About | News | Usage | FAQ | Stats | Privacy

The public keyserver running on keys.openpgp.org processes, stores and distributes OpenPGP key data. The specific way in which data is processed differs by type as follows:

• Email Addresses

  Email addresses contained in User IDs are personally identifiable information (PII). Special care is taken to make sure they are used only with consent:

  • Publishing requires double opt-in validation, to prove ownership of the email address in question.
  • Addresses are searchable by exact email address, but not by associated name.
  • Enumeration of addresses is not possible.
  • Deletion of addresses is possible via simple proof of ownership in an automated fashion, similar to publication. To unlist an address where this isn't possible, write to support at keys dot openpgp dot org.

  This data is never handed collectively ("as a dump") to third parties.

• Public Key Data

  The cryptographic content of OpenPGP keys is not considered personally identifiable information. This includes specifically public key material, self-signatures, and revocation signatures.

  This data is not usually collectively available ("as a dump"), but may be handed upon request to third parties for purposes of development or research.

• Other User ID data

  An OpenPGP key may contain personal data other than email addresses, such as User IDs that do not contain email addresses, or image attributes. This data is stripped during upload and never stored, processed, or distributed in any way.

  OpenPGP packet types that were not specifically mentioned above are stripped during upload and never stored, processed or distributed in any way.

Data is never relayed to third parties outside of what is available from the public API interfaces, and what is described in this policy.