SimpleLogin is an open-source email-aliasing service (web app, browser extensions, iOS/Android apps) that forwards mail sent to disposable aliases to a user's real mailbox and lets users reply through reverse-aliases. The project started in 2019, was incorporated as SimpleLogin SAS in Paris in 2020, joined Proton on 2022-04-08, and moved its legal domicile to Proton AG (Switzerland, register CHE-354.686.492) on 2024-01-01; the server code is published under the AGPL v3. Its privacy policy states that emails are not stored — a message is deleted once delivered, undeliverable messages are kept 7 days, IP addresses appear only in mail/web-server logs deleted after 7 days — but also discloses that, due to SMTP, the operator can see sender/recipient addresses, originating IP, subject and timestamps, and that unencrypted inbound mail is scanned for spam and viruses; forwarded content is readable in transit unless the user enables optional PGP. It states it will never sell personal data, names infrastructure subprocessors (Proton and UpCloud hosting, Paddle and Apple payments, Zendesk, Cloudflare DNS, hCaptcha) and uses cookieless Plausible analytics. Securitum audited the web and Android apps in 2022 with no critical findings, and a 2022 bug bounty was folded into Proton's general program in November 2024; no breach or regulatory action involving SimpleLogin was found in this research.
TIMELINE
NO ENTRIES ON FILE YET.
ULTIMATE PARENT
TOOLS WE RECOMMEND
PLUS
RECEIPTS
14 ON FILE
COLLECTION
SimpleLogin's security page states that user data is stored in an encrypted-at-rest PostgreSQL database backed up daily with backups older than 7 days deleted, and that UpCloud Object Storage holds profile pictures and temporarily bounced emails, which are deleted after 7 days — the one place message content is retained by the operator (note the privacy policy separately says database backups are kept up to 14 days).
SimpleLogin's privacy policy (updated 2025-09-15) states the service does not store emails — a message is deleted from its servers as soon as it reaches its destination — while undeliverable messages are kept 7 days, IP addresses appear only in Postfix/Nginx logs deleted after 7 days (retained permanently only for abuse), and account deletion purges backups and logs within 30 days; it also discloses that due to SMTP the operator can see sender/recipient addresses, originating IP, subject and send/receive times, plus per-account activity counts.
SimpleLogin's server application is published on GitHub under the GNU Affero General Public License version 3, a copyleft license that also covers network-server use, so anyone can inspect the running code or self-host their own instance.
SimpleLogin's About page states the project started in 2019, the company SimpleLogin SAS was created in 2020, that SimpleLogin joined Proton at the beginning of 2022, and that SimpleLogin is now the product of Proton AG, registered in Switzerland under number CHE-354.686.492.
Proton's announcement of 2022-04-08, by CEO Andy Yen, states that SimpleLogin joined Proton, that SimpleLogin functionality would be integrated into Proton Mail in the following months, and that SimpleLogin — described as a French open-source company — would continue as a separate service on Proton's infrastructure.
A SimpleLogin blog post dated 2024-01-01 states that its legal domicile moved from France (SimpleLogin SAS, Paris) to Switzerland, so that the contractual relationship with users is now with Proton AG, that law-enforcement data requests must go through the Swiss legal system, and that SimpleLogin no longer faces potential French data-retention obligations.
Proton's support documentation states that, through SimpleLogin's integration into the Proton ecosystem, a user can create a SimpleLogin account linked to their Proton Account and that Proton creates the SimpleLogin account using the user's Proton email address — a documented linkage between the aliasing service and the parent's mail identity.
SimpleLogin's FAQ states that its servers are provided by Proton and by UpCloud, a Finland-based cloud provider, and that SimpleLogin does not store emails — they are stored in the user's own mailbox — placing the operator's data-holding role at relay-and-forward rather than mailbox storage.
SimpleLogin's own PGP announcement states that without PGP, emails sent to an alias are forwarded as-is, leaving anyone in between or the destination email service able to read them, and that with PGP enabled (a paid-plan feature) inbound emails are encrypted with the user's public key on SimpleLogin's server before forwarding — the relay is a point of in-transit visibility unless the user opts in.
SimpleLogin's privacy policy states it will never sell personal information, that its default practice is not to access user information, and that access or sharing occurs only with the user's consent for support, when investigating abuse, or under a warrant or court order (with notice unless legally barred); it names infrastructure processors only — Paddle and Apple for payments, Zendesk for support, Cloudflare for DNS, hCaptcha, and hosting by Proton and UpCloud in Germany, Switzerland, the Netherlands and France — and discloses that unencrypted inbound mail is scanned for spam and viruses.
SimpleLogin announced on 2022-06-15 that it commissioned Securitum, a European security auditing firm, to audit its web app and Android app (browser extensions and iOS excluded), that the final report was overall positive with the only important issue already addressed and no critical vulnerability found, and published the full web and Android reports for download.
SimpleLogin launched a public bug bounty program on 2022-10-05 with published scope (simplelogin.io, app. and api. subdomains, extensions and mobile apps), qualifying vulnerability categories and disclosure rules modelled on Proton's program; a 2024-11-07 update states the program is now superseded by Proton's general bug bounty program.
Privacy Guides lists SimpleLogin as one of its two recommended email-aliasing providers under its published criteria for the category, noting the April 2022 acquisition by Proton AG and the option to link a SimpleLogin account to a Proton account.
SimpleLogin's privacy policy discloses cookieless, no-PII Plausible web analytics, hCaptcha on the login and registration pages, and possible mobile crash-reporting analytics in the native apps, and states the apps never access or track location; no advertising or cross-site tracking SDK is disclosed.