[Note: This isn’t about an isolated tech support issue. It’s about what one of the most “privacy-centric” companies on the planet—including its most-senior personnel—did when I exposed an architectural defect in one of their privacy apps that corrupted downloads of encrypted user data. The company’s official position was this, until I fought them for weeks to change it, and even then, they dodged any meaningful accountability: the affected user base should downgrade their entire privacy and security posture in order to “workaround” the app’s architectural defect.]

—

I’m an active Proton Unlimited subscriber and enjoy contributing my time and energy by reporting new bugs and when possible, helping to craft fixes for those bugs. A few months ago, I diagnosed and reported a data-corrupting defect in the Proton Drive Android app. The bug wasn’t massive, but it was substantive. From almost the moment I reported it, Proton fixated not on patching the defect but on managing me, the person who found it and who insisted it be treated the appropriate priority for an architectural defect.

What followed was a singular, nearly 50-day campaign of bad-faith damage control by Proton involving multiple Support agents, a supervisor, three “accountability” teams, and a public-facing reddit account, culminating in my outright administrative censorship. Although it took weeks of persistence (more on that below), I persuaded Proton to patch the defect begrudgingly. What I learned in the process is ugly: Proton’s “Privacy by Default” image is just a mask for what lies beneath: “Privacy by Deception.”

Here’s the timeline of how Proton weaponized its privacy image and corporate standing to manipulate a substantive defect and suppress the person who exposed it for telling the truth about the nature of that defect.

• Phase 1: The Misclassification (Filip G.)

Between May 22 and 26 (2026), I notified Proton that when the Proton Drive app’s auto-lock feature was set to “Immediately” (a mandatory setting for those whose Proton Drive syncs with not just their phone but also their numerous other devices, including their tablets and PCs), the act of initiating a download would trigger the app’s (not Android’s) lock screen, interrupt the OS intent, and result in a corrupted 0-byte download of the target file onto the device. This was a glaring architectural defect, not the intended behavior, and I have no doubt Filip G. understood its seriousness.

Given that I’d already diagnosed the bug, it was easy enough to prioritize it properly and slate it for an immediate patch. But on May 26, just four days after my initial report, Proton began establishing their bad-faith strategy. First, Support Agent Filip G. misclassified the data-corrupting failure of lifecycle management as a mere “suggestion,” which means it wouldn’t be fixed in the foreseeable future. I pushed back via additional emails, and when that proved fruitless, I asked for a supervisor.

• Phase 2: The Stonewalling (Marija S.)

Support Agent Marija S. took over on June 1. First, she wasn’t even a supervisor. Second, all she did was parrot back to me my own diagnosis and her colleague’s (Filip G.’s) misclassification. I reiterated the clear and reproducible data-corrupting nature of the defect and again asked for a supervisor.

• Phase 3: The Gaslighting (Damjan)

On June 2, Supervisor Damjan finally stepped in. He immediately built a straw-man argument (saying “background” downloading wasn’t possible, which had nothing to do with the behavior I reported), and he likewise parroted back to me the problem I myself had discovered. Because Damjan was the third person (a supervisor, no less) to churn me through the same dead-end hand-waving, there was no longer any doubt: Instead of owning up to and fixing the architectural defect in their privacy-oriented software, they were trying to manage and gaslight the person who exposed it and wanted it addressed properly.

But Damjan was just getting started. The next thing he did was to advise me to weaken my multi-device security as a “workaround” to their engineering failure. When I called him out on June 4, he conceded his negligence: “I completely understand and apologize for offering such a workaround in the first place.” Despite this, he continued pretending the bug wasn’t a defect but a “suggestion” and requested “improvement.”

I demanded he put me in touch with his own superiors. He claimed he forwarded my “latest” email to them. I demanded he send his superiors the entire ticket thread, not just my latest message. He changed his tune and claimed he’d already sent the whole thing. I repeated my demand for his supervisors so I could file a complaint against him. He pretended he couldn’t do that, and then he prematurely and unilaterally closed the ticket while still insisting the defect was just a requested improvement: “Due to the fact that we cannot provide an estimated time of arrival for this improvement, we would not be able to keep this ticket request open, and will need to close it.” Soon after, he followed through and buried the ticket. I pushed back, but he became unresponsive altogether.

• Phase 4: The Containment, Cover-Up, and Censorship

I bypassed Damjan and escalated the full ticket thread via email to Proton’s security@, abuse@, and legal@ teams. Their response: 🦗🦗🦗 Not even an acknowledgement, not even when I followed up.

Having exhausted the organizational chain of command, I went public, posting the documented timeline with appropriate evidence to r/ProtonMail under the title “Proton Support Loses the Plot: Misclassifying defects, pushing bad security advice, gatekeeping formal complaints, closing unresolved tickets, and oversight teams that are M.I.A.” But my original post was immediately “filtered.” I asked (exceedingly politely) that my post be approved for publication, but I heard nothing back. My post remained (and remains) shadow-banned.

The next day, Proton used its official reddit account to respond, but only with more self-serving gaslighting and fabricated claims. I pushed back using their own quoted words proving their response was full of lies. But Proton shadow-banned my reply as well. That means the only thing that is and was ever visible is my title and Proton’s response. They didn’t just get the last word; they got the only word. And if that still wasn’t enough, they even hid my reddit post from search indexing. See for yourselves: https://www.reddit.com/r/ProtonMail/comments/1uqolpe/proton_support_loses_the_plot_misclassifying/ (if they kill this link entirely, I’ve archived it here: https://ghostarchive.org/archive/BOcZh).

Proton creates a façade of “Privacy by Default” to hide its true nature: “Privacy by Deception.” It protects its image by willfully misclassifying defects as “suggestions” and “improvements,” negligently suggesting users compromise their own security in service of Proton’s almighty image, burying unresolved tickets and refusing to re-open them, obstructing users from holding Proton technically and organizationally accountable, and then censoring you users when they go public with the truth.

Now I’m left to wonder if Proton will target this post as well, even though it’s not on their subreddit. We’ll see.

I've been among the group complaining for a couple of years now that Proton is misleading its clients with their "Unlimited" plan. I think starting with their Standard Notes acquisition, they decided that it didn't count as a Proton product and that it would be a separate subscription. After that, Lumo and Meet were excluded from their Unlimited plans.

It's still a great subscription and an amazing value*. I don't blame them for the business decision. I understand that these are too expensive to fold in at the price and they don't want to raise the price. But, it's false marketing. Calling it "Unlimited" premium access and limiting premium apps is misleading.

*Weirdly, Duo is a much better value, 50% higher cost doubles your access, gives you Scribe, and quadruples your storage. It's a separate conversation but it might be time to give Unlimited users more storage soon to close at least that gap.

Imo Proton should offer users a limited improvement over the free versions of these products (ex: offering a 'mid' tier of Lumo with a longer chat history or more projects. Or adding integrated Meet scheduling in Calendar and local recording. Maybe letting Standard Notes users count their storage against their Drive and give them revision history, and web clipping. The kind of things that don't add significant cost to Proton but do add more utility to subscribers without giving them the 'full' and more costly perks)... Or, change the name of Unlimited (or, both).

They've recently admitted an interest in changing the name. It's been a few months without an update on their end though. I'm curious if this community has opinions about this?