What the OxiMail software reports
An OxiMail server can send us a short report about how it runs — only if its operator says yes, and only for the categories they choose. This page lists every field the report can carry, for each version of its format. It covers the software; this website is covered by the privacy policy.
-
Who receives it
Activate sàrl, Geneva, Switzerland, is the controller. The receiver runs on a server of Hetzner Online GmbH in Nuremberg, Germany (EU) — a provider separate from the one that holds licence records, so that a report cannot be joined to a licence.
-
Your choice, category by category
The setup asks “Help improve OxiMail? [y]es / [c]rashes only / [n]o / [d]etails” and has no default answer: pressing Enter asks again. An unattended setup must state the answer. An installation that was never asked sends nothing. The answer can be changed at any time with
oximail telemetry enable,oximail telemetry enable --crashes-onlyoroximail telemetry disable, without a restart. Saying no changes nothing for the server, its updates or its licence: no licence, not even the free one, depends on it. -
Crash reports (“crash”)
The version, how many times the server started after a run that did not stop cleanly, how those runs ended as systemd recorded them (killed by a signal, out of memory, timeout, unknown…), and where in OxiMail’s code a panic happened: the crate, the file and the line — never the message, never a value. At most sixteen distinct places per report.
-
The usage report (“usage”)
Operating system and architecture; the distribution as family and major version (such as debian-13); whether the build is official or custom; the server’s role (primary or backup MX) and compiled features; uptime in hours; accounts, mail received and mail sent as ranges (such as 10–49); the share of mail rejected as spam and the number of filter calls; the five most used JMAP methods with their call count and the share of calls in each response-time band; JMAP error types with their counts; protocols and client families with their counts (requests for web and calendar clients, sessions for IMAP clients, whose family is read from the name the client gives itself); which settings of a fixed list differ from their default (the setting’s name, never its value); how far the setup got (from a fixed list); the response time compared with the previous version run on the same server.
-
In every report
The version of the report format, the window it covers (its start, to the minute, and its length), the installation identifier, the software version, and the version of the consent text answered with the categories consented.
-
Never sent
Mail content or subjects, addresses, contacts, calendars, files, domain names, host names, your users’ IP addresses, the licence key, configuration values, panic messages.
-
The installation identifier
Derived from a random secret kept in the server’s data directory: not the licence, not the host name. It never appears in the server’s logs, and
oximail telemetry statushides it unless asked. A copy of the data directory restored on another machine gets a new identifier. The receiver keeps no access log and does not store the address a report came from; it keeps the time of receipt to the hour. -
How long
Reports are kept 90 days, then deleted; the receiver’s backups are kept seven days. What remains after that is a daily count per software version, without any identifier. Nothing of it is published.
-
See it, delete it
oximail telemetry statusshows the exact bytes of the last report the receiver accepted.oximail telemetry purge --applypresents the installation’s secret to the receiver, which deletes every report that installation sent; the installation then gets a new identity. No ticket, no email, no identifier to copy. -
Subprocessor
Hetzner Online GmbH, Gunzenhausen, Germany: hosting of the receiver. No other party receives or processes the reports.
Versions of the report format
-
4 — OxiMail 0.31, from 23 September 2026
The format described above. Each category leaves only with its own consent.
-
3 — 23 September 2026, morning
Introduced the consent question. Carried the distribution’s full name, a per-method 95th-percentile response time and an always-zero bounce counter, sent the secret itself as identifier, and only with consent to the usage report.
-
2 and earlier — before 23 September 2026
Sent under the previous setting, where reporting was on unless switched off. These reports are kept until their 90 days expire.