Herkos privacy policy
Last updated: 12 September 2026. Canonical URL: https://herkos.app/privacy
Herkos is a free, open-source mail client for the Nostr network, published by the Herkos project ("we"). This document explains what data the app handles, where it goes, and who can see it. We wrote it to be read, not skimmed: if something here surprises you, tell us at privacy@herkos.email.
The short version
- Herkos has no account system, no server of its own and no analytics. We do not receive your messages, your contacts, your key or your usage.
- Your Nostr public key is your identity on the network. Anything you publish on Nostr (profile, relay lists, labels) is tied to it and visible to the relays you use.
- Mail between Nostr users is end-to-end encrypted (NIP-17). Mail to or from traditional email addresses passes through a bridge that can read it.
- Some optional features send data to third parties (push notifications, scheduled sending). They are off until you turn them on, and this document names each of them.
Data that stays on your device
- Your secret key (nsec), when you log in with it, is stored in the operating system's secure storage (Android Keystore, iOS/macOS Keychain, Windows Credential Manager, libsecret on Linux, encrypted local storage on the web). If you log in with a remote signer (NIP-46 "bunker"), the key never reaches the device.
- Your mailbox: decrypted emails, attachments, labels, folders and contacts are cached in a local database so the app works offline. The database is not encrypted beyond what the operating system provides; the app lock (PIN/biometrics) is a convenience barrier, not encryption at rest. On Android the app is excluded from cloud and device-to-device backups.
- App lock PIN: stored as a salted, stretched hash (PBKDF2), never in plaintext.
You can erase all of it from Settings → More → Reset application, or by removing an account.
Data that leaves your device, and to whom
| Recipient | What they can see | When |
|---|---|---|
| Nostr relays (default list in Settings → Network, editable) | Your IP address, your public key, the events you publish (profile, relay lists, Blossom server list, NIP-32 labels, encrypted settings) and the encrypted "gift wraps" addressed to you, plus their timing. Relays cannot read the content of gift wraps. | Always, while the app syncs. |
| Blossom servers (editable) | Your IP address and public key, and the encrypted blobs of emails larger than 32 KB and their attachments. The key to decrypt a blob travels only inside the encrypted message. | When you send or open a large email. |
Bridges (nostrmail.org and uid.ovh by default, editable) |
The full content of any email you send to, or receive from, a traditional email address (Gmail, Outlook…), and the alias name@bridge you register. Bridges are independent operators with their own privacy terms; Herkos does not run them. |
When you use a @bridge identity or write to a non-Nostr address. |
| NIP-05 servers (the domain of an address you type) | That someone asked whether name@domain is a Nostr user. |
When you add a user@domain recipient. |
Push server (api.nmail.li, operated by the upstream Nostr Mail project; configurable at build time) |
Your public key, a device push token (FCM or UnifiedPush endpoint), your notification language, and — because it watches relays on your behalf — when you receive mail (not what it says). | Only if you turn on notifications for an account. Turning them off asks the server to delete the subscription. |
Scheduler DVM (a Nostr service run by a third party, see NostrConfig.schedulerDvm) |
Your public key, the already-encrypted messages to publish, their destination relays and the scheduled time. | Only if you use "send later". |
Remote signer / relays for NIP-46 (relay.nsec.app and fallbacks) |
Your public key and encrypted signing requests. | Only if you log in with a bunker or signer app. |
| Google (Firebase Cloud Messaging) | A push token and delivery metadata. | Only in the Google-services build (nmail_standard), and only with notifications on. The FOSS build uses UnifiedPush instead and never contacts Google. |
Herkos itself receives none of this. There is no crash reporting or telemetry.
Public by design
Nostr is a public network. These things are visible to anyone who queries the relays you use, and are linked to your public key:
- your profile (name, picture) and relay/Blossom server lists;
- NIP-32 label events the app publishes when you mark an email as read, star it, archive it or move it to a folder — including the name of custom folders. A sender who knows the id of the email they sent you can therefore tell when you read it. We plan to encrypt these; until then, be aware of it.
Your choices and rights
- Everything above is under your control in Settings → Network and servers (relays, DM relays, Blossom servers, bridges) and Settings → Notifications.
- You can export your key, remove an account (which also asks relays to delete your data, NIP-62) or reset the app at any time.
- Because we hold no personal data, we cannot answer access, rectification or erasure requests ourselves; direct them to the operator of the relay, bridge or push server concerned. We will help you identify it.
- Herkos is not intended for children under 16.
Changes
We will change this document when the app's behaviour changes, and record the
date at the top. The source of truth is PRIVACY.md in the repository; the
published page is a copy of it.
Contact: privacy@herkos.email · https://herkos.app