Criptext

Criptext is a free encrypted email service based off the Signal protocol.

5.4/10

How we calculate ratings →

Handling

Does the policy allow personally-targeted or behavioral marketing? Yes, but you may opt-out

4/10

Does the service allow you to permanently delete your personal data? Yes, by contacting someone

3/5

Does the service allow third-party access to private personal data? Yes

0/10

This may come in the form of outright data sharing or by using local third-party analytics software (such as Google Analytics, which collects a plethora of user information).

Note that whether the policy allows sharing aggregated user data does not affect this question.

If the personal data is encrypted when it passes through the third-party, it does not count as third-party access (as the data is inaccessible to that party).

If personal data has been made public by, for example, posting it to a blog, it does not count as private personal information (and is therefore not considered by this question).

Score

Yes

The policy allows sharing personal data with third parties (not just critical service providers), and does not explicitly list the third parties.

Yes, all parties specified (including non-critical service providers such as advertisers)

30%

Yes, not all parties specified (but only to critical service providers)

70%

Yes, all parties specified (only to critical service providers)

80%

100%

Citation

We may disclose your personal information to our subsidiaries and corporate affiliates for purposes consistent with this Privacy Policy.
We may employ third-party companies and individuals to administer and provide the Services on our behalf (such as training, customer support, hosting, email delivery and database management services). These third parties may use your information only as directed by Company and in a manner consistent with this Privacy Policy, and are prohibited from using or disclosing your information for any other purpose.
We disclose the content of your email message(s) to the email recipient(s) that you have designated in the email.
We may disclose your personal information to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us.
Company may disclose information about you to government or law enforcement officials or private parties as required by law, and disclose and use such information as we believe necessary or appropriate to (a) comply with applicable laws and lawful requests and legal processes, such as to respond to subpoenas or requests from government authorities; (b) enforce the terms and conditions that govern the Service; (d) protect our rights, privacy, safety or property, and/or that of you or others; and (e) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.
Company may sell, transfer or otherwise share some or all of its business or assets, including your personal information, in connection with a business deal (or potential business deal) such as a merger, consolidation, acquisition, reorganization or sale of assets or in the event of bankruptcy, in which case we will make reasonable efforts to require the recipient to honor this Privacy Policy.

When does the policy allow law enforcement access to personal data? When reasonably requested

3/5

Score

Always

This includes cases in which law enforcement either runs the service or has a known backdoor into (or relationship with) the service.

Not specified

When reasonably requested

60%

Only when required by a court order or subpoena

80%

N/A (no personal data to share)

The service would have no personal data to share with law enforcement.

100%

Never (special legal jurisdiction)

The service operates in a jurisdiction in which sharing data with law enforcement is never required.

100%

Citation

Company may disclose information about you to government or law enforcement officials or private parties as required by law, and disclose and use such information as we believe necessary or appropriate to (a) comply with applicable laws and lawful requests and legal processes, such as to respond to subpoenas or requests from government authorities; (b) enforce the terms and conditions that govern the Service; (d) protect our rights, privacy, safety or property, and/or that of you or others; and (e) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

Transparency

Does the policy outline the service's general security practices? Yes

2/3

Score

Somewhat

The policy provides only a very vague overview of its security practices.

30%

Yes

60%

Yes, including audits

"Reviews," "monitoring," etc. also count as audits.

80%

Yes, including independent audits

Independent "reviews," "monitoring," etc. also count as independent audits.

100%

N/A

The service doesn't collect any personal information.

100%

Citation

The security of your personal information is important to us. We take a number of organizational, technical and physical measures designed to protect the personal information we collect, both during transmission and once we receive it. However, no security safeguards are 100% secure and we cannot guarantee the security of your information.

You should take steps to protect against unauthorized access to your password and computer by, among other things, signing off after using a shared computer, choosing a robust password that nobody else knows or can easily guess, and keeping your log-in and password private. We are not responsible for any lost, stolen or compromised passwords or for any activity on your account via unauthorized password activity.

Notes

A more in-depth documentation on the email security and a whitepaper can be found https://www.criptext.com/en/security/

Is the policy's history made available? Only the date it was last modified

3/5

Does the policy require users to be notified in case of a data breach? Not necessarily

0/7

Will affected users be notified when the policy is meaningfully changed? Yes

5/5

Collection

Does the service collect personal data from third parties? No

10/10

Is it clear why the service collects the personal data that it does? Yes

10/10

Score

Somewhat

30%

Mostly

70%

Yes

100%

N/A

The service doesn't collect any personal information.

100%

Citation

If you have a Criptext account or use our Services, we use your personal information to: Operate, maintain, administer and improve the Services; Manage and communicate with you regarding your Criptext account, including by sending you service announcements, technical notices, updates, security alerts and support and administrative messages; Provide support and maintenance for the Services; and Respond to your service-related requests, questions and feedback.

If you request information from us, register for the Services, or participate in our surveys, promotions or events, we may send you Criptext-related marketing communications as permitted by law. You will have the ability to opt out of such communications.

We use your personal information as we believe necessary or appropriate to comply with applicable laws, lawful requests and legal process, such as to respond to subpoenas or requests from government authorities.

We will request your consent to use your personal data where required by law, such as where we use certain cookies or similar technologies or would like to send you certain marketing messages. If we request your consent to use your personal data, you have the right to withdraw your consent any time in the manner indicated when we requested the consent or by contacting us.

We may create anonymous data from the information you provide to us through the Services. We exclude any information that may make the data personally identifiable to you. We reserve the right to use that anonymous data for our lawful business purposes.

We use your personal information as we believe necessary or appropriate to (a) enforce the terms and conditions that govern the Service; (b) protect our rights, privacy, safety or property, and/or that of you or others; and (c) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity.

Does the service allow the user to control whether personal data is collected or used for non-critical purposes? On an opt-out basis, but only for some non-critical data/uses

3/10

Does the policy list the personal data it collects? Yes, generally

7/10

Score

The policy does not claim to not collect personal data, but it also doesn't provide any meaningful insight into the types of personal data it collects.

Only summarily

The policy uses overly vague language to provide a summary of the types of collected personal data.

30%

Yes, generally

All general categories of collected personal data are listed, though not all types of personal data are explicitly mentioned (for example, the list might use a phrase like 'such as' when listing types of personal data).

70%

Yes, exhaustively

All types of collected personal data are listed specifically

100%

N/A (no personal data is collected)

100%

Citation

Personal information that you may provide through the Services or otherwise communicate with us includes:

When you register or subscribe to any of the Services, you provide us with information such as your first name, last name, recovery email, username and password. You may optionally provide us, all in accordance with applicable laws, the email addresses in your mobile address book on a regular basis. You may also add other information to your account, such as a profile picture.

When you use our Services to send an email, we process your email address, recipient’s email address, subject and the encrypted content of your messages (including body and attachments). Once messages are delivered to your device, they are deleted from our servers. The same holds true for messages which you send. Your messages are permanently stored on your own device and not on our servers. If a message cannot be delivered immediately (for example, if you are offline or the device is powered off), we may keep it on our servers for up to 30 days. After the 30-day period the message is deleted from our server. We also keep email metadata (subject, date and sender email address) in order to enable certain features of the Services, such as the “unsend”, “read receipts” and “expiration” features.

You provide us information in your responses to surveys, and when you participate in market research activities, report a problem with the Services, receive customer support or otherwise correspond with us.

When you make purchases through the Services, you provide us with billing and payment information. We use a third-party payment provider to process payment card transactions. We collect the transaction details only (e.g., the invoice ID, and the date and amount of purchase).

Last Updated

June 24, 2020

Sources

Source #1 ↗

Contributors

doamatto