How do I verify a forwarded email?

Ask the mailbox owner to export the original email as a .eml file, then upload it to selfcheck.email. The DKIM signature on the original indicates whether the content is unchanged.

What does DKIM verification establish?

A valid DKIM signature establishes that the email content has not been altered since the sender's mail server signed it. It does not establish that the content is true or that a specific person wrote it.

Yes. You can verify up to 5 emails per hour without an account. Free accounts get 5 cases per month with timestamped PDF reports.

Does SelfCheck store my email?

No. The email file is processed in memory and deleted immediately. Only cryptographic hashes and the PDF report are retained.

Last updated: 1 July 2025

Privacy Policy

Data controller: HandyHope CIC (Company No. 16540333), ICO Registration ZB993576.

1. Verify / Retrieve mode

The original email file is deleted immediately after processing. Only cryptographic hashes, metadata, and the PDF verification report are retained (90 days default; configurable per plan).

Email body and attachments are deleted after processing and are not retained at rest in this mode.

2. Vault mode — stored emails

When you choose to share a verified email via Vault, an encrypted copy is stored for sharing with your designated recipients.

Encrypted at rest (AES-256-GCM)
Retention: your choice of 30 / 90 / 365 days
You can delete at any time — immediate removal
PIN stored as argon2id hash only — never in plaintext
Access logs retained 6 years (append-only)

3. Legal basis

Processing is based on your consent (UK GDPR Art. 6(1)(a)), withdrawable at any time. Audit logs are maintained under legitimate interest (Art. 6(1)(f)).

4. Who sees your data

Vault recipients see only what you choose to disclose
Verdict, verification status, signing domain, and disclaimer are always visible (cannot be hidden by the owner)
We do not sell or share data with third parties
We do not use external analytics, advertising pixels, or tracking scripts

5. Infrastructure and security

Hosting: Hetzner Cloud (Falkenstein, Germany — EU)
TLS in transit, AES-256-GCM at rest for Vault
No third-party fonts, analytics, or CDN scripts
All cookies are first-party and functional only

6. Data retention

Verify reports: 90 days default (configurable 7–365 days per plan)
Vault items: owner-chosen retention (30/90/365 days) + 14-day grace period
Account data: retained while account is active + 30 days
Audit logs: 6 years (append-only)

7. Your rights

Under UK GDPR you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), data portability (Art. 20), object (Art. 21), and withdraw consent at any time.

Contact: privacy@selfcheck.email

You also have the right to lodge a complaint with the ICO. (ico.org.uk).

8. Cookies

We use only functional, first-party cookies. See our Cookie Policy for details. Cookies.

···