About Thelemail
Private email hosting for domain owners, households and founder-run teams, operated in the EU by Thelemail.
Thelemail is private email hosting for the technical person already administering a domain, often a homelabber, a household’s technical member or a founder setting up a small team. Thelemail operates the mail infrastructure while that administrator keeps control of the domain and addresses. Paid household and team plans provide separate mailboxes, shared addresses and unlimited aliases on a connected custom domain, subject to a workspace anti-abuse guardrail. An individual without a domain can start with a permanent Free @thelemail.com mailbox with 1 GB of storage and no payment method; Free Family includes up to six private @thelemail.com mailboxes with 1 GB each and one shared @thelemail.com alias, without a payment method or expiry date. Custom domains, more storage and additional aliases require a paid plan.
Why Thelemail exists
Thelemail started from a practical requirement: run dependable email for a household and a small business without operating SMTP infrastructure every day. Domain ownership should provide address continuity. Managed hosting should cover queues, reputation, authentication records, abuse controls and spam classification.
The service is built and operated by Thelemail, an independent email service based in Portugal. Contact details are published in the Terms of Service.
What the service does
The domain administrator verifies ownership, prepares SPF, DKIM and DMARC, creates every recipient, imports existing mail and changes MX when the domain is ready. Other members receive private inboxes and do not need to manage DNS or encryption keys.
Mail between Thelemail accounts is end-to-end encrypted. OPAQUE unlocks a wrapped account key on the user’s device without sending the password to Thelemail, and stored mailbox content remains ciphertext to the service. For outbound external mail, the web client discovers compatible recipient keys through WKD and encrypts with OpenPGP. Thelemail also publishes user keys through WKD so compatible outside senders can encrypt inbound mail. Without a usable key, external mail uses standard SMTP with TLS where supported. The client tells the user which path applies. We run aligned authentication, sending infrastructure, reputation monitoring and spam classification.
What is independently inspectable
The production browser client, macOS desktop client, key transparency log and local export tool are published under AGPL-3.0. The desktop app keeps cryptographic operations in its Rust core and mirrors mail into an encrypted local database for offline reading and search. The export tool supports OPAQUE-protected accounts and decrypts mailbox data into standard formats on the user’s computer. Mobile client source remains private. Thelemail has not completed an independent security audit or formal compliance certification. The threat model, key transparency status and published source describe the current guarantees and the remaining gaps.
How the business is funded
Subscriptions fund the service. Stored mail is not scanned for advertising or AI training. Core mail infrastructure and encrypted mailbox data are hosted in the EU, with the processing details listed in the Privacy Policy. If you leave, export your mail in standard formats and move a custom domain by changing its MX records.
Read the threat model | See pricing | Learn how domain setup works