Glossary
Email Security & Privacy Glossary
📜 Legal & Surveillance Framework
| Term | Definition | Privacy Impact |
|---|---|---|
| GDPR (General Data Protection Regulation) | EU regulation establishing strict data protection requirements for organizations processing EU citizens' personal data. Grants rights to access, delete, and port data. | Strong protection - Requires consent, limits data collection, enables deletion rights |
| CLOUD Act (Clarifying Lawful Overseas Use of Data) | US law allowing American law enforcement to compel US-based technology companies to provide stored data, regardless of whether the data is stored in the US or on foreign soil. | Privacy risk - US companies must comply even for foreign-hosted data |
| PRISM | Leaked NSA surveillance program (2013) that collected internet communications from major US tech companies including Google, Facebook, Microsoft, Apple, and others. | Major concern - Demonstrates mass data collection from big tech providers |
| Five Eyes Alliance | Intelligence-sharing agreement between Australia, Canada, New Zealand, UK, and USA. Member countries share signals intelligence and surveillance data. | Surveillance network - Data shared across borders among member nations |
⚙️ Technical Protocols & Standards
| Term | Definition | Privacy Impact |
|---|---|---|
| IMAP (Internet Message Access Protocol) | Standard protocol for retrieving email messages from a mail server. Allows clients to access and manage messages stored on the server without downloading them locally. | Neutral tool - Convenience feature, but server-side storage may expose data |
| SMTP (Simple Mail Transfer Protocol) | Standard protocol for sending email messages between servers and from clients to servers. | Neutral tool - Often unencrypted unless using SMTPS/TLS |
| POP3 (Post Office Protocol v3) | Protocol for retrieving email that downloads messages to local device and typically deletes them from the server. | Mixed - More local control, but less convenient for multi-device use |
| Server-Side Encryption | Encryption where data is encrypted while stored on the provider's servers. The provider manages the encryption keys and can decrypt data when needed. | Limited privacy - Protects against theft, but provider holds keys and can access data (often used by big tech) |
🔒 Core Privacy & Security Concepts
| Term | Definition | Privacy Impact |
|---|---|---|
| End-to-End Encryption (E2EE) | Encryption method where only the sender and recipient can read messages. Not even the service provider can access the content. | Critical for privacy - Prevents service providers from accessing your data |
| Server-Side Encryption | Encryption where data is encrypted while stored on the provider's servers. The provider manages the encryption keys and can decrypt data when needed. | Limited privacy - Protects against theft, but provider holds keys and can access data (often used by big tech) |
| Zero-Access Architecture | System design where the service provider has no technical ability to access user data, even with legal requests. | Maximum privacy - Provider literally cannot read your emails |
| Metadata | Data about your communications: sender, recipient, timestamp, subject line, IP addresses, device info. | Often overlooked risk - Even with encrypted content, metadata reveals patterns |
| Data Mining | Automated analysis of user data to extract patterns, preferences, and behavioral insights for advertising or profiling. | Big Tech business model - How free services monetize your data |
| Jurisdiction | The legal territory where a service operates, determining which laws apply to data protection and government access requests. | Legal protection level - Swiss/EU laws vs. US Five Eyes alliance |
| Open Source | Software whose source code is publicly available for inspection, audit, and verification by anyone. | Trust through transparency - No hidden backdoors |
| Two-Factor Authentication (2FA) | Security layer requiring two forms of verification: something you know (password) and something you have (authenticator app, hardware key). | Account protection - Prevents unauthorized access even if password is compromised |
| PGP/GPG Encryption | Public-key cryptography standards for encrypting and decrypting messages using paired public and private keys. | User-controlled encryption - You manage your own keys |
| Anonymous Registration | Ability to create an account without providing personally identifiable information like phone number or real name. | Identity protection - Separates your online identity from real-world identity |
| Tracker Blocking | Technology that prevents invisible tracking pixels and scripts from monitoring email opens, clicks, and user behavior. | Prevents surveillance - Stops senders from knowing when/how you read emails |
🟢 Green = Privacy-positive
🔴 Red = Surveillance/risk warnings
🔵 Blue = Neutral technical information