Mail Scanning and Privacy: What the Service Can See

A mail service that scans works because you have authorised a stranger to open your letters. That is not a scandal, it is the product, but it is worth thinking about for longer than the fifteen seconds most people give it.

What you are actually authorising

Three distinct permissions get bundled together at signup.

Receiving mail addressed to you. This is Form 1583 and it is a postal requirement, covered in the Form 1583 article.
Photographing the outside. Every service does this by default. The image shows the sender, which is itself informative: a letter from a court, a hospital or a collections agency tells a story before anyone opens it.
Opening and scanning the contents. Usually on request, item by item, though some plans do it automatically.

The third one is the one to think about. Once scanned, the contents of your mail exist as a file on somebody else's server, indexed, searchable, and retained according to a policy you probably did not read.

The legal position, briefly

Mail in the postal system has strong legal protection in the United States, and interfering with somebody else's mail is a federal offence investigated by the United States Postal Inspection Service. Once mail has been delivered to your agent, at your written request, that protection has done its job: the mail reached the person you authorised. What happens next is governed by your contract with the service and by ordinary privacy law, which in the United States is thin and sectoral rather than comprehensive. The Electronic Frontier Foundation's privacy work is a reasonable starting point for how weak the default position is for stored records held by third parties.

Practically: assume that anything scanned could be produced under legal process, could be exposed in a breach, and will outlive your account.

Questions worth asking

How long are scans retained after I delete them? "Deleted" often means removed from your view. Ask about backups.
Who can see the scans internally? A service where any operator can open any account's images is different from one where access is logged and scoped.
Where is the scanning done? Some operations are offshore. That is not automatically bad, but it changes which laws apply.
Is the scanning automated or manual? Somebody is physically opening the envelope either way.
What happens to the paper? Shredding on site, and whether shredding is certified, varies more than you would expect.
Is two-factor authentication available? Your mail account is a password reset target for every other account you own. This one is not optional.

The security angle people miss

A mail service login is one of the highest-value accounts you have. Bank statements, tax documents, new card notifications and identity documents all arrive through it. Somebody who gets into it does not just read your post, they get the raw material for account takeover everywhere else.

Treat it like your primary email: unique password, two-factor authentication, and an account recovery route that does not depend on the mail service itself. That last part is a genuine circular dependency worth thinking through.

A middle path

You do not have to scan everything. A workable pattern:

Envelope images for everything, which is free and tells you most of what you need.
Open-and-scan only for things that need action.
Forward, unopened, anything genuinely sensitive that you want on paper: legal documents, anything with a full account number, anything from a tribunal.
Shred the rest at the source rather than storing it.

That reduces both your bill and your exposure, which is unusual as trade-offs go.

If you keep a physical box instead

The privacy calculus flips. Nobody opens anything, but the mail sits in a box in a shop, and the store holds copies of your identity documents anyway because Form 1583 requires it. Ask how those copies are stored. If you want to know what is arriving before you visit, the Postal Service's own Informed Delivery shows scanned images of the outside of letter mail for many addresses, at no charge, which covers part of the same ground without anyone opening anything.