[RandomGerm4n]

Why does Proton store IP addresses in the first place? If they didn't have them, they couldn't give them out. Same with the recovery email. They should write a warning next to it, so that you can then decide for yourself whether a recovery email is advantageous or harmful for your own threat model.

[protonmail]

Most of this metadata is kept only temporarily, including IP addresses, which you can read more about in our Threat model (https://proton.me/blog/protonmail-threat-model ), Privacy Policy ( https://proton.me/legal/privacy ) an this article (https://proton.me/blog/enhancing-protection-information-for-... ). By default, we don't retain IP addresses permanently. Your signup (account creation) IP address is temporarily kept for abuse-prevention purposes, and can be retained indefinitely if your account is found to be engaged in activities that breach our terms and conditions (spamming, DDoS attacks against our infrastructure, brute force attacks, etc). The legal basis of this processing is our legitimate interest to protect our Services against nefarious activities. If your threat model includes anonymity, we recommend that you follow the advice shared at the end of the Restore Privacy article above.

For the majority of users, it's better to have a recovery email on their account, as the risk of losing their password is higher than the risk of being targeted by a legal request. However, even in those cases you can have both, by setting up a new email address which you don't use for anything else as a recovery email.

[INGSOCIALITE]

Why is the recovery email forced? Cant this be an option if the user wants to have one saved when signing up?

[Logxnx]

True for the IP addresses They do have a feature for access logs to your account though. Maybe its because of that?

[protonmail]

This feature is off by default, and if you enable authentication logging for your Account or voluntarily participate in Proton's advanced security program, the record of your login IP addresses is kept for as long as the feature is enabled. However, the IP logs from before the feature is turned on and from after it is disabled are not kept.