Fastmail

PRODUCTIVITY & CLOUD

LAST UPDATED 4 AUG 2026

OF 100

PARANOIA SCORE

WHAT THE POLICIES SAY

Fastmail is a paid email, calendar, and contacts service operated by Fastmail Pty Ltd, an employee-owned Australian company (staff bought the business back from Opera Software in 2013). Its business model is subscriptions rather than advertising: the privacy policy states it does not sell personal information, and the service ships anti-tracking features such as anonymous remote-image proxying and Masked Email aliases. Fastmail deliberately does not offer end-to-end or zero-access encryption — user data sits on encrypted disks whose keys Fastmail controls, so servers can read mail for search and spam filtering and can be compelled to decrypt it. As an Australian provider it operates under the Privacy Act, TOLA-era surveillance law, and a US CLOUD Act agreement in force since January 2024; it publishes an annual data transparency report and has no publicly known customer-data breach.

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

16 ON FILE

COLLECTION

Fastmail's current privacy policy (successor to the archived April 2026 version) states that signing up for or using its services involves collecting name, primary username, billing and contact details, organization and domain names, and technical data such as IP address and browser type; technical data including IP addresses and client identifiers is logged for security, troubleshooting, and auditing, and account data is deleted within seven days after account closure.

fastmail.com ↗

[2020-06-24] · COLLECTION

As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service allow you to permanently delete your personal data? — Yes, using an automated mechanism.

privacyspy.org ↗

[2025-12-17] · COLLECTION

In a December 17, 2025 explainer on email encryption, Fastmail states that it does not offer end-to-end encryption and that user data is stored on encrypted disk volumes whose keys remain under Fastmail's control, meaning the service itself can read message content in order to provide server-side search, phishing detection, and malware prevention.

fastmail.com ↗

OWNERSHIP TRANSPARENCY

Fastmail's current privacy policy identifies the operating entity as Fastmail Pty Ltd, an Australian company with ABN 31 142 646 580, based at PO Box 234, Collins Street West, VIC 8007, Australia, as the party responsible for personal information provided through its services.

fastmail.com ↗

[2013-09-25] · OWNERSHIP TRANSPARENCY

In a September 25, 2013 announcement, FastMail stated that its developers and staff had purchased the business back from Opera Software (which had acquired it in 2010), making it an independent, staff-owned company.

fastmail.com ↗

[2020-06-24] · OWNERSHIP TRANSPARENCY

As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Yes.

privacyspy.org ↗

SHARING

Fastmail's current privacy policy states that Fastmail does not sell personal information, that messages reported as spam may be shared with trusted anti-spam partners, and that as a global business it may transfer personal information to countries including the US, UK, Australia, India, and Austria, which may have different data protection laws.

fastmail.com ↗

SHARING

Fastmail's Data Transparency Report states that under the Australian Privacy Principles it cannot disclose information to foreign authorities and complies only with requests made through Australian law enforcement, as amended by the Australia–US CLOUD Act agreement whose processes came into force in January 2024; for 2024 it reports 16 valid law-enforcement requests of which 13 were actioned, including 8 for stored communications (email content).

fastmail.com ↗

[2019-02-28] · SHARING

In a February 28, 2019 blog post on Australia's Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018, Fastmail described the law as allowing law enforcement to compel companies to modify their services and intercept customer data in unencrypted form, stated that its own business is not directly affected because it does not offer end-to-end encryption, and said it would not change its technology or policies in response, while acknowledging some customers discontinued service over the legislation.

fastmail.com ↗

[2020-06-24] · SHARING

As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — No.

privacyspy.org ↗

TRACK RECORD

Fastmail publishes a Security Issue Reporting page setting out a funded bug bounty with named scope: qualifying bug classes are enumerated (authentication/session management, XSS on www.fastmail.com or beta.fastmail.com, CSRF, remote code execution, privilege escalation), specific exclusions are listed, bounties run from a minimum of US$100 to a maximum of US$5,000 paid monthly via PayPal, and the responsible-disclosure terms commit Fastmail to investigate reports promptly and not to take legal action against researchers who follow the policy.

fastmail.com ↗

TRACK RECORD

Fastmail's privacy help article states that the company has not pursued formal SOC (System and Organization Control) certification, though it says it applies SOC principles to its work, and that it reviews law-enforcement requests for legitimacy, proportionality, and accuracy, notifying accountholders of requests for their information wherever possible.

fastmail.help ↗

TRACK RECORD

Fastmail publishes an annual Data Transparency Report with per-year counts of law-enforcement requests from 2021 through 2025, broken down by origin (mutual assistance treaty, Australian Federal Police, state police) and content type, and states that every request is checked for legal validity before being actioned and that only valid requests are actioned.

fastmail.com ↗

[2021-10-26] · TRACK RECORD

In an October 26, 2021 post, Fastmail disclosed that it had been targeted that week by a ransom-motivated DDoS attack (traffic exceeding 270 Gb/sec against a normal load under 10 Gb/sec) alongside other email providers, stated that it never pays extortionists, and reported that no customer mail was lost and customer data remained safe.

fastmail.com ↗

TRACKING TECH

Fastmail's privacy features page states that remote images in email are fetched anonymously through Fastmail's servers so that senders cannot use tracking pixels to learn a recipient's location, device, or reading behavior, and that its Masked Email feature issues a unique address per login that companies cannot link together to track users.

fastmail.com ↗

TRACKING TECH

Fastmail's privacy help article discloses that its marketing website uses cookies to track whether a visitor is owed a signup discount from a referral or marketing campaign and to understand which pages are useful, while stating that Fastmail does not sell or monetize confidential customer data or aggregate customer data.

fastmail.help ↗

DATA SOURCES

PrivacySpy

CC BY · PRIVACYSPY.ORG ↗

Claims are summarized from these sources and may be edited from the original.

LAST REVIEWED 2026-08-04 · METHODOLOGY v1.7