mail.normake.com

Privacy.

The short version: we keep your address, your mail, and what's needed to sign you in, and nothing that says who you are. No name, no phone number, no IP addresses, no ads. Google Analytics counts visits to the public pages, never inside your mailbox. Our cookies only sign you in.

Last updated 16 October 2026.

What's kept

Your address
the name you picked, @normake.com, and any addresses you add on your own domains. On someone's own domain, the address its admin chose for you
Own domains
only if you bring one: the domain, your note to the postmaster, the results of the daily checks of its public DNS records, and the key that signs its mail (encrypted). When you ask, we look up where its mail goes today, in the public DNS. As its admin: the signature and blocked senders you set for everyone on it
Your password
as a salted Argon2 hash: enough to check it, not enough to read it back
Your name
only if you add one in Settings → Writing. It goes in the From line of the messages you send, so the people you write to see it
Passkeys
only if you add one: its public key, the name you see in Settings → Security, and when it was added and last used. The private key never leaves your device
App passwords
only if you make one for a mail app: its name, a hash of it, and when it was made and last used
Recovery email
optional, and only as an Argon2 hash. When you ask for a reset, we check the address you type against it and send the code there
Your mail
messages you receive, send and draft, with their attachments; your folders, filters, blocked and trusted senders, the senders whose pictures you chose to show, and your signature
Agenda
the people you save there: name, address, and a phone and note if you add them
Auto-reply
if you turn it on: its message and dates, and which addresses it answered and when, so each gets it at most once every 4 days
Forwarding address
if you turn forwarding on: the address, encrypted, after you confirm it with a code we email there
Signed-in devices
a label like “Firefox on macOS”, the two-letter country Cloudflare reports, and when the device was last used. Never the IP address. You can see these and sign them out in Settings → Security
Wrong passwords
the time of each, to pause sign-in for 15 minutes after five. Deleted after a day

Mail is stored on the server as it arrived, so it can be shown and searched. It isn't end-to-end encrypted. Messages keep the headers they arrived with, which include the servers they passed through, as all email does.

If you ask for an address

We keep the address you asked for and your note. If you leave an email for the invite, it is stored encrypted and deleted as soon as your request is approved or declined.

What isn't kept

The main cookie is mail_session. It keeps you signed in, can't be read by scripts, and stops working after 30 days without use or when you sign out. With two-step sign-in on, two more: mail_2fa holds your sign-in for up to 10 minutes between the password and the code, and mail_trusted, only if you tick "Don't ask again on this device", skips the code there for 30 days. Your authenticator app's key is stored encrypted, and your backup codes only as hashes. On the public pages, Google Analytics sets its own cookies (_ga and _ga_…) to tell one visit from another.

Pictures in incoming mail that load from other sites are blocked until you choose to show them, because loading one tells the sender you opened the message.

Who else handles it

Cloudflare
Visits to mail.normake.com pass through Cloudflare, which protects the site and sees visitors' IP addresses under its own policy.
Brevo
Our server delivers mail to addresses outside normake.com itself, straight to the recipient's mail server, and so the codes we send to recovery emails, your auto-replies and the copies forwarding sends. Only some go through Brevo (France) instead: mail to addresses whose mail Microsoft handles (Outlook, Hotmail and many companies), and mail another server wouldn't take from ours. Brevo sees those messages and their recipients and keeps delivery records under its own policy, and adds a small tracking image to them, which can tell Brevo when a recipient opens one; we don't ask for or receive those reports. Mail between normake.com addresses never leaves our server.
Google Analytics
The public pages load Google Analytics while you're signed out. It counts visits: which page, where the visit came from, the browser and device, and a rough location Google works out from the visitor's IP address, under Google's own policy. Invite codes are taken out of the page address before it's sent. It isn't on any page you see once you're signed in, and never sees your mail.
Apple and Google
Only if you turn notifications on in the app you added to your home screen (Settings → Notifications). Waking a phone has to go through the maker of its browser: Apple's push service for an iPhone or iPad, Google's for Android, under Apple's and Google's own policies. What we send them contains nothing readable at all — not who wrote to you, not the subject, not even how long the message is; every push we send is the same size. They do see that your phone was sent something at that moment. Your phone then asks us for the words, over your own connection. Turning notifications off stops it, and nothing is sent to them otherwise.
Hetzner
Incoming mail reaches us through a small server at Hetzner (Germany), which passes the connection along and stores nothing.
Spam checks
run on our own server. Like every mail server, ours looks up the sending server and the links in a message in public spam blocklists.

Nothing is sold or shared with anyone else, unless the law requires it.

What the postmaster sees

The postmaster runs normake.com and has a page for spotting abuse. It shows each address, when it was made, how many messages it sent today and this month, and the most recent recipients mail went to, with whether each was delivered. It doesn't show what anyone's mail says.

Whoever runs a mail server can, technically, read the mail stored on it. The postmaster doesn't, except when you ask for help with a specific message, or when the law requires it.

Own domains: what an admin sees

If someone invited you onto their own domain, its admin sees your address, the name you added in Settings if any, when you joined, how much storage you use, and whether your address is suspended. Never your mail, your Agenda, your settings or who you write to, and they can't sign in as you. They can suspend your address or remove it; removing it deletes your mail.

The admin's domain-wide signature, if they set one, can go under the mail you send from it. Their blocked senders apply to mail sent to everyone on the domain.

For an own domain, the postmaster sees the domain, its admin, how many addresses and people it has, how its DNS checks went, and how much mail it sent and bounced in the last 30 days.

How long it's kept

Mail
until you delete it. Trash and Spam are emptied after 30 days
Signed-in devices
until you sign out, or after 30 days unused
Reset and confirmation codes
until they expire
Sending records
recipient, time and outcome, for as long as the address exists
Own domains
until the domain is removed. A removed address's name is held for 30 days, so mail meant for its last owner doesn't reach a new one straight away
Everything else
until the address is closed

Your data, your call

You can change your password and your recovery email, and sign out other devices, in Settings. Settings → Security also downloads all your mail as one file that other mail apps can import, and brings mail in from such a file; the file you upload is deleted once its mail is filed. You can close your address and delete everything in it there too. Under the GDPR you can also ask what we hold about you, have it corrected, or complain to Romania's data protection authority, ANSPDCP.

mail.normake.com is run by Antoniu-Mihai Temian. See also the terms of use.