Security • Privacy • No small print
What we can and can't see.
Straight answers about your privacy. Where BUOKO protects you, we explain how. Where it doesn't, we say so.
The short version
Here's how it works today.
Email has to pass through a server to be delivered. This is exactly what ours can and can't see.
What our servers can see
- iYour messages. Your mail is stored on our own server in Germany. It is not encrypted at rest, so our systems can technically read it. That's how we filter spam, power search and deliver your mail. Access to the server is locked down to the founder's security key.
- iDelivery details. Sender, recipients, subject, date and size. Every email provider needs these to deliver mail.
- iYour login IP address, kept for a short time to protect your account and stop abuse, then deleted.
- iYour plan. Paid plans are bought through Google Play in the BUOKO app for Android. Google handles the payment, so we never see your card number.
What we don't see, need or do
- No phone number, no real name. You don't need either to sign up.
- No ads, no selling your mail. BUOKO never sells your mail or uses it for ads.
- Nobody at BUOKO reads your mail unless you ask us to (for example, for support) or a valid legal order forces us to.
- Senders can't track you. Tracking pixels and remote images are blocked by default, so senders can't see when you open a message or learn your IP address. If you tap to load images, they load from the sender's server, just like in other email apps.
Being honest
BUOKO is not end-to-end encrypted.
With end-to-end encryption, only you and the person you write to can read a message, not even the email provider. BUOKO doesn't work that way. Mail is encrypted in transit with TLS (whenever the other server supports it) and stored on our servers in Germany. It is not encrypted at rest.
If you need that level of protection for something sensitive, use a tool built for end-to-end encryption.
Built in
How we protect you and your account.
Trackers blocked
Hidden tracking pixels and remote images are blocked by default. You decide when to load images.
Read receipts with consent
A read receipt is only sent if the person reading agrees. They choose Send or Don't send. No secret pixels, in either direction.
Two-factor sign-in
Turn on two-factor sign-in with an authenticator app. Even if someone learns your password, they can't get in without the code.
Recovery codes and backup email
Since we don't ask for your phone number, recovery codes get you back in. You can view them again while you're logged in. Add a backup email for account recovery too.
Aliases
Give shops and newsletters an alias instead of your real address. Turn it off if it starts getting spam.
App passwords
Using Apple Mail, Thunderbird or another email app? Give each device its own app password, so your main BUOKO password stays private.
Fair abuse protection
Sign-up limits per internet connection and daily sending limits keep spammers out. If something looks wrong, we pause sending, not your whole account, and a human reviews appeals.
Encrypted in transit
Mail travels with TLS whenever the other server supports it, so others can't read it while it travels.
Leave anytime
Delete your account in the app under Settings. See how account deletion works.
Where your data lives
Servers in Germany. EU rules.
BUOKO is an independent email service made in Estonia. Your mailbox is stored on a server in Germany and protected by the GDPR. You can ask for a copy of your data or have it deleted at any time.
- Mail stored in Germany, encrypted in transit
- Your GDPR rights: access, export, deletion
- Every helper we use is listed in our privacy policy
Found a security problem?
Please tell us privately first and give us a chance to fix it. We'll reply, keep you updated and credit you if you'd like.
