At OnionMail, we believe transparency is a cornerstone of any privacy-focused email service. Users entrusting us with their communications deserve to know exactly how their accounts are managed throughout their lifecycle \u2014 from registration, through periods of inactivity, all the way to username reservation after account closure.<\/p>\n
This article provides a complete and authoritative overview of our account policy: what a free account allows, what an upgraded account unlocks, what happens during inactivity, how aliases are protected, and why our system is designed the way it is.<\/p>\n
OnionMail offers anonymous registration. Anyone can create a free account without providing personal information, KYC, or identity verification. The registration process is intentionally minimal to preserve user privacy and align with the values of the Tor ecosystem.<\/p>\n
A free OnionMail account<\/strong> is designed primarily as a receive-only inbox<\/strong>. Once registered, users can:<\/p>\n What a free account cannot do<\/strong> is send outgoing emails. Outbound sending is a feature reserved for upgraded accounts. This separation allows us to offer a genuinely free, anonymous, privacy-respecting inbox to anyone who needs one \u2014 without exposing the network to abuse from spam or unsolicited mass mailing.<\/p>\n To keep a free OnionMail account active, the user must log in at least once every three months<\/strong>. Logging in is the only requirement \u2014 no email activity, no specific actions, just a successful authentication within the rolling 90-day window.<\/p>\n As long as the user logs in at least once every three months, the account remains active indefinitely<\/strong>. There is no overall lifetime limit, no expiration date, no annual renewal. A user who logs in regularly will never lose their account.<\/p>\n This requirement exists for several important reasons:<\/p>\n The three-month window is generous enough to accommodate occasional users while still keeping the system clean and responsive.<\/p>\n If a free user does not log in for three consecutive months, the account enters the inactivity-removal process. The account and all its associated data are deleted from our systems. This is consistent with privacy best practices: data that is no longer being used should not be retained indefinitely.<\/p>\n A common concern raised by users new to privacy-focused services is whether account deletion creates a window in which a malicious actor could re-register the same username and impersonate the original user \u2014 for example, to receive password reset emails from third-party services.<\/p>\n OnionMail addresses this concern directly with a username freeze policy.<\/strong><\/p>\n When an OnionMail account is removed for inactivity, the username is not<\/strong> immediately released back into the pool of available names. Instead, the username enters a mandatory freeze period of at least one year<\/strong>.<\/p>\n During this freeze period:<\/p>\n Only after the freeze period of at least one year has elapsed does the username return to the pool of available registrations.<\/p>\n This policy is a deliberate security design choice. We recognize that many users employ their email address as a recovery method for accounts on other platforms (GitHub, GitLab, domain registrars, financial services, etc.). A short or zero-day release window would create a real risk of alias hijacking<\/strong>, where a malicious actor registers a recently freed username to receive password reset emails for the previous owner’s third-party accounts.<\/p>\n By enforcing a one-year minimum freeze, we close this attack vector almost entirely. A would-be attacker would need to know that a specific alias was freed, wait at least twelve months, and then race other potential registrants for it \u2014 all while the original owner has had ample time to recover their other accounts through alternative means.<\/p>\n Users who want a fully featured email account without the three-month login requirement can upgrade to a paid plan. An upgraded OnionMail account removes the inactivity limitation entirely<\/strong> for the duration of the paid period and unlocks the features needed for serious, everyday email use.<\/p>\n An upgraded account includes:<\/p>\n When the one-year upgrade period ends, the account automatically reverts to free-tier status. From that moment, all the policies described above for free accounts apply: outgoing email is no longer available, and the account must be accessed at least once every three months to remain active. Users who renew their upgrade before the period expires maintain uninterrupted access to all upgraded features.<\/p>\n This structure gives users a clear choice. Those who only need a private inbox can use OnionMail entirely for free, with the modest commitment of logging in every three months. Those who need a full email solution \u2014 sending, account recovery, freedom from activity tracking \u2014 can upgrade and enjoy a year of unrestricted use, then decide whether to continue.<\/p>\n To ensure uninterrupted access to your OnionMail account, we recommend the following practices:<\/p>\n If you do not log into your free OnionMail account for three consecutive months, the account is removed and the username enters a freeze period of at least one year, during which it cannot be re-registered by anyone.<\/p>\n No. When an inactive account is removed, the username is frozen for a minimum of one year before it can be registered again. This freeze period is specifically designed to prevent alias hijacking and protect users who may use their address as a recovery method on third-party platforms.<\/p>\n You need to log in at least once every three months. As long as you do so, the account remains active indefinitely, with no overall time limit.<\/p>\n No. Upgraded accounts are exempt from the activity requirement for the entire duration of the paid period. You can go a full year without logging in and the account will remain fully active. The activity requirement only applies once the upgrade expires and the account reverts to free-tier status.<\/p>\n Upgraded accounts can send outgoing emails (a feature not available on free accounts), can connect a Tox ID for account recovery, and are not subject to the three-month login requirement for the duration of the upgrade. All features available on free accounts remain available on upgraded accounts.<\/p>\n Tox is a peer-to-peer, end-to-end encrypted messaging protocol. By linking a Tox ID to your upgraded account, you create a privacy-respecting recovery channel that can be used if access to your account is lost, without relying on phone numbers or third-party email providers.<\/p>\n When the one-year upgrade period expires, the account automatically reverts to free-tier status. Outgoing email becomes unavailable, the Tox ID restore feature is disabled, and the standard three-month login requirement begins to apply. The account itself is not deleted at that moment \u2014 it simply becomes a free account again.<\/p>\n No. Free accounts are genuinely free and require no personal information to register. They function as receive-only inboxes \u2014 they can receive, read, archive, and download emails, but they cannot send outgoing messages.<\/p>\n No, free accounts are receive-only. They can receive emails from any sender, including users of mainstream providers, but outgoing email sending is reserved for upgraded accounts.<\/p>\n Any successful authentication into your account counts. You do not need to send or receive emails \u2014 simply signing in within the three-month window is enough to keep a free account active.<\/p>\n Three reasons: efficient use of network resources, reducing the security risk that dormant accounts pose to any authentication system, and limiting accumulation of one-off accounts that degrade service quality for active users. Users who want to be exempt from this policy can upgrade their account.<\/p>\n A minimum of one year. After this period, the username may become available again for new registrations.<\/p>\n Once a free account has been removed, it cannot be recovered. The username is frozen and cannot be re-registered for at least a year, meaning there is no “limbo” period during which the original owner can reclaim it. This is intentional: a recovery option would necessarily create a security hole that attackers could exploit. Users who want continuity should either log in within each three-month window or upgrade to a paid plan, which removes the inactivity requirement and adds Tox ID recovery.<\/p>\n We recommend treating the three-month window as a hard deadline. Logging in well before the 90-day mark \u2014 for example, every 60 days \u2014 is the safest practice. Users who want to eliminate this concern entirely can upgrade.<\/p>\n OnionMail’s account policy is built around a simple principle: privacy and security are not in conflict, and good policy design serves both. Anonymous registration, free receive-only accounts, a clear and predictable activity requirement for free users, optional upgrades with full sending capability and Tox ID recovery, and a strict username freeze period together form a system that respects user privacy while actively protecting against the most common forms of email-based attacks.<\/p>\n If you have additional questions about how OnionMail handles accounts, aliases, or any other aspect of our service, please consult our documentation or reach out through the official support channels listed on our site.<\/p>\n","protected":false},"excerpt":{"rendered":"\n
The Three-Month Login Requirement (Free Accounts)<\/h2>\n
\n
What Happens to Inactive Free Accounts<\/h2>\n
The Username Freeze Policy: Protection Against Alias Hijacking<\/h2>\n
\n
Upgraded Accounts: No Activity Requirement and Full Sending Capability<\/h2>\n
\n
How to Keep Your Account Safe<\/h2>\n
\n
Frequently Asked Questions<\/h2>\n
What happens if I don’t log into my free OnionMail account for several months?<\/h3>\n
Can someone hijack my OnionMail alias if my account becomes inactive?<\/h3>\n
How often do I need to log in to keep my free OnionMail account active?<\/h3>\n
Do upgraded accounts have the same three-month login requirement?<\/h3>\n
What features does an upgraded OnionMail account include?<\/h3>\n
What is Tox ID account restore?<\/h3>\n
What happens when my upgrade period ends?<\/h3>\n
Does OnionMail charge for free accounts?<\/h3>\n
Can a free OnionMail account send emails?<\/h3>\n
What does “logging in” mean for the activity requirement?<\/h3>\n
Why does OnionMail delete inactive free accounts at all?<\/h3>\n
How long is the username freeze period exactly?<\/h3>\n
Can I recover a free account that has been removed for inactivity?<\/h3>\n
Is the three-month window strict, or is there a grace period?<\/h3>\n
Conclusion<\/h2>\n