Question 1

How private is signup?

Accepted Answer

Registration does not require KYC, identity documents, legal names, phone numbers, address verification, or an existing email address. Login uses an access token instead of an email address or username. GoyMail is for adults 18 and older. The service is privacy-focused, not abuse-friendly.

Question 2

How do I log in?

Accepted Answer

Use the access token shown at signup. It must stay in XXXX-XXXX-XXXX-XXXX format with the dashes included. Your token is shown once. Store it carefully; support cannot recover the original token after you leave the save-token screen.

Question 3

I set a custom mail password. Can I still generate PGP keys?

Accepted Answer

Yes. Webmail PGP always wraps the private key with your access token, not the custom IMAP password. When prompted, enter the token in XXXX-XXXX-XXXX-XXXX form. Do not delete the custom mail password to work around PGP; clearing it is unnecessary and used to rotate the token. Clear now puts IMAP back on the same access token you already have. It does not issue a new token.

Question 4

How do desktop or mobile mail clients connect?

Accepted Answer

Use your full email address as the username. Use the same token in XXXX-XXXX-XXXX-XXXX format as the IMAP/SMTP password, unless you set a separate app password in Settings. SMTP: mail.shabbos.to:465 (SSL/TLS). IMAP: mail.shabbos.to:993 (SSL/TLS). POP3: mail.shabbos.to:995 (SSL/TLS).

Question 5

Why is outbound SMTP locked?

Accepted Answer

Outbound SMTP is closed until you pay $1 (or use a paid plan that includes sending). That is a feature gate for shared-IP deliverability, not account suspension, and not proof-of-work. Spam and abuse raise blocklist and reputation costs. The more garbage people send, the more expensive unlock floors, plan prices, and free-tier send caps get for everyone. Per-account outbound rate limits still apply after unlock. Tipping toward hosting is separate but appreciated. See Donate for XMR, BTC, Bitcoin Cash, Litecoin, Lightning, and EVM options when available.

Question 6

Is GoyMail end-to-end encrypted?

Accepted Answer

Email is not end-to-end encrypted by default. Messages and metadata must pass through GoyMail systems so the service can provide mailboxes, IMAP/SMTP access, spam control, abuse handling, and security. Webmail can optionally use OpenPGP. You can generate a keypair, import keys, or publish a public key only. The public key is stored on GoyMail servers so other logged-in webmail users can encrypt to you. You can also opt in to public WKD / GoyKeys discovery (clear public warning; turn off anytime to stop serving). If you also upload a private key, it is stored only as ciphertext encrypted with your Access Token for in-browser unlock. Optional Autocrypt headers advertise your key on outbound mail. Compose can look up keys via GoyMail, GoyKeys, or remote WKD for other providers. Subjects stay plaintext. The web app renders mail bodies as plaintext and does not load third-party assets.

Question 7

How do I report abuse?

Accepted Answer

Send abuse reports to abuse@shabbos.to. Include the full original message source with all headers, message IDs, timestamps with timezone, the exact address or domain involved, and evidence for the abuse category. Screenshots alone are not enough. See Abuse for the full report requirements.

Question 8

How do I contact admin or support?

Accepted Answer

For general/admin questions, email admin@shabbos.to. Include the relevant account address or domain, what you were trying to do, and any useful timestamp or error text. Do not send your access token, app passwords, private keys, identity documents, or unrelated mailbox contents unless specifically requested.

Contact & FAQ