Proton
Proton offers genuinely strong privacy protections, including end-to-end encryption, minimal data collection, Swiss-jurisdiction servers, and a firm no-advertising commitment, making it one of the more privacy-respecting services available. However, the legal terms contain significant catches: your maximum compensation for any harm Proton causes is capped at $100, US users are forced into individual arbitration with no class action rights, and policy changes take effect automatically just by continuing to use the service. Practical limitations also apply, such as email metadata remaining visible to Proton, support messages passing through a US third party, early cancellation triggering the full remaining subscription cost, and free accounts being deleted after a year of inactivity. Overall, Proton's privacy promises are credible and well-structured, but its liability and dispute terms heavily favor the company, and users should understand these tradeoffs before relying on it for sensitive data.
Last analyzed
Heads up: this analysis is AI-generated, can be incomplete or wrong, and is not legal advice. Use it as a starting point and read the original document before you agree — see our Terms.
Clause-by-clause breakdown
Every clause we flagged in Proton's agreement, with what it means for you.
Using Proton after a policy change means you automatically agree.
“Within the limits of applicable law, the Company reserves the right to review and change this Privacy Policy at any time. As long as you are using the Services, you are responsible for regularly reviewing this Privacy Policy. Continued use of the Services after such changes are performed shall constitute your consent to it.”
Quoted verbatim from the agreement What this means: Proton can change its Privacy Policy at any time, and simply continuing to use the service counts as your agreement to the new terms. You are not guaranteed a notification or a chance to affirmatively accept changes before they apply to you.
What you can do: Periodically check Proton's Privacy Policy page for updates, and consider setting a reminder to review it every few months.
Proton's maximum payout to you for any harm is $100.
“To the extent not prohibited by law, you acknowledge and agree that in no event will the Company be responsible or liable to you or any third party, under any theory of responsibility or liability, for any indirect, special, exemplary, incidental, consequential, or punitive damages (including, but not limited to, procurement of substitute goods or services; loss of data, use, or profits; business interruptions; or any other damages or losses), for any multiplier on or increase to damages, or for any costs or fees (including attorneys' fees), whether under these Terms or otherwise, arising in any way in connection with your Account, the Services, or these Terms, whether arising at law, in equity, or otherwise, and whether based in contract, strict liability, tort (including negligence or otherwise), common law, statute, equity, or otherwise, even if we have been advised of the possibility of such damage, or for any other claim, demand, or damages whatsoever, arising out of or related to your use or inability to use your Account or the Services. Without limitation of the foregoing, and to the extent not prohibited by law, the total liability of the Company's parties for any reason whatsoever arising out of or related to the use of, or inability to use, your Account or the Services, or these Terms, shall not exceed $100, or the amount you paid us, if any, for use of your Account or the Services, whichever amount is greater.”
Quoted verbatim from the agreement What this means: If Proton loses your data, suffers a breach, or causes you harm, your maximum compensation is capped at $100 or what you paid — whichever is more. All consequential damages (lost business, lost data value, etc.) are excluded entirely. For a service storing sensitive communications and files, this cap is very low relative to potential harm.
What you can do: Maintain your own encrypted backups of critical data stored in Proton Drive or Mail, and do not rely solely on Proton for irreplaceable information.
US users must arbitrate disputes individually and cannot join class actions.
“These Terms of Service contain a class action waiver as well as an arbitration provision, which requires you to arbitrate any claims (with certain exceptions) you may have on an individual basis. Arbitration on an individual basis means that you will not have, and that you waive, the right for a judge or jury to decide your claims, and that you may not proceed in a class, consolidated, or representative capacity in any forum, as described in more detail below. Any and all disputes, actions, claims, or other controversies arising out of or relating in any way to these Terms, your Account, the Services, your use of (or lack of use of) or access to (or lack of access to) your Account or the Services, or any advertising, promotion, or other communications between you and the Company, whether based in contract, warranty, tort, statute, regulation, ordinance, or any other legal or equitable basis, shall be resolved exclusively through final and binding individual arbitration, and the parties expressly waive any and all rights to appeal any order or judgment of the arbitrator or seek confirmation of an order or judgment of the arbitrator to the extent permitted by applicable law. You and the Company each agree that any proceeding to resolve any dispute, claim, or controversy will be brought and conducted only in the respective party's individual capacity and not as part of any class (or purported class), consolidated, multiple-plaintiff, or representative action or proceeding (”
Quoted verbatim from the agreement What this means: class action"). You and the Company agree to waive the right to participate as a plaintiff or class member in any class action.
What you can do: Send a written opt-out notice to Proton AG, Attn: Legal, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland within 30 calendar days of first agreeing to these Terms to preserve your right to sue in court and join class actions.
Free accounts inactive for 12 months can have all data deleted.
“The Company reserves the right to suspend or delete Accounts that have been inactive for a consecutive period of twelve months. For more information, we invite you to read our inactive account policy. The Company reserves the right to suspend or delete free Accounts that have been inactive for a consecutive period of 12 months and/or part or all of their associated data and content according to this section. If you have been inactive on your free Account for a consecutive period of 12 months or more, access to your Account and all or part of the data associated with your Account (including but not limited to emails stored in Proton Mail, files stored on Proton Drive, calendar entries in Proton Calendar and passwords in Proton Pass) may be deleted. You will receive notices 30, 15 and 7 days in advance before such action is taken on the recovery email associated with your Account.”
Quoted verbatim from the agreement What this means: If you have a free Proton account and don't log in for 12 months, Proton can delete your emails, files, calendar entries, and saved passwords. You get warning notices 30, 15, and 7 days before deletion, but only to your recovery email — which you may not check.
What you can do: Log in at least once every 12 months to keep your free account active, or upgrade to a paid plan which is always considered active.
Proton can see email subjects, recipients, and attachment names.
“Due to limitations of the SMTP protocol, we have access to the following email metadata: sender and recipient email addresses, the IP address incoming messages originated from, attachment name, message subject, and message sent and received times.”
Quoted verbatim from the agreement What this means: Even though email content is encrypted, Proton can see who you email, when, the subject line, and attachment names. This metadata can reveal a lot about your communications and relationships, and is accessible to Proton and potentially to Swiss authorities under legal compulsion.
What you can do: Be aware that email subjects and recipient addresses are visible metadata. Use Proton-to-Proton emails where possible, as these benefit from the most protection.
Proton owes you nothing if your data is lost or exposed.
“The Company has no obligation to store or forward the contents of terminated Accounts. We also have no obligation to store messages or contents for accounts that exceed their storage quotas. Furthermore, you will not hold the Company liable or seek indemnification if confidential material is unintentionally released as the result of a security failure or vulnerability in the performance of the Services or if data is deleted for an inactive account (see section 3). Due to the encrypted nature of the Services, you acknowledge that the Company has no ability or obligation to recover your data if you misplace your password.”
Quoted verbatim from the agreement What this means: Proton disclaims any obligation to preserve your data if your account is terminated or exceeds storage limits. You also waive the right to seek compensation if a security failure accidentally exposes your confidential data. And if you lose your password, your data is gone forever — Proton cannot recover it.
What you can do: Store your Proton password and recovery key in a secure offline location (e.g. a password manager or printed copy in a safe).
Lumo data may be disclosed to German authorities, not Swiss.
“We will only disclose the limited user data we possess on a Lumo account if we are legally obligated to do so by a binding request coming from the competent German authorities.”
Quoted verbatim from the agreement What this means: Lumo's privacy policy states data is disclosed only to German authorities, while the main Proton Privacy Policy says data is disclosed only to Swiss authorities. This inconsistency is confusing and could mean Lumo data is subject to a different (and potentially broader) legal jurisdiction than the rest of your Proton account.
What you can do: If jurisdiction matters to you, be cautious about what you share with Lumo until Proton clarifies which legal framework governs Lumo data disclosure.
Signing up automatically opts you into promotional emails.
“By signing up to our Service, you agree to receive communications from us, which may include promotional emails. You can stop receiving emails from us by following the unsubscribe instructions included in every email we send.”
Quoted verbatim from the agreement What this means: Signing up for Proton automatically opts you into promotional emails. You have to actively unsubscribe to stop receiving them. This is opt-out rather than opt-in for marketing communications.
What you can do: After signing up, check your email preferences in the Proton dashboard under the 'Account' tab and adjust your marketing email settings.
Lumo only encrypts chats you explicitly save.
“2.1.2 Account Activity: your inputs are processed by the Services in order to provide outputs. After processing of an input and generation of an output (when you save your chat history within Lumo), the input and output are encrypted with zero-access encryption (meaning we as a provider are not able to decrypt it anymore).”
Quoted verbatim from the agreement What this means: Lumo encrypts your chat history only after you choose to save it. The phrase 'when you save your chat history' implies that unsaved conversations may be processed without the same encryption guarantee. The policy does not clearly state what happens to inputs and outputs that are not saved.
What you can do: Review Lumo's settings and consider whether saving chat history is appropriate for your use case; be mindful that unsaved sessions may not carry the same encryption protections.
Phone and email used for verification are temporarily stored.
“In order to pursue our legitimate interest of preventing the creation of accounts by spam bots or human spammers, we use a variety of human verification methods. Verification may also be requested for some sensitive operations besides account creation in order to protect against brute-force attacks. You may be asked to verify using either Proton Captcha, email, or SMS. IP addresses, email addresses, and phone numbers provided are saved temporarily in order to send you a verification code and for anti-spam purposes. The period of temporary data retention is determined by our legitimate interests of protecting the service from spam, and also by any applicable Swiss legal requirements we must comply with. If this data is saved permanently, it is always saved as a cryptographic hash, which ensures that the raw values cannot be deciphered by us.”
Quoted verbatim from the agreement What this means: When you verify your account via SMS or email, your phone number or email address is temporarily stored. If retained permanently, it's stored as a one-way hash. The retention period is not precisely defined, which reduces transparency.
What you can do: If privacy is a priority, consider using Proton Captcha for verification rather than SMS or email, to minimize the data Proton temporarily holds.
Your IP address is normally not logged, but can be kept permanently if Proton suspects a ToS violation.
“By default, we do not keep permanent IP logs in relation with your Account. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our Terms of Service (e.g. spamming, DDoS attacks against our infrastructure, brute force attacks).”
Quoted verbatim from the agreement What this means: Proton does not log your IP address by default, which is a meaningful privacy protection. However, if Proton determines you have violated its Terms of Service, your IP address can be stored permanently. The definition of a ToS violation is broad, so this exception could apply in more situations than users might expect.
What you can do: Use Proton VPN or Tor when accessing Proton services if you want to prevent your real IP address from ever being associated with your account, even in enforcement scenarios.
You can only delete one email alias per year.
“You can delete up to one alias per year. Otherwise, aliases generally cannot be deleted. This limit does not apply to custom domains.”
Quoted verbatim from the agreement What this means: Once you create email aliases on a paid plan, you are largely stuck with them — you can only remove one per year. This means if you create aliases you later regret (e.g. for privacy reasons), you cannot quickly clean them up.
What you can do: Think carefully before creating email aliases, as you can only delete one per year; plan your alias strategy in advance.
Cancelling early costs you the full remaining subscription balance.
“If you terminate your Account before its term for convenience on the basis of a specific regulation allowing you to do so (including but not limited to Chapter VI of the EU Data Act), you agree that early termination penalties apply, whereas these termination penalties correspond to the remainder of the payment that would otherwise have been due for the agreed term of your Account subscription.”
Quoted verbatim from the agreement What this means: If you cancel your subscription early — even when a law gives you the right to do so — Proton charges you the full remaining balance of your subscription term as a penalty. This effectively makes early cancellation very expensive and could conflict with consumer protection rights in some jurisdictions.
What you can do: Before subscribing to a long-term plan, confirm you are comfortable with the full commitment, as cancelling early will cost you the remaining subscription fees.
Non-US users must resolve all disputes in Swiss courts.
“If you are a business user (anywhere in the world) or a consumer user (residing outside of the United States of America), you agree that these Terms shall be governed in all respects by the substantive laws of Switzerland, to the maximum extent permitted by law. Any disputes, actions, claims, or other controversies arising out of or relating in any way to these Terms, your Account, the Services... shall be subject to the jurisdiction of the competent courts of the Canton of Geneva.”
Quoted verbatim from the agreement What this means: For all non-US users (and all business users worldwide), any legal dispute must be resolved in Swiss courts under Swiss law. This means if you have a complaint, you would need to litigate in Geneva, Switzerland — a significant practical barrier for most users outside Switzerland.
What you can do: Be aware that as a non-US user, your legal recourse is limited to Swiss courts; consider whether this is acceptable before subscribing to paid plans.
Your support chat messages are processed by US company Zendesk.
“Your communications with us, such as support requests, bug reports, or feature requests may be saved by our staff. We may also rely on third parties, such as Zendesk or Calendly (see below). If you use Proton's live chat support, you consent to having the data contained within your live chat interaction processed by Zendesk Inc, the provider of Proton's live chat support platform.”
Quoted verbatim from the agreement What this means: When you contact Proton's support team, your messages are stored and may be processed by Zendesk, a US-based third-party company. This means your support conversations — which could contain sensitive account details — leave Proton's encrypted environment and are handled by an external provider.
What you can do: Avoid sharing sensitive personal information in support chats; use email support if you prefer to minimize third-party data exposure.
You can access, edit, delete, or export your data anytime.
“Through your Account interface, you can directly access, edit, delete, or export personal data processed by the Company in your use of the Services.”
Quoted verbatim from the agreement What this means: Proton gives you a self-service dashboard to view, edit, delete, and export your personal data at any time. This goes beyond what most services offer and is a meaningful user protection.
What you can do: Log in to your Proton account settings to manage, export, or delete your data whenever you choose.
Proton technically cannot read your emails, files, or passwords.
“We do not have the technical means to access the content of your encrypted emails, files, calendar events, passwords, or notes.”
Quoted verbatim from the agreement What this means: Proton uses end-to-end encryption so that even Proton itself cannot read your emails, files, calendar events, passwords, or notes. This is a strong technical privacy guarantee, not just a policy promise.
What you can do: Use Proton's native apps and features to keep your data end-to-end encrypted; avoid pasting sensitive content into unencrypted third-party integrations.
Proton does not permanently log your IP address by default.
“By default, we do not keep permanent IP logs in relation with your Account. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our Terms of Service (e.g. spamming, DDoS attacks against our infrastructure, brute force attacks).”
Quoted verbatim from the agreement What this means: Proton does not log your IP address by default, which is a strong privacy protection. However, if you violate the Terms of Service, your IP address can be stored permanently and potentially disclosed to Swiss authorities.
What you can do: Use Proton VPN to further mask your IP address from Proton's servers if IP-level anonymity is important to you.
Your data is never used for advertising, ever.
“User data is never used for advertising purposes.”
Quoted verbatim from the agreement What this means: Proton explicitly commits that your data will never be used to target you with ads. This applies across Proton Mail and is stated as an absolute rule, not a qualified one.
Proton's AI writing tool never trains on your data.
“Proton Scribe does not use content data or any of your data to train its models.”
Quoted verbatim from the agreement What this means: Proton's AI writing assistant (Scribe) explicitly does not use your content or personal data to train its AI models. This is a meaningful protection compared to many AI-powered services.
All servers are in Switzerland, Germany, or Norway only.
“Data is always stored in encrypted format on our servers, which are exclusively located in Switzerland, Germany or Norway, under the protection of some of the world's strongest privacy laws. Offline backups, which may be stored periodically, are also encrypted. We cannot decrypt any user encrypted content on either the production servers or in the backups. Backups are kept for up to 30 days.”
Quoted verbatim from the agreement What this means: All servers are physically located in Switzerland, Germany, or Norway — countries with strong privacy laws. Backups are encrypted and kept for a maximum of 30 days, limiting long-term data exposure.
Proton only shares data when Swiss law legally compels it.
“We will only disclose the limited user data we possess if we are legally obligated to do so by a binding request coming from the competent Swiss authorities. We may comply with electronically delivered notices only when they are delivered in full compliance with the requirements of Swiss law. Proton's general policy is to challenge requests whenever possible and where there are doubts as to the validity of the request or if there is a public interest in doing so. In such situations, we will not comply with the request until all legal or other remedies have been exhausted. Under no circumstances can Proton decrypt end-to-end encrypted content and disclose decrypted copies.”
Quoted verbatim from the agreement What this means: Proton will only hand over data when legally compelled under Swiss law, will challenge requests where possible, and can never hand over decrypted content because it doesn't have the keys. This is a strong legal and technical protection.
What you can do: Review Proton's published transparency reports to see how many requests have been received and challenged.
Proton collects minimal data and lets you sign up without personal information.
“Our overriding policy is to collect as little user information (personal data included) as possible to ensure a private user experience when using the Services. It is not necessary to provide personal information in order to create an Account. Analytics are anonymized whenever possible and stored locally (and not on the cloud). IP addresses are not retained and stored for such analytics.”
Quoted verbatim from the agreement What this means: Proton explicitly commits to minimal data collection and allows account creation without providing personal information. Website analytics are anonymized and stored locally rather than sent to cloud services, and IP addresses are not retained for analytics. This is a meaningfully stronger stance than most services.
What you can do: No action needed — this is a user-protective policy. You can create an account without providing a real name or recovery email if you prefer maximum anonymity.
You get a 30-day refund, but only once ever per account.
“You may cancel your subscription within 30 days of the initial purchase and receive a full refund for the Service. To request a refund, please contact us using our support form. For the sake of clarity, the cancellation and the request for refund must both be addressed within the 30-day period. Payments made by cash or bank transfers are not refundable. Refunds can only be requested once per user.”
Quoted verbatim from the agreement What this means: Proton offers a 30-day full refund window, which is a reasonable consumer protection. However, the refund is a one-time option per user — you cannot use it again if you re-subscribe later. Cash and bank transfer payments are excluded from refunds entirely.
What you can do: If you are unsatisfied within the first 30 days, contact Proton support promptly to request your refund before the window closes.
Frequently asked questions
Is Proton's Terms & Conditions agreement fair?
- BeforeYouClick grades Proton D on an A–E scale, where A is the fairest. Its agreement contains 3 critical clauses, 12 warnings and 9 good practices.
What are the biggest problems with Proton's terms?
- The most serious clauses we flagged are: Policy Changes Bind You Without New Consent, Liability Capped at $100 for Any Harm and Forced Arbitration and Class Action Waiver.
How long does it take to read Proton's terms?
- Proton's agreement takes about 75 minutes to read in full, across 24 clauses we reviewed. The summary on this page covers the same ground in under a minute.
When was Proton's agreement last analyzed?
- We last read Proton's Terms & Conditions on July 3, 2026. Companies change their terms without notice, so check the original document for the current version.
Is this analysis legal advice?
- No. This analysis is AI-generated, can be incomplete or wrong, and is not legal advice. Use it as a starting point and read the original agreement before you agree to it.
More agreements to read
- PosteoProductivityGrade A
- TutaProductivityGrade B
- KagiProductivityGrade C
- NotionProductivityGrade D
- FastmailProductivityGrade D
- AppleProductivityGrade E