Privacy policy

This English version is provided for convenience only. The German version is legally binding.

Last updated: 12 October 2026

In short: Postwacht only stores what a test needs and deletes it automatically. There is no tracking, no advertising, no analytics services and no sharing for advertising purposes. The servers are located in Germany.

1. Controller

The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

No data protection officer has been appointed because the legal requirements for doing so are not met. For data protection questions, please contact the address above directly.

2. What data is processed when

• When visiting the website: technically necessary connection data and a session cookie. No access logs with IP addresses are stored.
• When creating a test address: an irreversible hash of your IP address to limit abuse.
• When sending a test email: the complete email and the connection data of the sending mail server.
• With an account: your email address, a hash of your password, optionally two-factor data and the assignment of your tests.
• When you use account features: monitored domains and their check results, DMARC reports, inbox test results and API keys (hash only).

3. Servers and hosting

Postwacht runs entirely on its own systems in a data center in Frankfurt am Main, Germany. No content delivery networks, external fonts, external scripts or cloud analytics services are used.

Name resolution (DNS) for the domain postwacht.de is provided via the name servers of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare does not route any website traffic (no proxy); Cloudflare only answers the question at which IP address the server can be reached. These queries are usually not made by your device directly but by your internet provider's DNS resolver. Cloudflare is certified under the EU-US Data Privacy Framework.

The TLS certificates for the encrypted connection come from Let's Encrypt (Internet Security Research Group, USA). No data about you is transmitted to Let's Encrypt when you visit the website.

4. Visiting the website

When you visit the website, the server necessarily processes your IP address, the requested address, date and time and technical information about your browser in order to deliver the page. This data is not stored in access logs. Only in the event of technical errors may error messages without reference to visitors be logged.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the technical provision of the website.

5. Cookies

Postwacht sets exactly one cookie: mt_session. In signed form, it contains a protection value against forged form submissions (CSRF protection) and, if you are logged in, your account identifier. It is valid for up to 30 days or until you log out.

The cookie is strictly necessary for using the service. It is therefore stored without consent under Section 25 (2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG); subsequent processing is based on Art. 6(1)(b) and (f) GDPR. Tracking, advertising or statistics cookies are not used, which is why there is no cookie banner.

6. Running a test

What is stored

When you send an email to a test address (…@in.postwacht.de), Postwacht stores:

• the complete email with all headers, text, HTML, images and attachments,
• sender and recipient address from the transmission (envelope),
• connection data of the sending mail server: IP address, hostname, HELO name, encryption protocol,
• the results of all checks and the score calculated from them.

The email is stored encrypted and analyzed automatically only. Nobody reads the email, except in the case of a specific technical error or suspected abuse.

Who can see the report

Every test has a random, unguessable address. Anyone who knows this address can view the report and the original email. Therefore only share the link if you want to. Test reports are blocked for search engines.

Please note

Wherever possible, send emails with test content. If your email contains personal data of third parties, such as real recipient lists or customer data, you are responsible for being allowed to use it for this purpose.

Retention period and legal basis

The original email is deleted after 7 days. If you have the same email re-analyzed via “Re-check this email”, a new test with a copy of the email is created, for which the period starts again. The report remains available for 7 days without an account and 30 days with an account, and is then deleted completely. Deletion runs automatically every 30 minutes.

The legal basis is Art. 6(1)(b) GDPR because the processing is necessary for the check you requested.

7. Checks using third-party services

For some checks, Postwacht has to query information from the test email with external parties. Neither the whole email nor your IP address as a website visitor is ever transmitted.

• DNS lookups: To check SPF, DKIM, DMARC, MTA-STS, BIMI and reverse DNS, Postwacht queries the public DNS records of the domains and servers involved. This runs via our own resolver directly against the responsible name servers.
• Blocklists (DNSBL): The IP address of the sending mail server and the domains from the sender and links are queried with blocklist operators: Spamhaus, Barracuda Networks, SpamCop (Cisco), UCEPROTECT, PSBL, Mailspike, DroneBL, GBUdb, SURBL and URIBL. Some of them are based outside the EU, including in the USA. Only the respective IP address or domain is transmitted as part of a DNS query.
• Link reachability: Up to 30 links from the email are requested with a simple HEAD request to detect broken links. The respective web server sees the request from the Postwacht server, not yours. Links for unsubscribing, confirming or logging in are never opened, so that a test doesn't trigger any action. Links to internal networks are not opened either.

The legal basis is Art. 6(1)(b) GDPR, and additionally Art. 6(1)(f) GDPR for the blocklist queries. The legitimate interest lies in a meaningful deliverability check.

8. Free account

For an account you need an email address and a password. The following is stored:

• your email address, the time of creation, confirmation and last login,
• your password exclusively as an Argon2id hash. Nobody knows the password itself, not even the provider,
• if you turn on two-factor login: the secret key for your authenticator app (encrypted) and your recovery codes (hash only),
• the assignment of your tests to the account so that you can compare them,
• the language in which you receive emails.

To prevent anyone from registering other people's addresses, you must confirm your address via a link. We also send a link for “Forgot password”. We store both links only as a hash; they are valid for 24 hours or 30 minutes respectively, can be used only once and are deleted no later than one day after expiry. If you change your password or two-factor settings, you receive a notification email for security.

To protect passwords against guessing, we count failed login attempts per IP hash and per email hash for one hour.

All emails from the service are sent via the provider's own mail server (web.tkessel.de).

Your account remains until you delete it. You can delete it yourself at any time under “My account”; all associated tests and emails are removed immediately. The legal basis is Art. 6(1)(b) GDPR.

9. Account features

Domain monitoring

If you add a domain for monitoring, Postwacht checks it once a day and on request: public DNS records (MX, SPF, DKIM, DMARC, MTA-STS) and blocklists for the domain as well as for the server IP addresses that appear in your tests or in the domain's SPF record. The queries run as described in section 7. The domain, the latest result and a history of changes are stored. If a result changes, you receive a notification email; you can turn this off per domain. We also send you a weekly report every Monday with the status of your domains; you can turn this off too.

DMARC reports

If you add our report address to your domain's DMARC record, mailbox providers (e.g. Google, Microsoft, Yahoo) send daily aggregate reports to Postwacht. These reports contain no email content and no recipient addresses, but: the reporting provider, the period, the IP addresses of the servers that sent emails using your domain, their number and the results of SPF, DKIM and DMARC. We look up the reverse DNS name for these IP addresses in order to identify senders. We process TLS reports (TLS-RPT) in the same way if you add our address for them: they contain the number of successful and failed encrypted connections as well as names and IP addresses of the mail servers involved.

The report email itself is deleted immediately after analysis. We store the analyzed data for 180 days. The legal basis is Art. 6(1)(b) GDPR; insofar as IP addresses of third-party servers are personal data in individual cases, Art. 6(1)(f) GDPR. The legitimate interest lies in protecting your domain against abuse – which is exactly what DMARC reports are designed for.

Inbox test

In the inbox test, you send an email to seed mailboxes of Postwacht at major mailbox providers (e.g. Google Gmail, GMX, WEB.DE, T-Online, Yahoo). These providers process the email on receipt under their own responsibility according to their privacy policies; some of them are based in the USA. Postwacht logs into the mailboxes via IMAP for up to 30 minutes, determines in which folder the email is located and deletes it there immediately. Only the result per provider (folder and time) is stored, for 30 days. Please do not use emails with personal data of third parties for the inbox test. The legal basis is Art. 6(1)(b) GDPR.

API

We enable API access on request. For this we store your reasoning, the specified servers (hostnames or IP addresses) from which the API may be called, and the time of the application and the decision; we inform the operator of the application by email. We store API keys only as a hash together with a name, the creation time and the time of last use. To limit requests, we count calls per key for one minute; the IP address of each API request is compared with the approved servers but not stored. When you create a key, you receive a notification email for security. The legal basis is Art. 6(1)(b) GDPR.

If you create a webhook, we store the target address, the selected events, the signing secret (encrypted) and the time and result of the last call. For every event, we send the data described in the API documentation to the address you specified. You are responsible for the recipient there.

All data in this section is deleted when you remove the domain, revoke the key or delete your account.

Pro plan and payment

If you book Pro, we process the payment via Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. You enter your payment details directly with Stripe; we don't receive them. Stripe sends us a customer number, the subscription status, the end of the paid term and the billing details (name, address, VAT ID if applicable). Stripe also processes data at Stripe, Inc. in the USA; Stripe is certified under the EU-US Data Privacy Framework. For fraud prevention, Stripe additionally processes device and connection data under its own responsibility, see stripe.com/privacy.

With Pro, we store test reports, DMARC and TLS reports and inbox test results for longer (see section 12). When Pro ends, the retention periods of the free account apply again. For invoices, we store your billing details: customer type, name, company if applicable, address, country, VAT ID if applicable and the email address for invoices. We use them to create the invoice and also transmit name, address and VAT ID if applicable to Stripe for payment processing. We verify a VAT ID from another EU country when saving it via the European Commission's VAT Information Exchange System (VIES). We store every invoice as an unalterable, encrypted copy. We retain invoices for eight years from the end of the year of issue under Section 14b of the German VAT Act and Section 147 of the German Fiscal Code, even after the account has been deleted; after that they are deleted automatically. We delete the billing details in the account together with the account. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for retention.

If you cancel via “Cancel contracts here”, we process your name, email address, the time and the type of cancellation in order to carry it out and confirm it to you (Art. 6(1)(b) and (c) GDPR).

10. Abuse prevention

Without an account, 3 tests per day are possible, with an account 20. To enforce this limit, an irreversible hash value is formed from your IP address together with a secret key. This counter is deleted after 25 hours at the latest. In addition, the hash value is stored with the respective test and deleted with it.

To protect against automated requests, your browser solves a small puzzle (proof of work) when creating a test address, when registering and for “Forgot password”. This happens entirely on your device and on our server; no third-party services are used, no cookies are set and no data about your device is collected. In addition, the form contains a field that is invisible to humans and only filled in by bots.

The free Pro trial is available once per person. When you start it, we store an irreversible hash of your normalized email address (without additions such as “+…”) for twelve months – even beyond deletion of the account – so that a newly created account doesn't get another trial. In addition, a hash of your IP address counts the started trial for 30 days.

The mail server also limits the number of connections per sending server. Its operational logs contain the IP addresses of sending mail servers; they are used for troubleshooting and defending against attacks and are automatically overwritten depending on their size.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in stable, abuse-free operation.

11. Contact by email and support

If you contact us by email, your details are stored to process the request and deleted once it has been dealt with and no statutory retention obligations apply. The legal basis is Art. 6(1)(b) or (f) GDPR.

With an account you can send us a request via “Support”. For this we store the category, subject, your messages and our replies, optionally the link to one of your tests, and which help articles were shown to you before sending. We are notified of new requests and messages by email; you receive an email with a link about our replies, but without the text of the reply. We close answered requests without a response after 14 days and delete closed requests after twelve months, at the latest when the account is deleted. The legal basis is Art. 6(1)(b) GDPR.

The search on the help page and the suggestions while writing a request only evaluate your input for that one search; we do not store search terms. If you confirm that a suggestion helped, we count this anonymously per help entry.

12. Retention periods at a glance

13. Recipients and third countries

Data is not sold and not shared for advertising purposes. Recipients are only the parties named in sections 3, 7 and 9 to the extent described there, plus Stripe as the payment provider for the Pro plan. For blocklist operators outside the EU, the transfer takes place because it is necessary for the check you requested (Art. 49(1)(b) GDPR); only the IP address of the mail server or a domain is transmitted. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. The score relates exclusively to the technical characteristics of the test email.

14. Data security

• The website is only reachable encrypted (HTTPS). The mail server offers encrypted transmission (STARTTLS).
• Test emails are stored encrypted.
• The servers can only be administered via an isolated VPN.
• The systems are fully backed up every night. Data contained in backups is removed at the latest when the backup expires (14 days).

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Please contact the address in section 1. You can exercise many rights yourself: every report can be downloaded as JSON, and you can delete your account at any time.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

16. Changes

This privacy policy is updated when the service or the legal situation changes. The version published here applies.

See also: Terms · Imprint