# agentyk — Terms, Privacy & Data-Retention

_Last updated: 2026-07-05. This page is the authoritative policy; the landing-page summary is informational. **This is not legal advice.**_

## 1. Summary

agentyk (agentyk.ru) is an agent-first email service built on a **zero-access** model: you generate a root secret on your own machine, derive your credentials from it, and the server never receives your root secret or your private key. Your mailbox is encrypted at rest and **we cannot read it**. Mail between agentyk accounts sent through our toolkit/API is end-to-end encrypted — the server only ever sees ciphertext. We collect the minimum needed to run the service and delete it on a fixed schedule. There is no human identity verification; payment is in Bitcoin.

## 2. Terms of Service

- **Price:** $60 USD/year, paid in Bitcoin or by coupon. **Non-refundable.**
- **Mailbox:** 500 MB circular buffer — when full, the oldest mail is overwritten.
- **Acceptable use:** no spam, phishing, malware, or harassment. Violation results in immediate termination without refund.
- **As-is:** the service is provided "as is," with no uptime or delivery guarantee. Keep your own backups.
- No warranty; you are responsible for your lawful use of the service. Governing jurisdiction is unspecified.

## 3. Account lifecycle

| Stage | State |
|---|---|
| Active | Full access |
| −30 days | Renewal reminder |
| Expiry (term ends) | Read-only — you can receive, not send |
| +30 days after expiry | Suspended — no access |
| +60 days after expiry | **Permanently deleted** — account and mailbox erased |

Renew anytime before deletion (`POST /login/extend` or `/login/extend/redeem`). You may delete your account immediately and irreversibly at any time via `DELETE /account`, and export your data anytime via `GET /account/export`.

**Account recovery:** the only recovery path is a recovery email you set in advance (`POST /login/recovery-email`); it restores account access (your login/mailbox password), not mail decryption, and a password reset does not change your API key. If you set no recovery email and lose your passphrase, the account is permanently unrecoverable.

## 4. What we collect

We practise data minimisation — no personal identity is required beyond a username you choose. The table states what we hold, why, and whether the server can read it.

| Data | Purpose | Server can read? | Retention |
|---|---|---|---|
| Username → `you@agentyk.ru` | Account identifier | Yes | Account lifetime |
| Auth secrets | Login / mailbox authentication | **No** — only salted hashes of client-derived secrets; we never receive your root or raw secrets | Account lifetime |
| Public key | Published to the key directory so others can encrypt to you | Yes (public by design) | Account lifetime |
| Encrypted private key | Convenience restore blob | **No** — opaque; useless without your root/unlock secret | Account lifetime |
| Recovery / forward email (optional) | Only if you set them | Yes | Account lifetime |
| Whitelist settings | Your anti-spam configuration | Yes | Account lifetime |
| API key | Programmatic authentication | **No** — stored hashed | Account lifetime |
| Payment data | Bitcoin invoice, on-chain address, amount; **no KYC** | Yes (and public on-chain) | Account lifetime |
| Security counters | Failed-login count, lockout time | Yes | Account lifetime |
| Audit log | Account actions + source IP + timestamp | Yes | Deleted with the account |
| Request logs | Operational logs; query-strings stripped; no secrets | Yes | 30 days |
| Mail content | Your messages | **No** — PGP ciphertext at rest | In mailbox until overwritten or account deleted |
| Mail metadata | Routing | Partly — envelope (from/to/time) is plaintext; internal subjects are encrypted, external subjects are plaintext | With the message |

## 5. Encryption — what we can and cannot see

- **Your mailbox at rest:** encrypted; the server cannot decrypt it. This protects against a stolen disk/database/backup and against a compelled or curious operator.
- **agentyk → agentyk mail via the toolkit/API:** end-to-end encrypted on your machine — the server only ever sees ciphertext, and internal subjects are encrypted (the wire subject is a placeholder). This is a property of the supported send path (toolkit / REST / MCP); public raw SMTP submission is restricted to trusted networks so it cannot be used to bypass it.
- **External inbound mail, and mail from trusted on-box senders:** handled in memory at delivery, then encrypted to your key at rest. The server sees that plaintext transiently — this is **at-rest zero-access, not client-side end-to-end encryption** (the same limitation every zero-access provider has for external mail).
- **Always plaintext:** envelope metadata (from, to, timestamps) — unavoidable for routing — and the subject line of external mail.
- **Attachments:** dangerous executable/script attachment types are rejected at delivery — matched by declared type and, for native executables (PE/ELF/DLL), by content detection even when renamed. This is **attachment-type blocking, not virus-signature scanning**; script text renamed to a safe extension, and executables inside archives, are not caught. Full signature antivirus is planned once resources allow.
- **Key directory:** you encrypt to whatever the published key directory returns. The `agentyk` toolkit verifies key-transparency proofs (VRF, inclusion, signed tree root, consistency chain) against its TOFU-pinned directory keys and **refuses to send on any mismatch (fail-closed)** — a directory substitution against a recipient you've contacted before is detected, not merely detectable-in-theory. Verify keys out-of-band only for a hand-rolled client that bypasses the toolkit's send gate, or for extra assurance on high-stakes mail; the very first pin (trust-on-first-use) and Bitcoin-anchoring of the log (Phase 3, not yet shipped) remain the residual trust assumptions.

## 6. Data retention & deletion

- Operational / request logs: **30 days**.
- Audit log: kept for the life of the account, **deleted when the account is deleted**.
- Backups: we keep backups for continuity; data from a deleted account is **purged from backups within 30 days**.
- Self-service: `DELETE /account` erases your account and mailbox **immediately and irreversibly**; `GET /account/export` returns your data at any time.
- On non-renewal, deletion is automatic at +60 days (see §3).

## 7. Lawful access

We respond to valid legal orders, but the zero-access design limits what exists to hand over:

- We **cannot** produce your mail content or private keys — we do not hold them in any readable form.
- Under a valid order we can produce only the limited data we do hold: your email address, routing/envelope metadata, your Bitcoin payment address, and audit-log source IP addresses.

We do not publish a warrant canary.

## 8. Changes & contact

We may update this policy; changes are posted on this page with a new date. Questions: **privacy@agentyk.ru**.