addy.io (formerly AnonAddy) is an open-source email aliasing and forwarding service run by Will Browning, a UK-based web developer, with mail and web servers hosted at Greenhost (Netherlands) and UpCloud (Netherlands/Poland). Its privacy policy states that emails are only stored on failed delivery and only if the user enables that option, that server logs are rotated daily and retained three days, that it will never sell, rent or share personal information, and that its site uses a self-hosted cookieless Umami analytics instance and no third-party cookies; disclosed third parties are Stripe and NOWPayments for payments, Amazon SES for the newsletter, and Cloudflare Turnstile on auth pages. Structural caveats: every forwarded message transits addy.io's servers in plaintext unless the user uploads a PGP key (which protects only inbound forwards), the operator is a single named individual with no legal entity or company registration published on the site (terms are governed by the law of England and Wales), and paid tiers fund the service. The application code is published under AGPLv3, and Securitum published a September 2023 penetration test and source-code audit report finding no significant vulnerabilities; no breach or regulatory action was found in this research.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
12 ON FILE
COLLECTION
addy.io's FAQ explains that monthly bandwidth is tracked as a single per-user byte counter incremented on forward/reply and reset each month, and that the operator deliberately avoids a rolling 30-day total because that would require logging the date and size of every email received — a stated data-minimization choice.
addy.io's Privacy Policy (last updated 4 September 2024) states that emails are only stored in the event of a failed delivery and only if the user has enabled that option, that Nginx access/error logs recording IP addresses and default Postfix logs are rotated daily and retained for three days, that name and card details are not stored in its database, and that the site sets only a small number of session cookies.
The anonaddy/anonaddy GitHub repository publishes the addy.io application source code under the GNU Affero General Public License version 3 (AGPLv3), the network-services copyleft licence, allowing anyone to inspect, audit, or self-host the running code.
addy.io's FAQ identifies the operator as Will Browning, a UK web developer, states the service provides him with an income and that he uses it daily, and describes a continuity plan: a person is in place who can keep paying for servers and domains if he is unavailable, and all addy.io domains are kept registered more than five years out. No company name or registration number is given.
addy.io's Terms of Service (last updated 14 September 2022) provide that the terms are governed by the law of England and Wales with the English courts having non-exclusive jurisdiction; the terms refer to 'the company' but do not name a legal entity, registered number or address.
Privacy Guides lists Addy.io as one of two recommended email-aliasing providers, under criteria that frame aliasing as requiring trust in the alias provider with unencrypted messages (mitigated by optional automatic PGP encryption of inbound mail), and notes Securitum's September 2023 audit found no significant vulnerabilities.
addy.io's Security page names the hosting providers handling user mail and data — mail.anonaddy.me at Greenhost.net (Netherlands), mail2.anonaddy.me at UpCloud (Poland), and the web application/database at UpCloud (Netherlands) — and describes opportunistic DANE TLS, MTA-STS, TLS-RPT, DNSSEC, SPF, DKIM and DMARC as the transport protections applied to mail relayed through the service; it also notes the September 2023 Securitum audit.
addy.io's Privacy Policy states it will never misuse, sell, rent, share or give away personal information to third parties, that server logs are disclosed only when compelled by law, and enumerates its third-party services: Stripe and NOWPayments for subscription payments (card data never touches its server), Amazon SES for newsletter delivery, Cloudflare Turnstile on auth pages, and UpCloud servers in the Netherlands for storage; recipient addresses, alias descriptions and public GPG keys are encrypted at rest with AES-256-CBC. The policy does not claim zero-access to forwarded email content, which transits its servers.
The published Securitum report (author Dariusz Tytko, Cracow, Poland; tests 16–29 August 2023, retest 15 September 2023) covers security tests of the app.addy.io web application and source-code analysis using OWASP Top 10/ASVS methodology, and records two LOW-risk findings (plan-limit bypass, username enumeration) both marked Fixed, plus five informational items on re-authentication and 2FA handling, one 'Partially implemented'.
In a 19 September 2023 blog post, addy.io announced it had passed an independent security audit by Securitum comprising a web-application penetration test of https://app.addy.io and a source-code audit; no significant vulnerabilities were identified, two low-risk issues were fixed and informational points addressed, confirmed by retest, with the full report linked.
addy.io's FAQ lists as product commitments 'No adverts', 'No analytics or trackers (just server access logs)' and 'No third party content', alongside open-source application code and bring-your-own GPG/OpenPGP encryption of forwarded emails.
addy.io's Privacy Policy states the site provides no third-party cookies and makes no effort to track visitors, does not use Google Analytics or other invasive tracking, and instead uses a self-hosted Umami analytics instance described as cookieless with no persistent identifiers and no cross-site or cross-device tracking; it separately discloses Cloudflare Turnstile as a bot-protection captcha on the login, register and password-reset pages.