ProtonMail's Privacy Policy Explained

Proton is the creator behind popular privacy based services such as Proton Mail, Proton Drive, Proton VPN, and this is their privacy policy explained in simple terms: (please note that this is very long but still way shorter than all their privacy policies)

Important note/disclaimer: This is not legal advice. These are my own understandings, and should not be a substitute for legal advice. All content contained in this post is for general information purposes only and does not consitute any form of professional advice. If you use this information, your doing so at your own risk. These might be very oversimplified and may not include everything. If you see anything that is inaccurate please reply to this post to let me know.

SHORT SUMMARY: Proton (at least according to their privacy policy) isn't a hungry data collecting company. They respect your privacy and encrypt most of the data they store, and they don't collect lot of information without a reason. I love how Proton is focused so much on privacy.

LONGER SUMMARY OF THEIR PRIVACY POLICY:

Proton AG is operating out of Geneva, Switzerland.

Data collected by Proton:

• When you visit their websites (proton.me, protonvpn.com) you will be "scanned" by a analytics tool that they've made. These are anonymized whenever possible. IP addresses are not retained and stored for such analytics.
• When you create an account, they store the information you provide. If you provide a recovery email they might spam you with annoying emails but don't worry you can disable it in your account settings. If you use their other services (Proton VPN, Drive, Pass) you could use an external email address which they will store, and they may send emails to that address unless you disable it.
• If your deemed suspicious by their systems, they may ask you to do a Proton captcha, or an email/SMS verification. Your IP address, email address, and phone number that you provide will be saved temporarly so they can send you an SMS/email and for anti spam purposes. And by temporary they mean until they have legitimate interest, if they choose to save it permanetly it's gonna be an cryptographic hash so they cannot decipher it.
• Referrals: I'm not gonna talk about them.

Account activity:

Protonmail: They have access to email metadata which are: Sender, and recipient email address, the sender's IP address, the name of any attachments (but not the contents) and the emails's subject line. They do NOT have access to your encrypted emails. However, if you get an email from an unecrypted source (like gmail) protonmail's servers could in theory read your email and only then encrypt it. If you use Easy Switch using Sign In with Google, they get API information and with that information they will do as Google says. Easy switch using username and password: they keep your username and password until you import your emails once it's done they delete it. They make backups and they delete it after 30 days.

Proton Drive: They have your files end to end encrypted and they cannot access it. Filenames, folder names, thumbnail previews are also encrypted. However, they do store the encrypted file's size so they can enforce storage limitations. Metadata can be accessed by proton (to operate services), and those metadata include: Time of folder/file creation or modification, permissions, username of the file creator/uploader (they need this to verify file authenticity with some fancy technology). If you use sharing URLs they can see when was the URL created, and who accessed it the last time and how many times the URL was accessed. They do NOT have access to file contents, file and folder names. But if someone is reporting abuse then they could send the encrypted file along with the link and password to proton. They make backups and they delete it after 30 days.

Proton VPN: I don't think they keep logs/backups. They say that in a case of a Swiss criminal investigation they cannot provide any VPN info but they can provide your IP address if you use protonmail.

Proton Calendar: They encrypt everything, except: Timezone, repetion rules, event creation and update times, event status. They make backups and they delete it after 30 days. Easy switch using Sign In Google: they get API info and they do as google says.

Proton Pass: Everything is encrypted including metadata. If you use email aliases, those email addresses are not encrypted else they wouldn't work.

Proton Wallet: I never used it so I'm not explaining it.

• IP logging: they do not keep permanent IP logs associated with your account, however they will keep it temporarily to combat abuse and fraud. If you do some stupid stuff and get your account suspended (breaching terms and conditions) they will keep your IP permanently. If you enable advanced logs in account security settings, they will keep your IP associated with your account as long as the feature is enabled, if you deactivate it all the IPs get deleted.
• Talking to Proton support: They use third party apps such as Zendesk and Calendly to process some information. Your support requests, bug repports, feature requests may be saved by proton staff. If you use Proton's live chat support (which I didn't even know existed) you agree to have your chat processed by Zendesk. The information you provide when you contact their support is processed for analytics purposes (such as: obtaining aggregate statistics) and they do not do targeted advertising or profiling using that information.
• Talking Proton's Sales Team: If your a business, why are you reading a random reddit user's post about privacy policies?
• Payment info: Proton uses Chargebee to process payments, only necesarry information is shared with them. Chargebee doesn't get access to your email or proton account information. Proton doesn't store your credit card, they only save your name and the last 4 digits of the credit card number. Cash and bitcoin payment and donations are accepted (idk why they have to say it in their privacy policy). They may use your account data for payment related matters.
• Native applications (like windows and phone apps): They (or the platform providers) may collect certain information. Fabric.io is used to collect mobile analytics such as crash reporting, and other statistics. Google Play Store and Apple App Store may collect information in accordance with their own privacy policies. Proton does not access or track any location based information from your device.
• Proton Scribe: Never used it, I'm not talking about it.
• Social Media: If you contact them on social media you do so at your own risk. Those interactions are governed by the platforms respective privacy policies and terms and conditions.
• Links to other stuff: Their website may contain links to other websites or services and they are not responsible for any of the content and those websites use their own privacy policies and terms and conditions.
• Network traffic that may go through third parties: I don't understand what it's used for.
• Data subprocessors: For proton to provide their services they need subprocessors to process different categories of data. Subproccesors do not store general day to day use of your account and services. Read the subproccessors list on your own.
• Data sharing: They disclose limited user data if they are legally obligated to do so by a "biding request coming from competent Swiss authorities". Proton's general policy is to challange requests whenever possible to ensure there are no doubts of the validity of the request. Proton's not responsible to notify users of legal requests, that falls on the responsibility of Swiss authorities.

THE END.

Proton, if your reading this please accept my volunteer translator application.

Want to understand how Tor works? I've explained it in r/InformationPrivacy.