Privacy Policy

1. Core Privacy Commitment & Sovereign Architecture

At Natrium Technologies Inc., we treat privacy as an engineering invariant rather than a marketing slogan. Our platform is built from the bare-metal operating system layer up to minimize metadata collection, eliminate behavioral surveillance, and keep your mailbox mathematically unreadable to everyone other than you.

We operate an independent, subscriber-funded business model. We do not sell, rent, broker, monetize, or trade your personal information. We do not participate in advertising networks, and we never scan or index your communications for commercial ad targeting or cloud AI model training.

2. Information We Never Collect

By design of our zero-knowledge encryption and anonymous registration flow, Natrium never collects, stores, or views:

• Plaintext email bodies, message drafts, scheduled emails, or personal notes.
• Plaintext file attachments, documents, archives, or media binaries on disk.
• Plaintext account passwords, unencrypted Data Encryption Keys (DEKs), or plaintext recovery answers.
• Mobile phone numbers, SMS verification logs, real legal names, or government identity documents.
• Keystroke timing telemetry, mouse movement recordings, screen captures, or cross-site ad tracking beacons.

3. Minimal Ephemeral Routing Metadata & Account Records

To route messages across the global Internet email network (RFC 5321 SMTP / Direct-MX) and defend your mailbox against unauthorized intrusion, our systems process strictly minimal operational records:

• Encrypted Account Credentials: Username, primary @natrium.sh address, AES-256-GCM encrypted password hash and salt (derived via scrypt N=32768 + HMAC-SHA256 server pepper), wrapped per-user cryptographic key envelopes, TOTP/WebAuthn credential identifiers, sender blocklist entries, and plan tier.
• Billing & Transaction Tokens: For paid subscriptions, our third-party payment processor (PayPal) provides transaction identifiers, subscription status, and billing cycle timestamps. We never receive or store your credit card numbers, bank accounts, or CVV codes.
• Mail Transport Envelope: Inbound and outbound sender/recipient email addresses, delivery timestamps, byte sizes, and cryptographic DKIM/SPF/DMARC verification statuses required for mail delivery.
• Perimeter Defense & Rolling SIEM Logs: Connecting IP addresses, TLS handshake parameters, and short-term circular rolling SIEM security logs retained strictly to detect brute-force attacks, rate-limit violations, and unauthorized intrusion attempts.

4. How Zero-Knowledge Encryption & Per-User Key Envelopes Work

Natrium employs a multi-layered cryptographic envelope architecture to protect all user data at rest and in transit:

• Memory-Hard Key Derivation: Your account password is processed through scrypt (N=32768, r=8, p=1) combined with a server-side HMAC-SHA256 cryptographic pepper and a unique per-user 128-bit salt. Both the salt and resulting verifier hash are additionally encrypted at rest using AES-256-GCM.
• Per-User Data Key Envelope: Each mailbox is provisioned with a dedicated 256-bit Data Encryption Key sealed under a user-specific Wrapping Key (scrypt derived from your password). When you change your password or complete a verified security question recovery, your key envelope is re-wrapped without exposing underlying data.
• Authenticated Ciphertext: Every message body, subject, sender/recipient field, draft, note, and TOTP secret is sealed with authenticated AES-256-GCM using a fresh 96-bit initialization vector (IV) and 128-bit authentication tag.
• Inbound Offline Mail Ingestion: When an external email arrives over TLS via SMTP while your session is offline, the MTA ingests the envelope and seals the payload with authenticated AES-256-GCM under a dedicated server ingestion key. Upon your next verified sign-in, the payload is transparently re-encrypted and sealed directly under your personal Data Encryption Key.
• Encrypted Attachment Blobs (.enc): Uploaded and inbound file attachments are encrypted immediately into binary .enc blobs with an authenticated header on disk. Plaintext attachment files are never retained in persistent unencrypted storage.

5. Cloudflare Perimeter Security & Edge Protection

To shield our sovereign mail relays and email interface from volumetric Distributed Denial of Service (DDoS) attacks and automated credential-stuffing botnets, Natrium utilizes Cloudflare Anycast edge protection and Turnstile human verification challenges. Cloudflare terminates external TLS 1.3 connections and forwards legitimate requests to our origin servers. Cloudflare never possesses database encryption keys or per-user DEKs.

6. Threat Defense, Tracking Protection & Signature Registry

Natrium executes automated, algorithmic threat screening at the mail boundary to protect users without human inspection:

• Multi-Engine Antivirus Screening (Hash Lookups): Attachments are verified via SHA-256 cryptographic hash-only queries against multi-engine threat intelligence databases (70+ antivirus engines including VirusTotal API and Falcon Sandbox intelligence feeds). Attachment binary contents are never uploaded or shared with external parties.
• Tracking Pixel & Spy Beacon Neutralization: Inbound HTML messages are parsed and sanitized automatically to strip 1x1 tracking pixels, remote spy beacons, and behavioral analytics scripts before rendering in your viewport.
• User-Controlled Phishing Reports & Blocklists: Users can report phishing emails through our integrated one-click report tool and maintain a personal blocked-sender registry that automatically drops unwanted senders at the SMTP ingestion layer.
• Prohibited CSAM Hash Registry: Attachment hashes are checked against our active registry of prohibited cryptographic signatures in strict compliance with 18 U.S.C. § 2258A.

7. Data Retention & GDPR Article 17 Cryptographic Erasure

We retain encrypted mailbox records only while your account remains active. When you initiate account deletion from your Settings panel:

• All email messages, drafts, notes, contacts, sessions, passkey credentials, and encrypted .enc attachment blobs on disk are permanently purged.
• Your per-user cryptographic key envelopes and cryptographic salts are destroyed (cryptographic shredding), rendering any historical ciphertext mathematically unrecoverable.
• You receive a formal cryptographic erasure receipt containing a verifiable non-identifying SHA-256 audit hash certifying the permanent purge of your account records.

8. Sovereign Infrastructure, Subprocessors & Technical Safeguards

Natrium operates dedicated, hardened Linux servers with encrypted storage layers and strict process isolation. Outbound emails are delivered directly to recipient mail exchangers via our native Direct-MX Mail Transfer Agent with 2048-bit RSA DKIM signatures and opportunistic TLS 1.3 / 1.2 transport encryption, eliminating third-party SMTP relay intermediaries such as SendGrid or Amazon SES.

Approved Technical Subprocessors: Natrium utilizes a strictly limited set of vetted technical subprocessors essential for infrastructure resilience and payment handling:

• Cloudflare Inc. (USA / Global Anycast Edge): Terminates external TLS 1.3 connections, provides volumetric DDoS protection, and executes Turnstile bot challenge verification. Cloudflare does not possess storage encryption keys.
• PayPal Inc. (USA / Global): Handles PCI-DSS certified payment processing and subscription billing tokens. Raw cardholder data never touches Natrium servers.
• VirusTotal & Falcon Sandbox / Hybrid Analysis: Receives one-way cryptographic SHA-256 hashes of attachments for multi-engine reputation screening. File binary contents are never uploaded or shared.

SIEM Log Retention: Operational perimeter telemetry and security logs are maintained strictly in a circular rolling buffer retained for a maximum of seven (7) days to detect brute-force attacks and rate-limiting abuse, after which entries are automatically overwritten and purged.

9. Statutory Privacy Rights (GDPR, UK GDPR & CCPA/CPRA)

Data Controller & Legal Bases: Natrium Technologies Inc. serves as the Data Controller for your account records. Processing is conducted under GDPR Article 6(1)(b) (performance of contract to deliver encrypted email services), Article 6(1)(c) (statutory compliance), and Article 6(1)(f) (legitimate interests in perimeter security and abuse prevention).

Regardless of your geographic residency, Natrium extends full statutory data protection rights to every user globally:

• Right of Access & Data Portability (GDPR Art. 15 & 20): View and export your messages, attachments, and account configuration at any time.
• Right to Immediate Erasure (GDPR Art. 17 / CCPA § 1798.105): Trigger instant, irreversible cryptographic shredding of your entire mailbox and attachment blobs without waiting periods.
• Right to Rectification (GDPR Art. 16): Modify your display name, signature, aliases, custom domains, and security settings directly in your dashboard.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a competent Data Protection Authority in your jurisdiction if you believe data handling violates applicable law.
• No Sale or Sharing of Personal Information: Natrium never sells or shares personal information as defined under the California Consumer Privacy Act (CCPA/CPRA) and honors Global Privacy Control (Sec-GPC: 1) and Do-Not-Track (DNT: 1) browser signals by default.

10. Self-Hosted Fonts, Vector Assets & Zero Third-Party IP Leaks

Many websites inadvertently leak visitor IP addresses and browser fingerprints to third-party servers by loading external stylesheets from Google Fonts (fonts.googleapis.com), icon CDNs, or external image hosts. Natrium self-hosts all typography (Inter and JetBrains Mono WOFF2 font files) and brand vector assets (/Natrium.svg) directly from our origin server under a strict Content-Security-Policy (font-src 'self' data:), ensuring zero third-party font or asset tracking requests occur when you load the application.

11. Opt-In Rich Music Presence & Server-Side Artwork Proxy

Users who voluntarily enable the Rich Music Presence feature (connecting Spotify, Last.fm, Apple Music, or YouTube Music status in their profile) share only the currently playing track title, artist, album name, and cover artwork URL they choose to display. To prevent external music CDNs from tracking recipients who view your profile or email header badge, Natrium fetches and serves album artwork through a privacy-preserving server-side proxy that strips client IP addresses and cookies. You can disconnect or clear your music presence at any time with a single click.

12. Local AI Inference & Autonomous Agent (MCP) Transparency

Natrium's native AI draft assistance and Pro auto-reply synthesis run exclusively on a dedicated, local inference engine within our sovereign infrastructure. Message prompts and contextual content are never transmitted to external commercial cloud AI providers, nor are they used for machine learning model training.

User-Authorized AI Agents & Model Context Protocol (MCP): When you explicitly connect and authorize an external autonomous AI agent via our Model Context Protocol (MCP) or WebMCP endpoints to query your mailbox or dispatch emails on your behalf, mailbox data requested by your agent is transmitted to the external model or client environment configured by that agent. You maintain sole authority over granting and revoking API keys and session tokens to autonomous agents.

13. Data Protection Officer & Contact Information

For privacy inquiries, GDPR/CCPA statutory requests, or questions regarding our cryptographic data handling practices, contact our Data Protection Officer: