Security

This page explains how Yellowbird protects your account and your mail, and where the limits of that protection are. For what we store and why, see the privacy notice.

In short

• You sign in with a passkey. There's no password to steal, reuse or guess.
• Yellowbird runs entirely on Cloudflare. We use no other hosting and no analytics.
• Your mail is encrypted when stored, but it isn't end-to-end encrypted. We could technically read it, so this page says exactly when we would.
• We only look at your mail when you ask us to, or when a court order requires it.
• If an authority asks us for your data, we tell you, unless the law forbids it.
• When you delete your account, your mail is deleted straight away.

How Yellowbird is built

Yellowbird is a single program running on Cloudflare Workers. It's made of a few parts, all run by Cloudflare:

• Receiving: Cloudflare Email Routing receives mail for your addresses and hands it to Yellowbird.
• Accounts: one database holds accounts, aliases, passkeys and plans.
• Your mailbox: every account has its own separate database for its mail, senders and settings, apart from every other account's.
• Storage: a full copy of each email, attachments included, is kept in a folder for your account. Files you send as links are kept there too.
• Sending: mail you send goes out through Cloudflare's email service.
• Digest summaries: if you turn on the daily digest on a paid plan, Cloudflare's Workers AI writes its summary from the subjects and previews of new mail in your inbox. The summary is plain text, and links in the digest are added by Yellowbird, never by the AI.

Cloudflare chooses where each part is stored, and we don't pin any of it to a region. Your data may be stored or processed outside the UK and the European Economic Area. The privacy notice explains how it's protected when it is.

Where your data is stored

What	Where	How it's kept
Your account, aliases, plan and passkeys' public halves	Accounts database	As is
Backup codes	Accounts database	Only as one-way hashes
Sign-ins	Accounts database	Only as a hash of each sign-in
Senders, recipients, subjects, previews and folders	Your mailbox's database	As is
Full emails and attachments	Storage, under your account	As received or sent
Files you send as links	Storage	As uploaded
Payment details	Creem, never Yellowbird	Under Creem's own policy

Cloudflare encrypts everything it stores for us. We don't add encryption of our own on top, so Yellowbird can read your mail to show, search and sort it. That also means that, technically, we could read it. The next sections explain when we would.

Signing in

• Passkeys only work on yellowbird.email, so a lookalike site can't use them. Each sign-in needs your face, fingerprint or PIN. We store only the public half of each passkey; the private half never leaves your device.
• Backup codes: you get 10, and each works once. We store them as hashes combined with a secret key, so even a copy of our database wouldn't reveal them. Repeated wrong guesses are slowed down, and after enough of them each try needs a human check.
• Alerts: using a backup code, adding or removing a passkey, or making new backup codes puts an alert in your inbox and notifies your devices.
• Staying signed in uses one cookie. Scripts on the page can't read it and other sites can't send it. It ends after 14 days without use, or after 90 days at most, and we store only a hash of it. You can sign out your other devices in Settings → Account.
• Sensitive changes, like deleting your account, removing a passkey, making new backup codes or signing out other devices, need you to have signed in or used your passkey in the last few minutes.
• Limits: sign-ins, sign-ups, sending and creating aliases are all rate limited, to slow down anyone trying to abuse them.

Who can see your data, and when

You

Your mail is shown only to you, when you're signed in. Nobody can sign in to your account without your passkey or one of your backup codes.

Yellowbird staff

Our admin tools show what we need to run Yellowbird and help you: your account details, plan, aliases, how many passkeys and sign-ins you have, how many folders you've made, and how many emails and how much storage each folder uses. They don't show your mail or your folders' names. Every change made with them, like suspending an account, is recorded.

Because we run Yellowbird, we could technically reach the data Cloudflare stores for us. We only look at the content of your mail:

• when you explicitly ask us to, for example to help with a support request, and only for that, or
• when a court order or warrant that's valid in England and Wales requires us to.

We don't read mail to investigate abuse. If we suspend an account, it's based on reports and on what our systems record, like how much is sent and which limits are reached, never on what's written.

Requests from authorities

If an authority asks us for your data, we'll tell you, unless the law forbids us. You're free to make the request public, and if you tell us you have, we'll confirm it's genuine to anyone who asks.

Authorities can also ask Cloudflare directly. Cloudflare explains how it handles these requests in its transparency report.

Companies that process data for us

• Cloudflare runs Yellowbird, and handles your data only as we instruct it.
• Creem handles payments. It gets our reference for your account, and collects your payment details itself.
• Your browser's push service delivers notifications, if you turn them on. They're encrypted so only your device can read them.

Reading mail safely

• Checking senders: Cloudflare checks each email's SPF, DKIM and DMARC. Yellowbird trusts only Cloudflare's own results, and ignores any a sender adds themselves. Mail that fails isn't bounced, but it never counts as coming from a sender you've approved, so it can't skip Screening or avoid a leak warning.
• Emails are shown in a sandbox. Scripts in them can't run, forms can't be sent, and they can't load anything from the internet until you choose to.
• Pictures are blocked until you choose Load images. Then your browser fetches them from the sender directly, which tells the sender your IP address and that you opened the email. Known trackers are pointed out so you can decide.
• Links open in a new tab, without telling the site where you came from.

Files you send as links

On a paid plan, large files are sent as links. Each link is long and random, so nobody can guess it, but anyone who has it can download the file, including anyone the email is forwarded to. It works until the email is deleted for good from your Sent folder and trash. Files you upload but never send are deleted after a day.

Linked files are always downloaded, never opened in your browser, so a file can't run anything on yellowbird.email.

Deleting your data

• Mail in the trash is deleted after 30 days. Deleting an email for good deletes its stored copy too.
• When you delete your account, we delete all of it straight away: your mail, files, mailbox and account. Deleted data can stay in our backups for up to 30 days before it's gone for good.
• We keep your username and alias addresses, so nobody can sign up with them and receive mail meant for you.
• Before you go, you can export your mail and aliases.

Protecting the website

• Yellowbird only works over HTTPS, and browsers are told never to connect to it over plain HTTP.
• Pages only run our own code, plus Cloudflare's human check when you sign up.
• Other sites can't show Yellowbird inside their own pages, which stops them tricking you into clicking something.
• We use one cookie, to keep you signed in, and nothing that tracks you.

Reporting a security problem

If you find a security problem in Yellowbird, email security@yellowbird.email. The address is also published in our security.txt.