GG.email
Sign in

Security & Privacy

How sign-in and sessions work, how we handle your data, and how to report a security issue

Account Security

GG.email has no passwords. You sign in with Steam or Discord, so your account is as secure as the Steam or Discord account you sign in with.

Signing In With Steam or Discord

When you sign in, Steam or Discord confirms who you are and tells GG.email. GG.email never sees your Steam or Discord password. Other platforms you link, such as Twitch or Battle.net, only add addresses. They can't be used to sign in.

Benefits

  • No password to forget - Use the gaming account you already have
  • No password to leak - We don't store passwords at all
  • Your platform's protections apply - Steam Guard and Discord two-factor authentication protect your sign-in
  • Familiar recovery - If you lose access, recover it through Steam or Discord
GG.email will never ask for your password. Not for Steam, Discord or any other platform, not by email, not in chat and not on a GG.email page. Anyone who asks is trying to steal your account. Only ever type your password on Steam's or Discord's own sign-in page.
Link both Steam and Discord. Your account can only be reached by signing in through them, so linking both gives you a backup if you ever lose access to one.

Two-Factor Authentication (2FA)

Steam or Discord handles your sign-in, so their two-factor authentication protects your GG.email account too.

Turning On 2FA

  1. Turn on two-factor authentication for every account you sign in with:
    • Steam Guard - Use the Steam Mobile Authenticator
    • Discord - Turn on two-factor authentication in Discord's account settings
  2. Nothing else to do: your next GG.email sign-in goes through the same protection
Recommended: turn on two-factor authentication for the platforms you only link too, such as Twitch and Battle.net. Those accounts back your addresses.

Session Management

When you sign in, GG.email keeps you signed in on that browser for a while, so you don't have to sign in every visit.

How Long You Stay Signed In

Your session renews while you use GG.email, and ends after a period of inactivity. Every so often you'll be asked to sign in again.

Signing Out

  1. Open the profile menu in the top corner of your inbox
  2. Click Sign out
On a shared or public computer, always sign out when you're done.

Data Privacy

Here is a short summary of how we handle your data. The Privacy Policy has the full details.

What We Collect

  • Account details - Your usernames and identifiers from the platforms you link
  • Your content - The mail you send and receive, and your contacts
  • Service data - Activity times, browser and device information, and a coarse IP address

What We Don't Do

  • We never sell your data
  • There are no ads on GG.email, and we don't use your mail for advertising. Pro subscriptions pay for the Free plan
  • We don't share your data with third parties, except the service providers listed in the Privacy Policy

Where Your Data Lives

GG.email runs on Cloudflare, and your account, mail and contacts are stored there. Your data is encrypted at rest and in transit.

Email Security

Checking Who Sent an Email

Incoming mail goes through these checks before it reaches you:

  • Mail that fails both SPF and DKIM is rejected
  • Mail that fails DMARC is rejected when the sender's domain asks for that
  • Free accounts receive only from other GG.email users and from approved senders, such as gaming platforms and major personal email providers. Those senders must pass authentication, so a forged message claiming to be from a gaming platform is refused
  • Pro accounts receive from anyone

Spam

If an email is unwanted, select it and click Report spam to move it to your Spam folder. To stop mail from someone for good, block them under Contacts in your profile settings.

Safe Email Practices

Help keep your account secure:

  • Be careful with unexpected emails that ask for personal information or account details
  • Check the sender's address before you click a link
  • GG.email will never ask for your Steam, Discord or any other platform password. Treat any message that does as a scam
  • Use Report spam on anything suspicious

Connected Account Security

Reviewing Connected Accounts

See which gaming accounts are linked to your GG.email account:

  1. Open your profile settings and go to Platforms
  2. Every address is listed with the platform it comes from
Tip: link both a Steam and a Discord account. You get a backup way to sign in, and an extra 250 MB of storage.

Account Recovery

If You Lose Access

Because you sign in with Steam or Discord, getting back into GG.email starts there:

  1. Recover your Steam or Discord account through their own recovery process
  2. Once you're back in, sign in to GG.email with that account
  3. Your GG.email account and mail are waiting for you

Keep a Backup Sign-In

If both Steam and Discord are linked to your account, you can sign in with either one. Losing access to one of them then doesn't lock you out of GG.email.

Can't Recover Your Sign-In Account?

If you can't get back into the Steam or Discord account you sign in with, contact support and tell us your GG.email addresses.

Data Deletion and Portability

Downloading Your Data

You can download a copy of your mail and account data at any time from your profile settings.

Deleting Your Account

  1. Open your profile settings and go to Subscription
  2. Under Danger zone, click Delete account
  3. Confirm. Your account, addresses, contacts and mail are deleted

Download your data first if you want to keep a copy.

Mail You've Deleted

Deleting an email moves it to Trash. Mail older than your plan's history (14 days on Free, 1 year on Pro) is removed automatically.

Deleting your account is permanent. Your addresses, contacts and mail can't be recovered afterwards.

Reporting Security Issues

If you discover a security vulnerability or think your account has been compromised:

For Security Vulnerabilities

Email security@gg.email with the details. We take security reports seriously.

If You Think Your Account Is Compromised

  1. Secure your Steam and Discord accounts: change their passwords, turn on two-factor authentication, and sign out their other sessions
  2. Sign out of GG.email on any device you still have
  3. Check the addresses under Platforms for any you don't recognise
  4. Email security@gg.email and tell us what happened

Responsible Disclosure

We appreciate responsible disclosure of security issues. If you find a vulnerability:

  • Report it privately to security@gg.email
  • Give us time to fix it before you make it public
  • Don't exploit it or access other users' data

Privacy Policy

For complete details on how we handle your data, please review our full Privacy Policy.

Our privacy policy covers:

  • What data we collect and why
  • How we use your data
  • Who we share data with
  • Your rights and choices
  • How to contact us
← Addresses & Contacts FAQ →