LFMail
Sign in Create account
Menu

Security and privacy

Your email is yours. Period.

In plain language: what we do to protect your account, and what we do (and do not do) with your data.

Privacy

LFMail is paid for by the people who use it. That is why we have no need to mine your inbox.

  • No ads and no profiling

    We do not read your email content for commercial purposes, we do not sell your data and we do not build advertising profiles.

  • Data in Brazil

    Mailboxes are hosted in a data center in Brazil.

  • Staff access is an exception

    Viewing the content of a mailbox requires a recorded reason (your authorization, a court order or serious abuse) and approval by a second person, and it leaves an audit record.

  • Your rights under the LGPD

    You can ask for access, correction, portability and deletion of your data. Export and account deletion are in your settings.

Account protection

Layers that add up to make life hard for anyone trying to get into other people’s accounts.

  • Strong, well-kept passwords

    Passwords are stored with Argon2id. When you create one, we refuse passwords that already appeared in leaks, without sending your password to anyone.

  • Two-step verification

    An authenticator app plus 10 single-use recovery codes.

  • App passwords

    Email programs use their own passwords, shown only once and revocable. Your main password does not work over IMAP and SMTP.

  • Sessions and devices

    See your active sessions and known devices, and end one or all of them.

  • Protection against guessing

    Limits on login attempts and bot checks after failures, without locking out the account owner.

  • Re-authentication

    To change sensitive things (password, 2FA, data export, account deletion) we ask for your password again.

Message protection

Spam and scams are the biggest threat to an inbox. We treat them as part of the product.

  • Encrypted connection

    Access to the webmail and to email programs uses TLS.

  • Sender verification

    We check SPF, DKIM and DMARC on incoming messages. Outgoing messages will be signed once sending email arrives.

  • Spam and phishing filter

    The filter learns from the Report spam and Not spam buttons, and messages that look like scams get a warning.

  • Isolated reading

    Message HTML is cleaned and shown in an isolated area. Remote images stay blocked until you allow them.

Saw something strange?

To report spam, phishing or abuse involving @lfmail.com.br addresses, write to abuse@lfmail.com.br . To talk about privacy or exercise your rights as a data subject, write to privacidade@lfmail.com.br .

Also read

Create your @lfmail.com.br address today.

It takes a few minutes. On your first subscription, you can cancel within {withdrawalDays} days and get your money back.

Create account

You must be 18 or older to create an account.