This is a translation provided for convenience. The French version is the only legally binding text. Version française

Privacy

Updated on 14 October 2026

Hexomail is an email client: it reads and sends your email on your device, connecting directly to your provider's servers (Gmail, Orange, your hosting provider…). This page describes, without exception, what leaves your device, to whom and why.

Data controller: Hexonest SAS (see the legal notice). Contact for any question about your data: bonjour@hexonest.fr.

1. What stays on your device

Your messages, attachments, folders, the search index and the image cache: in an encrypted local database.
Your email passwords and Google sign-in tokens: in the system keyring (Linux) or Android's encrypted storage.
Your private HexoTransfert keys.
Your address book: the addresses you write to and that write to you, and, if you ask for it, the contacts on your phone (Android, “Contacts” permission) or on a CardDAV server you specify. Only names and email addresses are read; nothing is sent to Hexonest.

Hexonest has no access to any of this data.

2. What goes through our servers, and only in these cases

Service	Data transmitted	Retention
Configuration detection, when adding an account	The domain name of the address (the part after “@”), never the full address.	The settings found are kept per domain, with no link to you.
Image proxy (subscribers, optional)	The address of the images you choose to display.	No addresses in our logs, only aggregate counters. Image cache: 24 h.
Destination of an opaque link (subscribers, on request)	The address of the link, at the moment you ask to reveal it.	No addresses in our logs.
Hexomail account (optional)	Your verified addresses, a hash of your password (scrypt), your credits, orders and subscription.	As long as the account exists. After it is deleted, accounting records (amount, date, payment reference) are kept for 10 years, without your email address.
Payment (purchase of credits or subscription)	On computers, your email address and your payment are processed by our payment provider, Stripe; on Android, by Google Play. We never see your card number.	According to these providers' obligations; on our side, like the accounting records above.
HexoTransfert	Your public keys, which can be looked up by people who send you files; the history of key lookups (sender's address, address looked up, date).	Keys: as long as you publish them. Lookups: 12 months, then deleted automatically.
Sync between your devices (optional)	Your accounts (without passwords), signatures and settings, end-to-end encrypted with a key that only your devices have.	As long as sync is active; unreadable to us.
Web version (see below)	The exchanges between the browser and your device, end-to-end encrypted: unreadable to us. Our server sees the IP addresses, the time and the size of the exchanges.	The exchanges are not stored: the relay passes them on in memory, for the duration of the session (12 h at most).
Adding a device	An envelope encrypted for the new device only, relayed by our server.	10 minutes at most, deleted as soon as it is received.
Sending a newsletter (list members)	The app fetches the addresses of the list's subscribers to send each of them their own copy, from your own mail server.	The addresses are not kept on the device; only the progress of the send is.
Subscribing to a mailing list	The address and name you provide, and proof of your consent.	As long as you are subscribed (see Mailing lists).
Address verification code	A message sent to the address being verified.	The code expires after 30 minutes.

Our servers' technical logs contain neither the content of your messages nor the addresses of images or links.

3. Google data (Gmail)

For a Gmail account connected with Google, Hexomail requests full access to Gmail (https://mail.google.com/), the only way to fetch and send your messages over IMAP and SMTP, as well as your address and profile picture.

Signing in to Google and exchanging tokens happen on your device; your Gmail messages and Google tokens never pass through Hexonest's servers.
The image proxy and automatic link revealing are disabled for these accounts, unless you enable them yourself.
Google tokens are never sent to another device, not even when adding a device: each device signs in to Google itself.
This data is used only to display your messages and let you manage them. It is not sold, nor used for advertising, nor to train artificial intelligence models.

Hexomail's use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Web version

The web version (mail.hexonest.fr/app) displays in a browser the messages that your Hexomail device sends to it. Your device is what connects to your email provider; the browser has neither your passwords nor your sign-in tokens.

Encryption: the browser and your device exchange end-to-end encrypted data, with keys created for the session and known only to them. Our server relays this data without being able to read it and does not store it.
Data seen by our server: the IP addresses of the browser and of your device, the time and size of the exchanges, the Hexomail account of the device serving the session. This data is used only to route the exchanges and to limit abuse; the relay does not keep it after the session.
In the browser: messages stay in the page's memory, without cookies or local storage, and are erased at the end of the session. Only the web app's files are cached.
Gmail accounts: accounts connected with Google are not accessible from the web version; no Gmail data obtained through Google APIs passes through it.
Limitation: the code of the web version is served by our website, and it is this code that decrypts the messages in the browser. A modified version could read them. We publish the fingerprint of each version so that a modification can be detected, but the web version remains less protected than the apps (see Data and security).

5. Mailing lists

Hexonest hosts mailing lists (newsletters) in France. There are two cases, depending on who sends the list.

Hexonest's lists

For its own lists, such as “Nouvelles d'Hexomail” (Hexomail news), Hexonest is the data controller.

Purpose: to send you the newsletter you signed up for, and nothing else. No third-party advertising, no resale, no matching with other data.
Legal basis: your consent, given by double confirmation: you tick the box, then you confirm through the link received by email. You can withdraw it whenever you like with the unsubscribe link in every message, or by writing to us.
Data: your address and, if you provide it, your name; as proof of your consent, the date, the IP address, the sign-up page and the text you accepted.
Protection: the address and name are encrypted in our database. Only the people in charge of the list have access to them.
Retention: as long as you are subscribed. An unconfirmed request is erased after 30 days. After you unsubscribe, we keep only a non-reversible fingerprint of the address, so as never to write to you again, even if the address is re-imported.
Sending: messages are sent from our mail server, hosted by HostNatPro in France, or from the sending server chosen for the list.

Lists from other senders

When a list is managed by another organisation, that organisation is the data controller: it decides what it sends you, and it is to that organisation that you address your requests. Its name and contact details are shown on the sign-up form and in every message. Hexonest then acts only as a processor (Article 28 GDPR): we host and send the list on its behalf, with the same protections, without using your data for ourselves. The unsubscribe link works in all cases, and we forward to the sender any request that reaches us.

6. This website

This website sets no cookies. It counts its visits anonymously with Umami, a free and open-source analytics tool that we host ourselves, on our servers in France: it is the only resource the website loads apart from its own files.

What is measured: pages viewed (without the address parameters), the site you came from, the type of browser, operating system and device, the language, the country and page load times.
What is not: your IP address is used only to infer the country; it is not kept. No cookies, no identifier that follows you across other websites, no recording of your clicks or movements.
If your browser asks not to be tracked (“Do Not Track”), your visit is not counted.
Use: knowing which pages are read and which are slow. These statistics are not sold, shared or used for advertising.
Retention: 25 months at most.

The web version uses no analytics tool; it connects only to our relay.

7. Support (support.hexonest.fr)

The help center and the support chat run on Libredesk, a free software that we host ourselves, on our servers in France.

Audience measurement: help center pages are counted like the pages of this website (see This website): anonymously, without cookies, and without the searches you type there.
If you write to support: we receive your name, your email address, your messages and their attachments, as well as the address and title of the help center page you are on. They are used only to answer you and follow up on your request.
Cookies: once you start a conversation, the chat sets two technical cookies, valid for one year, so that you can find your conversation again. They serve no other purpose and are not set if you do not write.
Who has access: the members of Hexonest's support team. The team is alerted to a new request by our own notification server, with your name only.
Retention: 3 years after your last message, then deleted. You can ask for earlier deletion (see Your rights).

8. Hosting

Our servers are hosted by OVH SAS, in its Gravelines data centre, in France. Payments are processed by Stripe Payments Europe (Ireland) on computers and by Google Ireland on Android. Verification codes and security alerts are sent by our mail server, hosted by HostNatPro, in France.

9. Your rights

You can access your data, have it rectified or erased, object to its processing or request its portability by writing to bonjour@hexonest.fr. You can delete your Hexomail account yourself, in the app, or ask us to do it (how): your addresses, published keys, sessions, credits, subscription and synced data are erased; only the accounting records of your purchases are kept, without your email address. For a mailing list, the unsubscribe link is enough; for the complete erasure of your subscription, write to the sender of the list. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

10. Minimum age

Hexomail is intended for people aged 16 or over. We do not knowingly collect data about younger people: if you believe that a Hexomail account has been created by someone under 16, write to bonjour@hexonest.fr so that it can be deleted.