Security is not a feature. It is our architecture.
Privacy was not bolted on as an afterthought. This is how FAE was built from the ground up.
How emails flowthrough FAE
FAE operates as a proxy between the internet and you. No email provider is replaced, none is bypassed. Your real email address exists exclusively in our auth system — it is never exposed to any sender or recipient.
The entire mail flow runs through AWS SES (Simple Email Service) with EU infrastructure. Every incoming message passes through the following stages:
Inbound Email Flow
What happens when someone emails your alias
Reply Flow (reversed)
Your real email appears nowhere in the flow.
Neither the original sender nor the recipient of your reply ever sees your real address. It exists exclusively in our encrypted auth system.
AES-256 at rest.TLS 1.2+ in transit.
Every email stored in FAE is encrypted with AES-256 — the same standard used by financial institutions and governments worldwide. In transit, TLS 1.2+ secures every connection.
| Aspect | Standard | Details |
|---|---|---|
| Storage (at rest) | AES-256 | All email content, metadata, and attachments in S3 and database |
| Transmission (in transit) | TLS 1.2+ | All connections: SES receiving, API communication, app sync |
| Auth data | Hashed + salted | Passwords are never stored in readable form |
| API communication | HTTPS only | Strict HSTS enforced |
| Push notifications | APNs (TLS) | Apple Push Notification Service with encrypted connection |
“We don't read your emails. We don't analyze them. We don't sell anything. Our only source of revenue is your subscription.”
GDPR is not a feature.It is the foundation.
All data is stored in the European Union — AWS eu-central-1 (Frankfurt). Subscription metadata is processed via RevenueCat (USA); email content does not leave the EU. GDPR rights under Articles 15-20 are built directly into the app — no support ticket needed.
Right of Access
See what data we store about you at any time — accessible directly in the app.
GDPR Art. 15Rectification
Correct inaccurate data yourself at any time through your profile.
GDPR Art. 16Right to Erasure
Delete your account and all data — Access ends immediately. Remaining data is removed within 30 days.
GDPR Art. 17Data Portability
Export all your data in a machine-readable format.
GDPR Art. 20| Requirement | Status | Implementation |
|---|---|---|
| EU data storage | Active | Exclusively AWS eu-central-1 (Frankfurt) |
| Data Protection Officer | Contact | contact@lazy.space |
| DPA (Data Processing Agreement) | Available | On request for B2B customers by email at contact@lazy.space |
| Privacy by Design | Implemented | Minimal data collection, purpose limitation, alias isolation |
| Consent management | Implemented | Opt-in for push notifications, granular settings |
Who processesyour data?
Transparency is non-negotiable. Every service involved in processing your data — visualized with data flow, purpose, and location.
Email Pipeline
Email receiving & sending
Email storage
Serverless logic
Database & Auth
Database & authentication
Website hosting
Payments & Distribution
Subscription management
No email content. Limited subscription metadata with pseudonymous user identifier.
Push & distribution
Device token + app metadata. No email content.
FAE App · iOS · Encrypted connection
All email data stays in the EU.
The entire email pipeline — receiving, storage, processing, sending — runs exclusively on EU infrastructure (AWS eu-central-1, Frankfurt). Services outside the EU receive no email content. Subscription metadata is processed via RevenueCat (USA).
Zero tolerancefor abuse.
FAE is a privacy tool — not a vehicle for spam, harassment, or illegal activity. We take every abuse report seriously and act quickly.
Report abuse from a @fae-mail.com address
If you have received unwanted emails from a @fae-mail.com address, report it to us:
contact@lazy.spacePlease include the following information:
- 1The full email headers of the unwanted message
- 2The @fae-mail.com address the message came from
- 3A brief description of the issue
- 4Your contact details for follow-up (optional)
We respond to all abuse reports within 24 hours. Violations of our terms of service result in immediate account suspension.