Most of this metadata is kept only temporarily, including IP addresses, which you can read more about in our Threat model (
https://proton.me/blog/protonmail-threat-model ), Privacy Policy (
https://proton.me/legal/privacy ) an this article (
https://proton.me/blog/enhancing-protection-information-for-... ). By default, we don't retain IP addresses permanently. Your signup (account creation) IP address is temporarily kept for abuse-prevention purposes, and can be retained indefinitely if your account is found to be engaged in activities that breach our terms and conditions (spamming, DDoS attacks against our infrastructure, brute force attacks, etc). The legal basis of this processing is our legitimate interest to protect our Services against nefarious activities. If your threat model includes anonymity, we recommend that you follow the advice shared at the end of the Restore Privacy article above.
For the majority of users, it's better to have a recovery email on their account, as the risk of losing their password is higher than the risk of being targeted by a legal request. However, even in those cases you can have both, by setting up a new email address which you don't use for anything else as a recovery email.