Are they required to keep the data?

And don’t pay with a credit card if you’re committing crimes lmao

Not sure about Swiss laws regarding merchant payment card data retention... But they aren't really going to matter with this situation either way. Even if Proton doesn't keep any identifying information directly, the payment processor for sure is going to keep identifying data. Proton will have a confirmation number for the payment being processed, which can be correlated via the payment processor anyway.

Proton did some PR for Trump a while ago that didn't get them on everyones good side.

They’re not shilling for Proton you’re just not understanding that using Mailbox will not protect you from what happened with Proton in the article.

You cannot put up a fight when ordered to do something by a judge who has jurisdiction over you. You either comply or you’re committing a crime.

Proton's response

I imagine they got courts and lawyers and motions and hearings and stuff over there, even if the fight is doomed you need to show your teeth once in a while. and what's with the proton employee reviewing whether there were "explosives" and "guns" involved, naturally based on super-reliable evidence, what the fuck is that?!

and alla that aside, why do they have payment and user info on file, for what fucking purpose? there's either user privacy or there ain't. and them folks are in the "ain't" camp.

Recurring payments I think

I don't see any anonymous payment methods on this page.

Tuta has a 3rd party provider that you can send cash or Monero to and get a gift card to pay for your account.

Mullvad will directly take cash and Monero.

I don't see anything suggesting that Proton does anything similar

I imagine they got courts and lawyers and motions and hearings and stuff over there, even if the fight is doomed you need to show your teeth once in a while.

That’s not how it works. They can’t just refuse to comply with a lawful order from a judge. They could be put in actual jail. This affects all email providers.

just really sad to call yourself a privacy company and then feed your customer to the gestapo

people can end up as embarrassing footnotes in history a number of different ways, but being a dishonest coward company in the privacy sphere is basically speedrunning it

Long Live Tutamail and using a duckduckgo.com address as a backup!

what is this take based on? there's a direct line between "we want this shit done" and "judge rubberstamps order"? no process, no interview, no hearing, no nothings? medieval courts maybe worked that way, no system of government I know of nowadays does.

Every single government works this way. Court orders are not optional.

Not this again...

For one, it was Andy Yen, posting on his personal rather than from Proton's account.

Second, if you follow the money, Andy Yen and Proton donates a lot of money to liberal organizations. They also campaign for Democrats actually.

The downfall of this is all because he thought Gail Slater would be a good pick and the entirety of the privacy community thought he undid all of his privacy advocacy and foundation overnight.

https://scribe.rip/@ovenplayer/does-proton-really-support-trump-a-deeper-analysis-and-surprising-findings-aed4fee4305e

Yeah, I am no fan of proton and they have lied before (no log VPN logs magically finding logs for authorities and then later removing the no-log claim).

But this is literally just proton being legally compelled to hand over data the user willingly gave (not being harvested or de-encrypted). A nothing story.

Another comment linked to a reddit post where Proton explained what happened.

Yeah, the credit card was on file for recurring payments.

Is there any private way to have emails forwarded from a service like GMail to Proton? I know you could forward to an alias on the Proton account, or alternatively forward through a third party (which you would then have to also trust), but I want to hear from people who know more on the topic than me.

I never trusted ProtonMail. Right when you sign up, you're constantly bombarded with advertisements to upgrade to pro. They're plastered everywhere with obnoxious banners.

I get that they're a business and they need money to operate, but the ads are so obnoxiously "in your face" that in my mind their priority isn't your privacy, it's your money.

Tutamail is the better service.

They gave payment data to the authorities, because, guess what, they HAVE to provide whatever is subpoenaed. Did they provide emails, IP addresses? Doesn't say any of that. There's the option of paying with crypto, but the imbeciles that know they are going to be at risk of being found, paid with a credit or debit card.

404 media is more of the same sensationalism laden bullshit out there. Make a fucking Strom out of a drop of water.

Private from what? Google sees the forwarded emails anyway.

Plus, the owner of Proton said that Trump also did good things.

That was the straw that broke the camel's back.

Oh boy, their man fawning over Trump is aging like fine milk.

Proton the company that prides itself protecting privacy when it is literally the law of the country they are in. It is like a cabby advertising that they have license and insurance.

Idk you asked. I used a search engine. You can too.

I will always be a amazed at the bootlicking this company produces.

Protón don’t promise anonymity If you use your credit card to pay protón services. Maybe he has to learn more about OPSEC. 🤷‍♂️

Please, using crypto alone isn't going to do shit. The barrier to entry for truly anonymous usage is not something most people will ever accomplish.

Privacy is effectively dead but yet we have a company trying to advertise about it. Proton has always been marketing garbage meant to attract people's money.

Garbage company with no ethics other than taking care of their pocket book.

You’re mixing up privacy and anonymity. Encryption alone doesn’t make you anonymous — that’s true — but Proton never claimed it would. Their promise is that email content is end-to-end encrypted, which is why they can’t hand over the messages themselves.

In the case reported by 404 Media, the identification came from payment information, not from breaking encryption. If you pay with a credit card, your identity is already tied to the account. That would happen with any service under a legal jurisdiction.

The real takeaway isn’t that Proton is “garbage”, it’s that most people misunderstand what encryption actually protects.

I was talking about both. The fact that Proton exists as a middle man to expose a customer is the reality of the situation. Do you think they score points for blaming their customer!? I really have a hard time dealing with shills for corporations.

The real takeaway is the way Proton advertised itself was a fucking lie and now they have to spend all their time back peddling while shills like you do PR for them.

Garbage company with to leaders who say stupid shit about politics they don't understand and make idle threats to their own government saying they are going to move like the little fascist bitches they are.

Proton didn’t “expose” the user by breaking encryption. According to the reporting, the identification came from payment information, which any company legally has to keep and can be compelled to provide under a court order. The email content remained encrypted.

This isn’t unique to Proton — any service operating under a legal jurisdiction is a potential middleman if it stores identifiable data. That’s exactly why anonymity requires Tor, anonymous payments, and strict OPSEC, not just encrypted email.

So the real lesson isn’t that encryption is fake; it’s that privacy tools don’t automatically give anonymity, and many people expect them to.

Proton, if it cared, could have taken any number of steps to mitigate this problem. Like I said, they created a false image of what they provided to the public and have been back peddling ever since. I get it you don't see it that way and that you don't view yourself as a shill.

You’re still confusing two completely different things: privacy and anonymity. Encryption protects the content of messages, not every piece of metadata around an account. Proton has always been clear about that.

In the 404 Media case, the identification came from payment information, not from Proton breaking encryption. If someone pays with a credit card, their identity is already tied to the account. That would happen with any provider under legal jurisdiction.

Honestly, the way you’re framing this suggests you don’t really understand how encryption, metadata, and OPSEC work. Encryption ≠ anonymity. Anyone who actually works in security knows that.

I was never confused about the issue. Honestly you are just shilling for Proton.

I’m not shilling for Proton. I’m pointing out a basic distinction you keep ignoring: encryption protects message content, not identity.

Calling Proton’s encryption a “lie” just shows you’re arguing emotionally rather than technically. Anyone who actually understands the space knows encrypted email was never meant to guarantee anonymity.

I said their marketing was a lie. Hey I get it, reading is hard.

I read it just fine. What you’re doing is calling it a “lie” because you expected anonymity from a tool that advertises encrypted email. Those aren’t the same thing.

Anyone who actually understands the basics of privacy tools knows that. Your argument sounds more like frustration than a technical point.

How's Tutamail any better than Proton Mail? Help me understand. And if Tutamail's priority is not your money, then what is it? There's no such thing as a free thing after all (?).

They’re a paid service with a free tier — of course they promote upgrades. That’s literally how freemium products work.

But ads for a paid plan don’t suddenly mean the privacy model is fake. By that logic every privacy service with a free tier would be “untrustworthy.”

If you prefer Tuta, fine — but pretending Proton exists only to grab money is a pretty shallow take.

Please, they changed their marketing and had to make several clarifications. They were deceptive to begin with. It was always dumb considering they only ever followed the law. It was never like they went above and beyond.

Hey we are company that follows the law pick us just doesn't have the vibe that got them their business.

I criticize the company for their practices you are playing shill pretending to "inform" me about technical issues.

I’m not pretending anything. You’re criticizing their marketing, I’m pointing out the technical reality behind the claims. Those are two different discussions.

Proton’s core claim has always been encrypted email content, not immunity from legal orders. No company operating in a country can ignore the law.

If your argument is that their marketing created unrealistic expectations, that’s a fair criticism. But calling it a “lie” and ignoring how the technology actually works doesn’t make the argument stronger.

I am here saying Proton sucks for X and Y reason. The fact that all Proton can do is blame their users rather than develop more robust practices speaks to the opposite of what got people to buy into their ecosystem to begin with

So this is much more than their marketing. Like any corporation they suck just because they exist. As their ecosystem grows they will increase in price and enshitification will quickly set in. It is inevitable.

Finally their leadership has made so many statements that are frankly so out of touch with reality it isn't funny. I feel sorry for people that are getting taken advantage of. Proton is just another predatory lying corporation.

This story is yet another example of the damage this company has caused because of their carelessness. Instead of figuring out how not to store this information on their servers they choose to put their users at risk.

There is so much wrong with this company it isn't funny. I called Telsa and Musk several years ago as garbage and I fully believe Proton is in the same vein.

Yes, that's basically what I was getting at. So it sounds like as long as Google knows the account emails are being forwarded to (can see the headers) there is no notion of privacy.

You’re free to dislike Proton, but most of what you’re describing isn’t unique to them — it’s how any service operating under a legal jurisdiction works. If a company stores payment or account data, a court can compel it. That’s true for Proton, Tuta, Gmail, or anyone else.

Expecting a hosted email provider to somehow eliminate all legal exposure for users just isn’t realistic. If someone needs real anonymity, the solution was never a normal email service in the first place.

Criticizing marketing or leadership is fair. But blaming Proton for the basic limits of hosted services sounds more like anger at the system than a technical critique of the product.

I had looked to possible anonymous payment methods for Proton and found nothing before.

I asked because you were making a claim against what I had found. Not my fault you made a false claim without proof

We're not in a court of law, and i didn't make any claims. Get over yourself.

I could say the same to you. You're the one who sent a link without checking if it was relevant to the conversation.

Most people would accept that they made a faux pas and quietly leave the thread. Instead, you decided to get defensive and snarky about it. Grow up.

The way email forwarding works is: email is being received in full (by Google in your case), they look up processing rules, and send a copy to your Proton account, then optionally delete it.

The only thing you protect yourself from this way is Google knowing your IP address every time you check email. They have seen the contents and all headers of forwarded messages.

Sorry to reply to a two week old comment, this is their supported payments page: https://proton.me/support/payment-options.

You can use a prepaid visa to buy account credits, or proton gift cards. They don't support monero, which is really annoying, but it's not the biggest hassle to convert from monero to bitcoin for a purchase.