Excellent points, this is just why I run my own servers and actually emails which are private are sent as links, messages and data remain only on my server and

Excellent points, this is just why I run my own servers and actually emails which are private are sent as links, messages and data remain only on my server and are deleted after 30 days. So even if someone still got that message with link, they don't have my message anymore. Btw. You can count how many of your friends are security experts and how many aren't, I'm pretty sure that ratio is quite bad. Anyway, for some uses your own tor hidden service is fine, it's quite easy to run if you're familiar with Tor and services. You can also use something better and more secure for communication than HTTPS and Tor, like SSH and BBS like interface. It reduces risk that people accessing your service with systems which aren't properly prepared to be secure won't store anything at all on disk. (Yes, it still could be possible to swap or hibernate some data if users are real failures.) Yet another option which I like is RetroShare, it's secure and keeps data private, but it doesn't inheritly hide connections between nodes, for that part you'll need another anonymization layer. For simplicity, I prefer to use self hosted message system with SSL and notifications can be sent with link or without link to users when required based on message content / subject / privacy level required etc. If users do have registered account, then they also might need to give their login credentials if required. My server also provides TOTP authentication as 2FA solution, for a few geeks who use it, including my self.