Privacy

The Poku account server holds who you are and a locked copy of your mailbox list. It cannot open that copy.

What the server stores

Your email address.
A login proof made from your password on your own device, stored only as a slow one-way hash. Your password itself never leaves your browser or computer.
The random salt and settings used to make that proof.
Your authenticator secret, encrypted with a server key (the server needs it to check your codes), and your backup codes as one-way hashes.
Your vault: your mailboxes and their passwords, encrypted on your device with a key the server never sees. That key is stored only locked: with your password, with your recovery code, and briefly for a computer you approve until it collects it.
The computers signed in to your account: their name, platform and when they were last seen, and a one-way hash of each computer's token.
Short-lived records: email codes, sign-in steps and counters that limit guessing. A log of account events (what happened and when) without secrets and without full IP addresses.

What it never has

Your Poku password, your recovery code or your vault key.
Your mailbox passwords in readable form.
Your mail. Poku talks to your mail provider directly from your computer, never through this server.

A copy of the whole database plus every server secret still does not reveal a mailbox password without also guessing your Poku password (slow by design), or holding your recovery code or a signed-in computer.

The honest limit

On these web pages, the encryption runs in JavaScript that pokumail.com sends to your browser. If this server were taken over, it could send a page that steals your password as you type it. To make that harder, the pages load no script from anywhere else and run under a strict security policy. The poku command-line tool does its part of the encryption itself, without these pages.

No tracking

No ads, no analytics, no outside scripts, fonts or images, and no cookies. Your sign-in lasts until you close the tab.

Email we send

Sign-up and reset codes, and notices about your account: a new computer signed in, your password was reset, your second factor was locked, your saved mailboxes were reset, or your account was set to be deleted. They are sent from poku@pokumail.com through Mailgun.

Where it runs

The service runs on Vercel; the database is Neon Postgres in the United States.

Deleting your account, questions

Write to support@mattmade.ai.

What the server stores

Your email address.

A login proof made from your password on your own device, stored only as a slow one-way hash. Your password itself never leaves your browser or computer.

The random salt and settings used to make that proof.

Your authenticator secret, encrypted with a server key (the server needs it to check your codes), and your backup codes as one-way hashes.

Your vault: your mailboxes and their passwords, encrypted on your device with a key the server never sees. That key is stored only locked: with your password, with your recovery code, and briefly for a computer you approve until it collects it.

The computers signed in to your account: their name, platform and when they were last seen, and a one-way hash of each computer's token.

Short-lived records: email codes, sign-in steps and counters that limit guessing. A log of account events (what happened and when) without secrets and without full IP addresses.

What it never has

Your Poku password, your recovery code or your vault key.

Your mailbox passwords in readable form.

Your mail. Poku talks to your mail provider directly from your computer, never through this server.

The honest limit