Protonmail is cop friendly. Any reasonable privacy aware email provider would hash the secondary email, not store it as cleartext. I implemented secondary email hashing for Riseup to prevent exactly this thing, over a decade ago.
https://restoreprivacy.com/protonmail-discloses-user-data-leading-to-arrest-in-spain/
Here's a list of nice tech collective that host different services for people, including emails. A good part of them don't require invite.
@elijah IP addresses are not logged by default, and you can see when they are in our Privacy Policy: https://proton.me/legal/privacy
Nothing has been reengineered - this is how it's always worked, and we have been transparent about it since we started in 2014: https://proton.me/blog/protonmail-threat-model
You may be referring to Proton VPN, which is a completely no-logs service: https://protonvpn.com/blog/transparency-report
@elijah Swiss jurisdiction remains superior when it comes to privacy protection, as we have discussed with our community e.g. here: https://www.reddit.com/r/IAmA/comments/10y49ln/comment/j7w6kx4/ and here: https://www.reddit.com/r/IAmA/comments/10y49ln/comment/j7w7pbh/
Email privacy in particular, is better protected since our court victory in 2021: https://proton.me/blog/court-strengthens-email-privacy
Login IP addresses are simply not logged by default, and, no, they have not been logged in this particular case either.
@protonprivacy from that link:
2.5 IP logging: By default, we do not keep permanent IP logs in relation with your Account. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our terms and conditions (e.g. spamming, DDoS attacks against our infrastructure, brute force attacks). The legal basis of this processing is our legitimate interest to protect our service against nefarious activities. If you enable authentication logging for your Account or voluntarily participate in Proton's advanced security program, the record of your login IP addresses is kept for as long as the feature is enabled. This feature is off by default, and all the records are deleted upon deactivation of the feature. The legal basis of this processing is consent, and you are free to opt in or opt out of that processing at any time in the security panel of your Account. The authentication logs feature records login attempts to your Account and does not track product-specific activity, such as VPN activity.
it sounds like you or the swiss government can arbitrarily decide to start logging IP addresses without being compelled to notify users? is there a reason you don't make a commitment to notify users whenever their IP address is logged? does swiss law put you under a gag order, or are you just not interested in notifying users when their privacy may be compromised?
@[email protected] i was shocked i just saw [their response to the IP address leak](https://proton.me/blog/climate-activist-arrest) and they literally said: > The Internet is generally not anonymous, and if you are breaking Swiss law, a law-abiding company such as Proton Mail can be legally compelled to log your IP address. the direct statement that they are *legally compelled to log IP addresses* is an absurd fucking thing to bury halfway in the middle of the post!!!
@elijah i was shocked i just saw their response to the IP address leak and they literally said:
The Internet is generally not anonymous, and if you are breaking Swiss law, a law-abiding company such as Proton Mail can be legally compelled to log your IP address.
the direct statement that they are legally compelled to log IP addresses is an absurd fucking thing to bury halfway in the middle of the post!!!
@just1602 @elijah Signal feels like the gold standard here. This is how they respond to subpoenas:
https://signal.org/blog/looking-back-as-the-world-moves-forward/
In the midst of world-wide protests against racism and police brutality, a lot of people are becoming more immediately aware and concerned about the security of their data and online communication. We’ve gotten a lot of questions at Signal over the past week, so we wanted to briefly recap how it ...
@elijah Proton se conforme aux demandes de droit Suisse. C’est dans les CGU. De plus, quoi qu’il arrive, le contenu du message restera chiffré est sécurisé.
Eeeeeyikes.
Just when I switched to Proton.
@elijah Proton will send a mail to the provided recovery mail address for account recovery (https://proton.me/support/set-account-recovery-methods#ways-to-reset-your-password) I do not see how this can be done with irreversible hash of that address.
You can criticize the mere existence of that kind of recovery (Proton does offer better ones). But unless I have overlooked sth. your suggestion to hash the recovery address seems like nonsense.
You pointed out that you implemented hashing so I must be missing sth. I‘m looking forward to being corrected.
Elijah Waxwing
Jon (now at neuromatch.social)
Vanessa
Justin !
Nico🦆
Proton
Lexi of the Night
d@nny disc@ mc²
Tony “Abolish ICE” Arcieri🌹🦀
srijit
Delta Chat
holga
✨buff dog himbo✨
4censord 
cyplo
Hot Mess Express🍉🌹
Semitones
Eloy.
SimpleX Chat
Cyb3r1c 🇧🇪 ☠️
scoonch
Kostyn
Ornella 🍉
Steven Sparrow
Primo
Jorge - vitrubio.net
Nils Hammer