Startmail

What Is Startmail?

Your inbox is one of the easiest places to get tracked, profiled, and quietly data-mined—usually without your consent. StartMail’s pitch is simple: pay for email so you’re not the product, and get practical privacy features (aliases, encryption options, minimal tracking) without giving up compatibility with normal email clients.

StartMail is built for people who want a privacy-leaning mailbox that still behaves like “regular email.” You can use it in the browser, but you can also connect it to standard mail apps via IMAP (POP3 isn’t supported). That IMAP support is a key differentiator versus providers that lock you into a proprietary app.

It’s a paid service based in the Netherlands, and it explicitly positions itself around EU privacy law (GDPR) and operating outside US jurisdiction.

Startmail Features and Performance

StartMail supports webmail plus IMAP access, with IMAP disabled by default and enabled manually in settings. It does not support POP3.
Protocol note (from VPNSpotter specs): IMAP.

On the privacy side, StartMail leans heavily on aliases. Official docs and pricing pages describe “unlimited aliases,” including aliases under a StartMail-controlled alias domain and also aliases on a custom domain once that domain is verified (with some plan/account-type constraints).
There’s also a “burner aliases” concept on the pricing page (“one-click burner aliases” that disappear after an hour).

Encryption is offered in a few different ways:

• OpenPGP support: StartMail’s support materials and whitepaper describe OpenPGP-based encryption and signing, including “one-click” PGP in the web interface and the ability to use OpenPGP with an IMAP client (i.e., you can configure your own client to do end-to-end encryption with OpenPGP).
• Password-protected messages: Instead of sending the encrypted body as a normal email, StartMail can store an encrypted message on its servers and send the recipient a notification link; recipients get limited attempts to enter the password (five tries) before losing access.

A real-world limitation: you can’t send encrypted email from an alias address (at least in the webmail encryption workflow described by StartMail). That’s explicitly documented in StartMail support.

Under the hood, StartMail’s technical whitepaper describes a “User Vault” design: user data (mail, preferences, spam profile, search index) is stored encrypted in an individual vault, implemented as a LUKS volume, and opened during a session when the user logs in. The whitepaper also describes separate IMAP credentials per device (so you can revoke one device without changing the main account password).

Performance-wise, StartMail’s whitepaper explains why some features (notably search indexing) only update while you’re logged in, because the index lives encrypted in the vault and can’t be updated when the vault is closed. That’s a real architectural trade-off: privacy-oriented encrypted-at-rest design can constrain background processing.

On mobile: historically StartMail pushed IMAP + responsive webmail, but as of late September 2026 its support center states it has released an Android app on Google Play and says an iOS version is in App Store review.

Pricing and Plans

StartMail is paid (no permanent free tier is advertised). It offers a 7-day free trial.
Pricing model (from VPNSpotter specs): paid.

Plans are split into Personal and Business, with both monthly and annual billing:

• Personal: $6.99/month or $59.88/year (billed annually).
• Business: $8.99/month or $83.88/year (billed annually).

(Important: StartMail’s pricing page currently shows Personal at $4.99/month when billed annually but still lists $59.88 annually; the support article lists $6.99 monthly and $59.88 annually. Where StartMail’s own pages diverge, the safest “confirmed” pricing is the annual totals and the monthly prices shown in the pricing/support materials as cited above. )

Feature differences called out by StartMail include:

• Storage: 20GB (Personal) vs 30GB (Business)
• Custom domains: Personal supports one custom domain; Business supports unlimited custom domains.

Payment methods vary by region and plan, and StartMail’s pricing page says Bitcoin payment is possible on annual plans (by contacting them for the BTC price/address).

Refunds: StartMail’s Terms of Service state that terminating the agreement does not create a right to repayment/refund for the remaining subscription period (i.e., no prorated refund by default).

Privacy and Security Assessment

Jurisdiction: StartMail is based in the Netherlands, and markets EU/GDPR protections as a key selling point. Netherlands jurisdiction is a double-edged sword: you get EU data protection frameworks, but you’re also in a country that participates in intelligence-sharing alliances (often discussed as “Nine Eyes”). StartMail itself emphasizes that it operates under Dutch/EU law and outside US jurisdiction.
Known jurisdiction spec (VPNSpotter): The Netherlands.

Logging: StartMail’s privacy policy describes limited log retention. It states web logs (user agent, pages visited, IP address, timestamp) are stored for a maximum of 7 days, then deleted. It also states it stores 7 days of logs including some email metadata (remote server IPs, SMTP sender/recipient addresses for sent/received email) for troubleshooting and anti-abuse/spam/phishing.

IP privacy in outgoing mail: StartMail says that when you send email, your IP address is not included in the email headers; StartMail’s IP is shown instead. Its support documentation also describes “header stripping” that removes IP address details and information about your email client/plugins from messages sent via StartMail.

Encryption at rest architecture: The StartMail whitepaper describes a design where user data is stored encrypted in a per-user “User Vault” (LUKS volume). It also describes how mail is encrypted on arrival with a “queue key pair” and moved into the user vault once opened in-session. This is meaningful protection against certain at-rest compromise scenarios, but it’s not the same thing as “provider can never access plaintext under any circumstances.” The same whitepaper makes clear the vault is opened during user sessions.

Open source / audits: StartMail’s whitepaper includes a discussion of open source vs closed source as a design consideration, but the sources reviewed here do not clearly establish that StartMail’s apps/server components are fully open source, nor do they document an independent “no-logs” audit in the way VPN services often do. Without a primary source confirming a third-party audit and scope, it’s better to treat StartMail as not publicly audit-proven on logging claims.

Known incidents: No major breach/incident claims are included here because the provided sources do not document a specific incident with verifiable details.

Strengths and Limitations

Strengths

• IMAP support with normal email apps. If you want privacy-focused email but refuse to live inside one provider’s proprietary client, StartMail is built for that workflow.
• Unlimited aliases, including custom-domain aliases. The alias system is a major reason people choose StartMail, and it’s prominently supported in official documentation.
• Practical encryption options. You can use OpenPGP and signatures, plus password-protected encrypted messages for recipients who don’t use PGP.
• Header/IP stripping for outgoing mail. StartMail documents stripping IP/client/plugin details and not including your IP address in message headers.

Limitations / trade-offs

• No POP3. If your setup depends on POP3, StartMail isn’t designed for it.
• Encrypted sending limitations with aliases. Official docs state you can’t send encrypted emails from an alias address, which undercuts one of the most common privacy workflows (“use aliases for everything”).
• Refund policy is strict. Terms indicate canceling doesn’t entitle you to a refund for unused time.
• Some processing only happens while logged in. The whitepaper explains search indexing updates only when you’re logged in because data is stored encrypted in the vault otherwise. That’s a sensible privacy decision, but it can feel less “instant” than mainstream webmail.

Who Should Use Startmail?

Good fit if you are:

1. An email-client user who wants privacy features without losing IMAP. If you live in Thunderbird/Apple Mail/Outlook (or a mobile mail app) and want a privacy-focused provider that still speaks standard protocols, StartMail is built around that.
2. An alias-heavy user trying to reduce tracking and spam. StartMail’s unlimited aliases (including custom-domain options) are a core feature set, not an afterthought.
3. Someone who wants EU jurisdiction (Netherlands) and GDPR framing instead of a US-based email provider.

Not a great fit if you are:

1. A POP3-only user (StartMail doesn’t support it).
2. Someone who needs encrypted sending from alias addresses as a routine workflow (StartMail documents that it’s not possible).
3. A bargain hunter expecting a free plan: StartMail is paid, with a time-limited trial rather than an ongoing free tier.