No-email AI accounts: a selling point that fails teams

An AI account with no email is sold as privacy. For a company it removes the address for an incident notice, account recovery and the way to take access back from someone who leaves. It also hides less than the pitch suggests. Drael is the clearest example we know, and we would not run a team on it.

Data collected on 9 and 10 November 2026 from Drael's privacy page, its account documentation and home page, and from NotHoly pricing. We did not create a Drael account.

#What Drael's no-email account is

Drael's privacy page describes it: "An account is a name you choose, a code, and a key derived from your name and password that only exists to recover the code." The home page turns that into one of its three headline figures, no personal data, and into a promise: "No email is asked, so there is nothing here to leak or to sell."

The recovery story is one sentence in the terms: "if you lose both, your history cannot be recovered by anyone, us included." There is no reset link, because there is nowhere to send one.

#What the design still exposes

No email does not mean nobody sees anything. The same privacy page lists who does.

Who	What they see, in Drael's words
The CDN in front of the site	"sees your address and the traffic passing through it"
The card processor	Receives your network address "for its own fraud checks"
The payment provider	"sees the payment and whatever you give it to pay"
Drael's server, during use	"holds your key in memory, because the model has to read the conversation"
Drael's monitoring	Route, timing, errors "and the account's internal id"
The breach lookup service	"the identifier you asked about"
Sites you fetch	"a request from our server"

The encryption claim comes with its own limit: "it protects what is stored, not a conversation while it is happening." So the account has no email, and the operator still handles your prompts in clear while you work, a payment trail exists, and the ledger survives deletion "because accounting records have to be kept".

The trade also runs one way. Drael knows nothing about you, and you know nothing about Drael: its terms name no company, no address and no governing law. We think an anonymous customer buying from an anonymous seller has given up more than they gained.

#What breaks when the account belongs to a company

Everything a security team does with a vendor account assumes an identity behind it.

Need	With a no-email account on Drael
Incident or breach notice	No address to send it to
Recovery after a lost credential	None; lose the code and the password and the history is gone
Offboarding a contractor	No organization or roles in the public documentation; the person keeps the account
Proof of who ran what	A handle the user chose
Billing to a company	A payment reference; the seller is unnamed
Scaling a team	Four answers at once per account; the docs suggest "separate accounts"

NIST SP 800-115 expects test data to be collected, stored and destroyed under documented rules that management and the test lead sign. An account that belongs to whoever holds a code does not fit under rules like that.

#Why security teams already fight this

Unmanaged AI accounts are the problem security teams are trying to remove. The Verizon 2026 DBIR reports that 45% of employees are regular AI users on corporate devices and that 67% of users on corporate devices use non-corporate accounts. Netskope's 2026 report counts 223 GenAI data policy violations per organization per month, with source code the most common data type at 42%.

A no-email account cannot be anything other than a personal account. A company cannot claim it, monitor it or close it. In the Stack Overflow Developer Survey 2026, 13.0% of respondents (n=13,857) cite privacy or security as a reason to avoid AI, and a tool that removes the organization from the account does not answer that concern.

#Four questions before a team adopts one

Ask who receives the breach notice. Ask how access is revoked when someone leaves. Ask which legal entity you are paying. Ask what happens to the work if one person loses a password. On Drael the answers from the public pages are: nobody, it is not, unknown, and it is gone.

#What NotHoly does

NotHoly requires an email, and we do not claim anonymity. In exchange the console has organizations, roles, workspaces, keys with limits and an audit log, and the terms name the company you are dealing with. API content is not recorded, only metadata; chat history is saved unless you choose an ephemeral chat. A team can remove a member and keep the work.

If your requirement is that the vendor must not know your email, NotHoly does not meet it.

#Where each fits

A no-email account fits an individual who wants to stay unknown to the seller and carries nothing anyone else depends on. It fits no team: there is no address for an incident notice, no recovery, and no way to offboard someone who leaves. NotHoly requires an email and claims no anonymity; in exchange a team gets organizations, roles, scoped keys and an audit log, and can remove a member and keep the work.

#Frequently asked questions

#Is there an AI with no signup or email?

Yes. Drael opens an account with a name, a password and a code, and allows three free sessions per address in 24 hours.

#Is an anonymous AI account really anonymous?

No. On Drael the CDN sees your address, the payment provider sees the payment, and the server holds your key in memory while you use it.

#What happens if I lose my Drael password and code?

The terms say the history "cannot be recovered by anyone, us included".

#Can a company use a no-email AI account?

It can pay for one. It cannot administer it, receive notices on it or take it back from an employee.

#Does NotHoly work without an email?

No. An email is required.

#Verdict

"No email" is a slogan aimed at an individual who wants to stay unknown to the seller. It does that partially, and it removes every control a team needs. On Drael it comes with a seller that is just as anonymous as the buyer. For work with a client, pick the account you can administer: why professionals do not run engagements on Drael has the full checklist, and NotHoly pricing starts at US$ 5.