4 ms·

situations like this is what makes it really hard for others in this space to survive. I run https://clean.email https://clean.email (and we don't store/retain/

by kkyryl 9y ago

situations like this is what makes it really hard for others in this space to survive. I run https://clean.email https://clean.email (and we don't store/retain/sell any data, just charge people to use it) and the biggest issue we have is lack of trust because of news like this. although every day someone would still email with a question "why you are not free like unroll.me".. sigh.

kkyryl 9y ago
it's kinda funny how ~50 people who came from this thread to our service illustrated the point of the lack trust – not a single person registered :)
- CamelCaseName 9y ago
  I don't see how that indicates a lack of trust. People may not be in the mood to change, or need to do more research before they do, especially since it is very late in the evening for the Western world. Also, it's only been 30 minutes since your first post, and 50 is a small sample size.
  - kkyryl 9y ago
    that's just a joke – I was not really hoping to get users from here :) I was actually surprised with 50 even clicking the link.
- gogopuppygogo 9y ago
  I clicked, I read your value prop, I just can't see myself paying $95+ /year for less obnoxious email in my inbox. It's really not that big of a problem to me.
  - kkyryl 9y ago
    ugh. I have "Yearly pricing to the homepage" sitting in my to-do list for a few weeks :) so – there's yearly pricing (and it starts with 14.99 / year (I know, this looks really weird, but it took us some time to get to this pricing). now, whether it's valuable enough to justify the price – depends a lot on how you use your email. we've got users managing 3-5 accounts with hundreds of thousands of emails each and they use our labeling/organization more than removal. think of it as of a way to act upon a group of emails no matter what the size of the group is. (and I kinda think our website is not really good at communicating this – our traffic is mostly coming from android app right now and we've been putting website work off. who knew!).
    - DrJaws 9y ago
      Then why you complain? You offer plain and simply ask for 8€ per month per account. That's simply a ridiculous amount of money for 99% of the people, what you have but we can't see is part of the problem, not the trust, the price is just not worth for what you offer, so, don't complain about "not a single new customer from 50 clicks".
      - kkyryl 9y ago
        https://news.ycombinator.com/item?id=14182152 https://news.ycombinator.com/item?id=14182152 ;)
    - jh00ker 9y ago
      Hey, quick fix: Just make Yearly the default option when the page loads, since the yearly options are the best price. Users to your site may just scroll through without clicking anything and only see the monthly prices (like I did).
      - kkyryl 9y ago
        this sounds like a great idea from the rational standpoint, but our data says otherwise. we've seen a conversion increase and generally more people started buying when we enabled monthly prices and again when we made them default. I have a few theories to back it up – but generally speaking pricing perception is emotional, not rational. looking at our prices you'd assume no one buys monthly, but about 40-50% of people do :)
- ianwalter 9y ago
  Yea I'm certainly not eager to sign up for another service like this after finding out that the last one I used sold my data. It's getting really tough to trust third party services with your data these days.
  - kkyryl 9y ago
    my point exactly. I was just discussing this with a friend – there's really no way for us to prove that we don't keep or don't sell the data we get access to (aside from clearer tos/policies). and it's even scarier with iCloud for example – they don't have oAuth and people need to enter their passwords to scan/clean. (they do have "app-specific" passwords though but looks like people have hard time figuring those out.)
    - raesene2 9y ago
      Well there is, but it's not cheap. You get a trusted third party to Audit you and publish the result of their Audit, something similar to a SAS70. It's not a perfect solution but it's an option to consider
      - kkyryl 9y ago
        fair point – this is something we consider doing before expanding to b2b market. but: my day job is in ecommerce (I work as a product manager at FastSpring) and I used to work on CleanMyMac at MacPaw – had to work with trust in both. it's somewhat unexpected but people who are buying software for themselves usually don't care about PCI compliance, audits, and other artifacts of "institutional validation". they care about a "norton secured" badge, proper language, recommendation from a person they know, a review at the website they read, "that green thing with the lock in my browser".. we're now at the phase where we are trying to find the right combination. just to be clear – it's very different from project to project and depends on the audience. what I'm saying is that we're making decisions emotionally mostly based on our prior experience and rely on internal "thermometer" to tell us if what we're seeing is trustworhty.
        9y ago
sorokod 9y ago
> the biggest issue we have is lack of trust because of news like this. This gives you something fundamental to compete on.
nkrisc 9y ago
Well now you have an excellent value proposition you can point to for why you aren't free.
- kkyryl 9y ago
  Yeah, I'm working on the website update right now to put ToS/policies front and center – "we can do a better job" communicating our policies :)
eganist 9y ago
Interesting. I can't click your Terms of Use link. Would you happen to have a direct link handy?
- kkyryl 9y ago
  We have them on the "about" page – https://clean.email/about https://clean.email/about – but we are actually working on a separate page right now. as I said above – we can and should do better putting our policies front and center.
tptacek 9y ago
I understand that you don't retain user emails, and that's good, but do I understand that your service has somewhere a database of OAuth bearer tokens that provide direct access to the email archives of everyone who has signed up for your service? How do you protect that? I would be terrified.
- kkyryl 9y ago
  yes, that is correct. we actually started without keeping refresh tokens and only using access tokens – but they expire really fast and google api randomly stops accepting them so we had to start keeping refresh tokens as well. they are encrypted and can only be decrypted by "scan" and "action" (delete, trash, etc) jobs, job servers are not exposed to the outside and can only be accessed via the private network via ssh using access keys and only from a specific node which has those keys. keys are password protected. access to that specific node is restricted to a set of known public ip addresses. database and job servers are different servers of course. database servers are also only accessible within the private network. the only thing that's publicly exposed is a load balancer. to access anything else we log in to the "gateway" instance which we access by ip only and it does not have any domain name associated with it. with all that – I am very open to ideas about protecting that further.
  - insomniacity 9y ago
    Encryption at rest? Backups and encryption thereof?
    - kkyryl 9y ago
      All job servers are stateless by design and easily disposable/replaceable with a fresh build so we don't back them up. we don't back up user data either – it's deleted within 24 fours (or immediately on request). the only thing backed up is a table with refresh tokens which are encrypted and decryption keys are not backed up with it.
michaelmior 9y ago
Could you explain the limits of the free plan? Interested in trying this out but it's not clear what I'll get it and if/when I'll be forced to pay. That said, I understand the value in paying for such a service instead of selling off all my data.
- kkyryl 9y ago
  Free plan allows you to clean (remove, trash, label etc) 1000 emails
  - michaelmior 9y ago
    Thanks! That sounds pretty reasonable. It would be great to have that explained somewhere on the site.
    - kkyryl 9y ago
      Hmm, makes sense. I went ahead and added it under pricing. Thank you :)
      - michaelmior 9y ago
        Awesome :) Minor nit, the grammar you're currently missing an article. It should be "Cleaning the first 1,000 emails is free!"
        kkyryl 9y ago
        that's the thing about quick fixes lol :)
        kkyryl 9y ago
        fixed that too. thank you again.
bethebutterfly 9y ago
You won't survive and you clearly don't understand how this business works.

by kkyryl 9y ago

kkyryl 9y ago

it's kinda funny how ~50 people who came from this thread to our service illustrated the point of the lack trust – not a single person registered :)

CamelCaseName 9y ago
I don't see how that indicates a lack of trust. People may not be in the mood to change, or need to do more research before they do, especially since it is very late in the evening for the Western world. Also, it's only been 30 minutes since your first post, and 50 is a small sample size.
- kkyryl 9y ago
  that's just a joke – I was not really hoping to get users from here :) I was actually surprised with 50 even clicking the link.
gogopuppygogo 9y ago
I clicked, I read your value prop, I just can't see myself paying $95+ /year for less obnoxious email in my inbox. It's really not that big of a problem to me.
- kkyryl 9y ago
  ugh. I have "Yearly pricing to the homepage" sitting in my to-do list for a few weeks :) so – there's yearly pricing (and it starts with 14.99 / year (I know, this looks really weird, but it took us some time to get to this pricing). now, whether it's valuable enough to justify the price – depends a lot on how you use your email. we've got users managing 3-5 accounts with hundreds of thousands of emails each and they use our labeling/organization more than removal. think of it as of a way to act upon a group of emails no matter what the size of the group is. (and I kinda think our website is not really good at communicating this – our traffic is mostly coming from android app right now and we've been putting website work off. who knew!).
  - DrJaws 9y ago
    Then why you complain? You offer plain and simply ask for 8€ per month per account. That's simply a ridiculous amount of money for 99% of the people, what you have but we can't see is part of the problem, not the trust, the price is just not worth for what you offer, so, don't complain about "not a single new customer from 50 clicks".
    - kkyryl 9y ago
      https://news.ycombinator.com/item?id=14182152 https://news.ycombinator.com/item?id=14182152 ;)
  - jh00ker 9y ago
    Hey, quick fix: Just make Yearly the default option when the page loads, since the yearly options are the best price. Users to your site may just scroll through without clicking anything and only see the monthly prices (like I did).
    - kkyryl 9y ago
      this sounds like a great idea from the rational standpoint, but our data says otherwise. we've seen a conversion increase and generally more people started buying when we enabled monthly prices and again when we made them default. I have a few theories to back it up – but generally speaking pricing perception is emotional, not rational. looking at our prices you'd assume no one buys monthly, but about 40-50% of people do :)
ianwalter 9y ago
Yea I'm certainly not eager to sign up for another service like this after finding out that the last one I used sold my data. It's getting really tough to trust third party services with your data these days.
- kkyryl 9y ago
  my point exactly. I was just discussing this with a friend – there's really no way for us to prove that we don't keep or don't sell the data we get access to (aside from clearer tos/policies). and it's even scarier with iCloud for example – they don't have oAuth and people need to enter their passwords to scan/clean. (they do have "app-specific" passwords though but looks like people have hard time figuring those out.)
  - raesene2 9y ago
    Well there is, but it's not cheap. You get a trusted third party to Audit you and publish the result of their Audit, something similar to a SAS70. It's not a perfect solution but it's an option to consider
    - kkyryl 9y ago
      fair point – this is something we consider doing before expanding to b2b market. but: my day job is in ecommerce (I work as a product manager at FastSpring) and I used to work on CleanMyMac at MacPaw – had to work with trust in both. it's somewhat unexpected but people who are buying software for themselves usually don't care about PCI compliance, audits, and other artifacts of "institutional validation". they care about a "norton secured" badge, proper language, recommendation from a person they know, a review at the website they read, "that green thing with the lock in my browser".. we're now at the phase where we are trying to find the right combination. just to be clear – it's very different from project to project and depends on the audience. what I'm saying is that we're making decisions emotionally mostly based on our prior experience and rely on internal "thermometer" to tell us if what we're seeing is trustworhty.
      - 9y ago

sorokod 9y ago

> the biggest issue we have is lack of trust because of news like this. This gives you something fundamental to compete on.

nkrisc 9y ago

Well now you have an excellent value proposition you can point to for why you aren't free.

kkyryl 9y ago
Yeah, I'm working on the website update right now to put ToS/policies front and center – "we can do a better job" communicating our policies :)

eganist 9y ago

Interesting. I can't click your Terms of Use link. Would you happen to have a direct link handy?

kkyryl 9y ago
We have them on the "about" page – https://clean.email/about https://clean.email/about – but we are actually working on a separate page right now. as I said above – we can and should do better putting our policies front and center.

tptacek 9y ago

I understand that you don't retain user emails, and that's good, but do I understand that your service has somewhere a database of OAuth bearer tokens that provide direct access to the email archives of everyone who has signed up for your service? How do you protect that? I would be terrified.

kkyryl 9y ago
yes, that is correct. we actually started without keeping refresh tokens and only using access tokens – but they expire really fast and google api randomly stops accepting them so we had to start keeping refresh tokens as well. they are encrypted and can only be decrypted by "scan" and "action" (delete, trash, etc) jobs, job servers are not exposed to the outside and can only be accessed via the private network via ssh using access keys and only from a specific node which has those keys. keys are password protected. access to that specific node is restricted to a set of known public ip addresses. database and job servers are different servers of course. database servers are also only accessible within the private network. the only thing that's publicly exposed is a load balancer. to access anything else we log in to the "gateway" instance which we access by ip only and it does not have any domain name associated with it. with all that – I am very open to ideas about protecting that further.
- insomniacity 9y ago
  Encryption at rest? Backups and encryption thereof?
  - kkyryl 9y ago
    All job servers are stateless by design and easily disposable/replaceable with a fresh build so we don't back them up. we don't back up user data either – it's deleted within 24 fours (or immediately on request). the only thing backed up is a table with refresh tokens which are encrypted and decryption keys are not backed up with it.

michaelmior 9y ago

Could you explain the limits of the free plan? Interested in trying this out but it's not clear what I'll get it and if/when I'll be forced to pay. That said, I understand the value in paying for such a service instead of selling off all my data.

kkyryl 9y ago
Free plan allows you to clean (remove, trash, label etc) 1000 emails
- michaelmior 9y ago
  Thanks! That sounds pretty reasonable. It would be great to have that explained somewhere on the site.
  - kkyryl 9y ago
    Hmm, makes sense. I went ahead and added it under pricing. Thank you :)
    - michaelmior 9y ago
      Awesome :) Minor nit, the grammar you're currently missing an article. It should be "Cleaning the first 1,000 emails is free!"
      - kkyryl 9y ago
        that's the thing about quick fixes lol :)
      - kkyryl 9y ago
        fixed that too. thank you again.

bethebutterfly 9y ago

You won't survive and you clearly don't understand how this business works.