Evil Overlord B.V.
Cornelis van Noordestraat 26
2033 ED Haarlem, the Netherlands
KvK 77651790 · VAT NL861081298B01
hello@briefkist.eu — a person answers, usually within a working day. Security reports: via GitHub Security Advisories (see SECURITY.md for the policy).
Niels Filmer, at the address above.
This policy is short because we collect little. It covers the website and the hosted service; a self-hosted server sends us nothing at all.
No analytics, no non-essential cookies, no tracking pixels. Server logs hold IP addresses for at most seven days, for abuse prevention only.
We hold your email address, billing records (a legal obligation), and the operational metadata of your instance — its size, its version, whether it is running. We hold your archive only as ciphertext. During the seconds a letter is processed it exists unencrypted in your instance's memory; that data is purpose-limited, never retained and never used to train anything. The full technical account is on the security page, which this policy incorporates.
Export and deletion are self-serve buttons, not request forms. For anything else under the GDPR, write to hello@briefkist.eu. The supervisory authority is the Dutch Autoriteit Persoonsgegevens.
Briefkist is licensed AGPL-3.0. Self-hosting is free, needs no account, and these terms don't apply to it — the license does.
We provide a single-tenant server, keep it patched and backed up, and target 99.5% monthly availability. You may cancel at any time from the dashboard, effective at the end of the paid period. We may end the service with 90 days' notice, during which export remains available.
You hold the only key. We cannot recover an archive whose passphrase is lost, and you accept that a lost passphrase means lost data.
The service archives your own household's documents. Don't use it to store or distribute material you have no right to hold.