[Ideas] Improve Email Provider Criteria and Description

[jnton]

Many people have been concerned by the release of IP addresses to authorities by ProtonMail #61 #298, the problem is that such possiblity was clearly declared. People are not well informed about mail policies so I propose:

1. Write what type of logging the mail provider declares to do (especially regarding IP addresses)

2. Specify if a mail provider has a clear data disclosure policy and a transparency Report

3. Implement "clear disclosure policy" and data logging into the mail provider's criteria

4. Reorder the mail providers using the previous criteria (by using only that criteria Posteo should be put on top and Disroot at the bottom of the list)

This is some data on the topic, with related sources:

ProtonMail

IP logging: IP is stored permanently if the user engaged in activities that break ProtonMail's terms and conditions, it also can be kept temporarily to combat abuse and fraud (it's not specified for how much time) [1]
Clear data disclosure policy: Yes
Transparency report: Yes

Mailbox.org

IP logging: IP is stored and then erased after 4 days [2]
Clear data disclosure policy: Yes
Transparency report: Yes

Posteo

IP logging: No log policy, independently confirmed in an audit report by the German Federal Commissioner for Data Protection [3]
Clear data disclosure policy: Yes
Transparency report: Yes

Disroot

IP logging: IP addresses of currently logged in users via IMAP/POP3 protocols are stored for as long as the device is logged on the server (per each device logged in), moreover, non-anonymous IP addresses are also present in server logs which are kept for 24 hours, after which they are erased [4]
Clear data disclosure policy: Not present
Transparency report: No

Tutanota

IP loggin: IP is logged only of individual accounts in case of serious criminal acts after being served a valid court order by a German judge [5]
Clear data disclosure policy: Yes
Transparency report: Yes

StartMail

IP loggin: IP is stored for a maximum of 7 days, after which it's deleted [6]
Clear data disclosure policy: Yes
Transparency report: No

Sources:

[1]

IP Logging: By default, we do not keep permanent IP logs in relation with your use of the Services. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our terms and conditions (spamming, DDoS attacks against our infrastructure, brute force attacks, etc). The legal basis of this processing is our legitimate interest to protect our Services against nefarious activities. If you are breaking Swiss law, ProtonMail can be legally compelled to log your IP address as part of a Swiss criminal investigation. This obligation however does not extend to ProtonVPN (see VPN privacy policy here). Additional details can be found in our transparency report.
https://protonmail.com/privacy-policy

[2]

Type: web server / web portal / administration interface
Relates to: JPBerlin, mailbox.org, Heinlein-Hosting, ox.io
Stored data: when and from which IP address our platform was accessed.
Purpose: protection against misuse and unauthorised access
Erasure period: after 4 days.
Access by: system administration, support/help desk, programmer
Type: mail server SMTP, spam and virus filters
Relates to: JPBerlin, mailbox.org, Heinlein Hosting, ox.io
Stored data: sender, recipient, message ID and size of a sent or received email. Parts of the content or subject of an email are not stored in this context
Purpose: to verify that the emails entrusted to us have been correctly delivered/received if users complain about the loss of an email, and to protect against misuse.
Erasure period: after 7 days.
Access by: system administration, support/help desk
Type: mail server POP3/IMAP, ox.io
Relates to: JPBerlin, mailbox.org, Heinlein Hosting, ox.io
Stored data: what account has logged in when from what IP address. If emails are erased, the message ID and size of the erased email are stored. When an email is moved to another IMAP folder, the message ID and size of the email and where it was moved from and to are saved. No contents of the email are logged in this context.
Purpose: to verify whether unauthorised access to a mailbox has taken place or why and how an email has been erased if users complain about the loss of an email and protection against misuse. If the user grants direct debit authorisation or if external payment services are used, bank data or transfer IDs are stored.
Erasure period: after 4 days.
Access by: system administration, support/help desk
https://mailbox.org/en/data-protection-privacy-policy

[3]

Traffic data consists of all data, that is accumulated through the use of Posteo.
In conformity with the law, we strictly do not collect and save any IP addresses that could be traced back to customers.. This was independently confirmed in an audit report by the German Federal Commissioner for Data Protection. We also do not collect your IP address if you visit our website or if you use our contact form or webmailer. We also do not collect or save your IP address if you use an external client to retrieve your emails via IMAP or POP3 or to transmit messages via SMTP to be delivered by us. In the communication between email servers via SMTP, we come to know the IP addresses of other email servers (for example IP addresses from GMX and Gmail servers). The IP addresses of provider servers are only logged in the logfiles when errors occur and deleted after 7 days.
We exclusively record errors that occur when sending and receiving emails to quickly identify and correct technical disruptions and errors. We delete this data, which cannot be traced back to an individual, automatically after 7 days. In addition, we create generic, anonymised system usage and capacity statistics. These statistics also do not contain any personal information or IP addresses.
https://posteo.de/en/site/privacy_policy

[4]

IP addresses of currently logged in users via IMAP/POP3 protocols are stored as long as the device is logged in the server (per each device logged in).
Server logs, which store information such as, but not limited to, your username and your IP address, from and to email addresses, IP addresses of servers the emails come in or go out to, are stored for a period of 24 hours after which they are deleted from the server. No backup of log files is created. Logs are kept to prevent brute-force attacks on accounts and to provide quick insight when debugging issues.
Given that email works on a federated protocol, when interacting with email addresses hosted on third party servers (eg. Gmail.com, Posteo.org), data is sent to other independently operated and owned servers in the network over which we have no control.
https://disroot.org/en/privacy_policy

[5]

By default, we do not log IP addresses when you log in or when you send an email. The IP addresses of sent and received emails are stripped so that your location remains unknown.
We only log IP addresses of individual accounts in case of serious criminal acts such as murder, child pornography, robbery, bomb threats and blackmail after being served a valid court order by a German judge. You can find details on this as well as on German data protection rights on our blog.
https://tutanota.com/faq/

[6]

When you visit the Website, the following details are automatically processed:
-Your IP address → to allow effective troubleshooting and abuse control.
-Browser and operating system type and version → to display the Website in the right format for your browser and operating system.
-Browser language settings → to show you the Website in the right language.
-Country (based on IP-address), date and time → to know in which countries and at what moments our marketing efforts appear to be effective.
-Origin of your visit (such as whether you directly typed the Website URL or accessed the Website through a search engine query or link from another website) → to assess the success of our search engine optimization and information outreach efforts.
-Clicked links and visited (parts of) pages on our Website → to help us get an idea of which of our pages appear to be effective to inform our visitors.
-In our weblogs we store the browser user agent, pages visited, IP address and timestamp for a maximum of 7 days after which they are deleted.
-All other information is processed in a self-hosted analytics tool and stored anonymized, in order to analyze usage trends.
https://www.startmail.com/en/privacy/

[dngray]

I would be adverse to being specific about IP logging, because this can change if a provider is compelled to do it by a court order.

IP logging: IP is stored permanently if the user engaged in activities that break ProtonMail's terms and conditions, it also can be kept temporarily to combat abuse and fraud (it's not specified for how much time) [1]

By default ProtonMail doesn't log, unless you enable the setting to show what your devices logged with what IP address. If a court supplies an order, they will will enable logging. It should be assumed every provider can or will do this, (regardless of what they say) otherwise risk being in contempt of a court order.

In regard to German providers like Posteo, they have a similar law that allows for real-time monitoring as explained by tutanota:

By default, we don't record IP addresses of our users. Therefore, IP addresses can only be recorded for a single user account after we received a valid German court order for a real time monitoring (TKÜ), but not for the past. There is no data retention law for email providers in Germany.