Who can read your email? A simple explanation

Where your emails are stored, who can read them there and on the way, what encryption changes, and which four private email providers this site lists.

Key points

Every email you send or receive is stored on the servers of your email provider, often for years. A regular provider can read every message that is not end-to-end encrypted.
Transport encryption protects an email on its way between servers. Germany’s Federal Office for Information Security (BSI) points out that the providers involved can still read it in plain text.
Private email providers encrypt your stored mail so that, as they state, they cannot read it themselves.

Where your email is stored

An email does not travel straight to the person you write to. It goes from your device to your email provider, from there to the recipient’s provider, and from there to the recipient. Your provider keeps a copy in your mailbox, and the recipient’s provider keeps one in theirs.

Both copies often stay on the servers for years, until someone deletes them.

Who can read it

Who	What they can read
Your email provider	every message that is not end-to-end encrypted
The recipient’s provider	the same, on its side
Someone who gets into your account	everything in your mailbox
Authorities	what a court orders a provider to hand over

Providers also read mail by machine. Google, for example, states in its terms that its automated systems analyze content “for spam, malware, and illegal content” when it is sent, received, and stored.

Gmail and ads. In 2017, Google announced that it would stop using the content of consumer Gmail to personalize ads. Its privacy policy, in effect since October 16, 2026, keeps that rule with one exception: if you choose to make your Gmail data available to other Google services that support personalized ads.

What encryption changes

Transport encryption (TLS) protects an email on its way between servers. According to the BSI, the email is still in plain text at the providers and at the relay points along the way.

Zero-access encryption protects stored mail. The provider encrypts each message with a key that only you can unlock. Proton describes it as protecting your data “so that only you have access.”

End-to-end encryption protects the message the whole way. According to the BSI, only the sender and the recipient can then read it, if they have the necessary key. The guide End-to-end encrypted email, explained shows how this works.

The private providers listed here

	Company	Based in	Free plan	Open source
Hushmail	Hush Communications Canada Inc.	Canada	no	no
Posteo	Posteo e.K.	Germany	no, 1 euro a month	partly
Proton Mail	Proton AG	Switzerland	yes	yes
Tuta	Tutao GmbH	Germany	yes	yes

The table shows what the providers state on their own websites. This site has not tested them.

What you can do

Protect your email account first, with a long, unique password and two-factor sign-in.
Do not send passwords or copies of your ID in a normal email. Use end-to-end encryption or another way.
Choose a provider that cannot read your stored mail if you want your mailbox to stay private.

Next step

Why your inbox is the key to your other accounts, and how to protect it, is explained in the guide Why your email account needs the best protection.