We built Masquerade so we’d never
have to read your data.

Masquerade is operated by Webaze BV, Boerderijstraat 39, 8500 Kortrijk, Belgium (EU). The service is available at masquerade.broker. For privacy enquiries: privacy@email.masquerade.broker.

We are a controller under the EU General Data Protection Regulation (GDPR). We are not required to appoint a Data Protection Officer, but all data subject requests are handled personally by the founder.

We collect only what we need to run the service. Here’s a plain account:

We do not collect: real names (optional at signup), phone numbers, location data, or any persistent cross-site tracking identifiers.

Persona data (names, addresses, biographies, and any custom fields you store) is encrypted in your browser before it ever reaches our servers. We use a standard X25519/XSalsa20-Poly1305 scheme (libsodium / TweetNaCl). The encryption key is derived from your master password using Argon2id and is never transmitted to us.

Inbound email to your aliases is sealed using your public key (crypto_box_seal) before storage. Only you, with your private key held in your browser session, can decrypt it.

Practical consequence: if you lose your master password, we cannot recover your personas or messages. There is no backdoor. We are not being coy; we genuinely cannot help.

The source code for the browser extension is open-source and auditable. The relay is also open-source. If the cryptography implementation ever changes, we will announce it in advance.

When you create a persona, Masquerade generates one or more alias email addresses (e.g. swift.fox.4k2@email.masquerade.broker). Email sent to that alias is:

1. Received by our relay server.
2. Sealed against your public key.
3. Stored encrypted in our database.
4. Delivered to your Masquerade inbox, decryptable only by you.

We retain inbound messages for 7 days on the free tier, 90 days on the Pro plan, and 365 days on the Business plan, after which they are permanently deleted from our servers. You can export or delete your messages at any time.

We do not read your mail to operate the relay. Headers (from, to, subject) are processed as metadata required to route and display messages; subject lines are encrypted before storage in the same way as body content. The one exception is opt-in phishing scanning, which is off by default: if you turn it on, message content is analysed in memory at delivery to produce a phishing verdict and then discarded — it is never stored or logged. See Phishing & Reach detection.

Masquerade can warn you when something reaches one of your aliases that shouldn’t, and flag mail that looks like phishing. This works in tiers, and the part that reads message content is opt-in and off by default.

• Reach detection (metadata, on by default). We use envelope signals already needed to route your mail — sender address and domain, SPF/DKIM/DMARC results, whether the sender matches the service the alias is bound to, and receipt patterns — to detect when a third party reaches a single-service alias. No message body is read. Legal basis: legitimate interest (Art. 6(1)(f) GDPR, Recital 49 — security of your own mail).
• Phishing content scanning (server-side, consent, off by default). If — and only if — you switch this on, our server reads the message body in memory at the moment of delivery to score it for phishing (e.g. spoofed links, credential-harvesting language). The body is then discarded. We store the verdict and score only; we never store, log, or transmit the content that produced them, and we never use it to train models, profile you, or for analytics. Legal basis: your consent (Art. 6(1)(a) GDPR). You can turn it off again in one click, and the server stops reading your bodies immediately. When off, your inbound mail is encrypted to your key and stored sealed — exactly as before.
• Breach-database correlation (Tier 2, consent, off by default). Optionally, we can check a derived/hashed identifier of the service an alias is bound to against a breach database (Have I Been Pwned) to strengthen a Reach Alert. No message content is involved. Legal basis: your consent (Art. 6(1)(a) GDPR).
• Security alert emails (consent, on by default once a detection tier is enabled). When Reach or phishing events trigger, Masquerade can email a security alert to your account email address. This notification channel is active by default once you enable the underlying detection tier. You can turn off email alerts at any time in Settings → Notifications without disabling detection. Legal basis: your consent (Art. 6(1)(a) GDPR).

In short: we don’t read your mail. Server-side phishing scanning is opt-in and off by default; when on, content is analysed in memory and never stored. We carried out a Data Protection Impact Assessment before building this, and you can withdraw consent at any time.

We use a small number of third-party services. Each is bound by a data processing agreement:

• DigitalOcean (EU): cloud infrastructure. All data at rest stays in EU datacenters.
• Mollie: payment processing. Mollie is the controller for payment card data; we do not store card numbers.
• Resend: transactional email (account notifications only, not alias relay). Minimal data: your account email and notification content.
• Have I Been Pwned (HIBP): optional breach-database correlation (Tier 2 Reach detection). Engages only if you opt in. We send a derived/hashed identifier of the bound service — never your message content, and never a plaintext address where the k-anonymity API applies.

We do not use Google Analytics, Meta Pixel, or any third-party advertising or tracking SDKs.

We use Umami, a privacy-focused, cookieless analytics tool hosted on our own infrastructure (analytics.webaze.be). Umami does not use cookies, does not track users across sites, does not collect personal data, and does not store IP addresses. All data is aggregated and anonymous. It is fully GDPR-compliant without requiring consent.

Under GDPR, you have the right to:

• Access: request a copy of the data we hold about you.
• Rectification: correct inaccurate data (though most data is encrypted and only you can modify it).
• Erasure: delete your account and all associated data. We will action this within 30 days.
• Portability: export all your data as JSON from your account settings at any time.
• Restriction: restrict processing in certain circumstances.
• Object: object to processing based on legitimate interest.
• Lodge a complaint: with the Belgian Data Protection Authority (GBA / APD) at www.dataprotectionauthority.be.

To exercise any right, email privacy@email.masquerade.broker. We will respond within 30 days. We do not charge for data subject requests.

We keep your data only as long as your account is active, or as long as required by law. Specific periods:

• Account data: retained until you delete your account.
• Relay IP logs: 30 days, then automatically purged.
• Inbound messages: 7 days (Free), 90 days (Pro), or 365 days (Business). You can delete earlier.
• Billing records: 7 years, as required by Belgian accounting law.
• SecurityEvent and Reach detection records: deleted when the related message or alias is deleted.
• Phishing verdict and score: deleted when you delete the related message. The body that produced them is never stored.
• Security notification logs (email alerts recorded server-side): 90 days, then automatically purged.
• Anonymised analytics: indefinite (no personal identifiers).

When you delete your account, your encrypted persona data is deleted immediately. Billing records are retained for the legal minimum and are not linked to your persona data.

Technical measures in place:

• All data in transit encrypted with TLS 1.3.
• All data at rest encrypted at the storage level (AES-256).
• Persona and message content additionally encrypted client-side (E2EE; see section 3).
• Passwords never stored: only Argon2id-derived key hashes.
• Rate limiting and IP reputation checks on the relay.
• No admin interface with access to decrypted user data. It does not exist.

To report a vulnerability, email security@email.masquerade.broker. Our PGP key is available at /.well-known/security.txt. We respond to all responsible disclosures.

We use one first-party session cookie to keep you logged in. That is it. No tracking cookies, no advertising cookies, no third-party cookies from analytics providers.

The marketing website (this site) uses no cookies. Our analytics (Umami) is cookieless by design — it identifies unique visits using a hash of the visitor’s IP + user-agent, discarded daily. There is no cookie banner because there is nothing to consent to.

If we make material changes, we will notify you by email (to your account email) at least 14 days before the changes take effect. The current version of this policy is always available at this URL.

This is version 1.2, published June 2026 (corrected infrastructure provider from Hetzner to DigitalOcean; corrected transactional email provider from Postmark to Resend; added GDPR article citations (Art. 6(1)(f) + Recital 49, Art. 6(1)(a)) to security-detection lawful bases; added G3 security alert email channel disclosure; added SecurityEvent, phishing verdict, and notification retention periods). Version 1.1 added the Phishing & Reach detection section and the HIBP sub-processor. Version 1.0 was published April 2026. Masquerade is a one-person company and we will be honest when this policy changes and why.