Privacy
What this site collects
This page is about ihasmail.org, the website. It is not about ihasmail the mail client, which runs on whatever server its operator installed it on and never reports anything back here.
Last updated 28 August 2026
The short version
- Analytics runs only if you press Accept. Decline, or ignore the banner, and Google is never contacted from this site.
- You can change your mind at any time from Cookie settings in the footer. Turning it off deletes the cookies it set.
- There is no advertising, no profiling, no selling anything to anyone, and no account to create.
- Everything on the page — stylesheet, script, images, the fonts — is served from this domain. With analytics declined, the site loads nothing from a third party at all.
- No AI reads anything of yours. Not what you do on this site, and not — in the mail client — your mail. See AI below.
Who is responsible
The controller for this site is Coffey Labs, which publishes ihasmail. For anything on this page, including the rights below, write to privacy@linuxexperts.net.
Analytics, with consent
If you press Accept, this site loads Google Analytics, which sets cookies in your browser and sends Google your IP address, the pages you view, roughly where you came from, and general details about your device and browser. Google acts as our processor for this, and processes it on servers in the United States as well as the EU — a transfer that relies on the EU–US Data Privacy Framework and Google's standard contractual clauses.
The lawful basis is your consent, under GDPR Article 6(1)(a) and the ePrivacy Directive Article 5(3). That is why nothing loads before you answer: consent has to come first to be worth anything.
| Stored | What it is | How long |
|---|---|---|
ihasmail-consent | Your answer to the banner, kept in local storage so we stop asking. Set whichever way you answer. | Until you clear your browser storage |
ihasmail-theme | Light or dark, if you used the toggle. Never leaves your browser. | Until you clear your browser storage |
_ga, _ga_… | Google Analytics. Only ever set after you press Accept. | Up to 2 years, or until you decline |
The first two are how the site remembers a preference you expressed, so they are set without asking — refusing to remember that you refused would be its own kind of absurd.
Server logs
The web server records each request: IP address, timestamp, the path asked for, the referrer and the browser's user-agent string. This happens for every visitor and is not affected by the banner. It is what makes it possible to keep the site up, see that a deploy worked, and notice someone probing for a way in. The lawful basis is legitimate interests under Article 6(1)(f) — running a service securely. Logs are kept short-term for operational purposes and are not used to build any profile of you.
Cloudflare
This domain is served through Cloudflare, which sits between you and the origin server, terminates TLS, and caches static files. Cloudflare necessarily sees the requests it passes through and acts as our processor for that. It is how the site stays reachable, and it applies whether or not you accept analytics.
AI
Nothing you do here is sent to an AI service. This site runs no AI feature of any kind: no assistant, no chat, no summarising, no scoring or profiling of visitors. Analytics, if you accept it, is Google Analytics as described above and nothing more.
The same holds for the mail client. ihasmail does not use AI to read, process, summarise or generate anything from your mail. It is a JMAP client: messages are held entirely by the Stalwart server its operator runs, ihasmail keeps no database of its own, and no message content, address or attachment is sent to any third-party AI service — there is no such call in the code to make, which is checkable, because the source is published.
Where AI was used is in writing the project: parts of ihasmail's code, its documentation and this website were drafted with the help of AI tools, principally Claude, and every such contribution is reviewed, tested and maintained by the project maintainer. That is a fact about how the software was built, not about your data — the fuller account is in the AI disclosure on the home page.
Your rights
If the GDPR applies to you, you have the right to:
- ask what personal data we hold about you, and get a copy;
- have it corrected, or erased;
- restrict or object to how it is processed;
- receive it in a portable form;
- withdraw consent at any time — Cookie settings in the footer, which is as easy as giving it was, deliberately;
- complain to your data protection authority if you think we have got this wrong.
Withdrawing consent does not make what happened before it unlawful, but it stops the processing from that point and clears the cookies involved.
Links out
This site links to GitHub, the Stalwart project, the ihasmail documentation and coffeylabs.org. Following a link puts you on someone else's site under someone else's privacy notice; nothing here follows you there.
Changes
If this notice changes in a way that affects what you agreed to — a new processor, a new purpose — the banner asks again rather than quietly carrying your old answer forward onto something new.