTML mail is shown as text, and remote images are not loaded. That also means images hosted elsewhere cannot report that you opened a message.
MICA
MICA only receives the selected message or your current draft when you click an action, through Google Vertex AI on an EU endpoint. The website keeps no AI history, and MICA cannot send mail. Details are in How MICA helps with your mail.
Advertising
There are no ads and no Google ad scripts in your inbox. The public introduction page has two clearly labeled placements reserved for future advertisements. No ad is served today. You can hide the placements in the advertisement preferences on that page; the choice is saved in your browser. Serving ads in the future would require a separate consent.
Legal texts
The Privacy policy, Terms and Imprint are published with Ostrae Account.