Privacy notice
Effective 22 October 2026. This is a temporary inbox service, not a permanent or confidential email account.
What is stored
We process your temporary address, email headers, content, arrival time and attachments metadata to deliver messages. Your browser stores inbox access keys and display preferences. The server stores a hash of each access key. Rate-limit counters use a keyed hash of the connection address, rather than storing the raw IP in the application database. Hosting and email providers may separately keep network/security logs.
Who can access mail
Anyone with your access key can access that inbox. Other visitors cannot access it by guessing the email address. The operator and hosting/email providers can access server-side email. Mail is not end-to-end encrypted. Do not send passwords, financial records, identity documents or other sensitive information here.
Expiry and deletion
The default inbox lifetime is one hour, with a maximum of 24 hours from creation. Access ends at expiry. Scheduled maintenance deletes expired application content and, when the Mail API connection is working, requests deletion of the matching originals from the dedicated receiving mailbox. Deleting an address also makes its source copies eligible for removal. Incoming mail for unallocated or ambiguous temporary addresses is held for at most 24 hours after the service discovers it, then scheduled for deletion. Direct system mail to the inbound service mailbox is excluded.
Deletion can be delayed by maintenance failures, API permission problems, provider outages or a disconnected mailbox. Provider backups and security logs follow their own retention schedules; we cannot promise immediate physical erasure. Used-address hashes are retained permanently to prevent address reuse. Message-deduplication identifiers and completed processing records are kept up to 30 days. Abuse reports are kept up to 30 days.
Images and attachments
External images are blocked until you choose to show them. Showing them can reveal your network address and that a message was opened to the remote image server. Attachment downloads are disabled during the safety beta; no malware-scanning guarantee is made.
Providers and storage
This deployment uses Hostinger hosting and email. The operator controls the receiving connection and private server settings. There are no advertising or analytics scripts in this version. Operational provider logs still exist. Inbox contents and access keys must never be sent to an analytics service.
Questions or privacy requests
Use the report form and choose “Privacy request.” Include a way to contact you only if you want a reply. Never include passwords, verification codes, API tokens or inbox access keys. Keep the report receipt.