Privacy Policy

1.1 This Privacy Policy explains how the operator of this disposable email service ("we", "us", the "Service") processes personal data belonging to the following groups of people:

• 1.1.1 visitors who use the web inbox without an account (a "Guest");
• 1.1.2 registered account holders who buy a paid plan or call the REST API (a "Customer");
• 1.1.3 recipients of transactional email we send (receipts, plan changes, security notices);
• 1.1.4 anyone who contacts support or writes to the address published on the main site.

1.2 The Service exists to keep your real inbox out of signup flows. That purpose shapes every decision in this document: we collect less than a normal newsletter form does, and we keep it for the shortest window the product can still function inside.

1.3 Privacy questions, deletion requests, and law-enforcement requests go to [email protected]. Put "privacy" in the subject line and include the temporary address involved: we cannot look up an address we no longer hold, so include the approximate date and time as well.

2.1 Personal data means any information that can identify you directly or indirectly. We process only the categories below.

• 2.1.1 Mailbox data: the randomly generated address string, the messages delivered to it (headers, bodies, attachments), and the expiry timestamp of the mailbox.

  Source: generated by the Service when you or a script requests an address, plus the sending mail server that delivers into it.

• 2.1.2 Session data: a random session identifier stored in one first-party cookie, binding the mailboxes you created to this browser. No name, no email, no profile.

  Source: created by the Service on your first visit.

• 2.1.3 Account data: email address, password hash (Argon2id, salted, never reversible), display name if you provide one, plan slug, and account creation date. Only for Customers.

  Source: submitted by you at signup.

• 2.1.4 Billing data: invoice number, amount, currency, plan, and the payment provider's transaction reference. We do not receive or store full card numbers; the payment provider handles the card.

  Source: created when you complete checkout.

• 2.1.5 Log data: truncated IP address, requesting endpoint, HTTP status, response time, and user-agent string, retained for abuse mitigation and capacity planning.

  Source: generated automatically by the web server and the mail API.

• 2.1.6 Support data: whatever you voluntarily put in a support message, including any screenshots you attach.

  Source: provided by you.

2.2 We do not process special-category data (health, biometrics, political opinions, religion) and we do not build advertising profiles from message content.

3.1 We process personal data on the following bases.

3.1.1 Performance of a contract: delivering mail to the mailbox you asked for, keeping the inbox reachable, and issuing the plan you paid for.

3.1.2 Legitimate interest: keeping the Service online and unattractive to abuse. Our interest is proportionate because the data involved is minimised: addresses are random, logs are coarse, and nothing is used to build a profile of a person.

3.1.3 Legal obligation: retaining invoice records for the period tax law requires, and responding to a valid legal order.

3.1.4 Consent: optional product email (release notes, change summaries). You can withdraw consent at any time from the account page or by replying to any such message; withdrawal does not affect processing that already happened.

3.2 We do not sell personal data, do not share mailbox contents with advertisers, and do not use message bodies to train models. Verification-code extraction happens in memory at render time; the parsed code is shown to the mailbox owner and is not retained separately.

4.1 Personal data reaches the following recipients, each bound to process it only for the listed purpose.

• 4.1.1 The hosting and mail infrastructure provider that runs the API and the inbound mail pipeline.
• 4.1.2 The payment provider, for Customers only, to charge a card and issue a receipt.
• 4.1.3 Transactional email provider, used to deliver signup confirmation, receipts, and security notices.
• 4.1.4 A CDN and DNS provider, which sees request metadata but not mailbox contents.
• 4.1.5 Competent authorities, only on a lawful, specific, and documented request.

4.2 Where a recipient is outside your jurisdiction, the transfer relies on an adequacy decision or standard contractual clauses. A copy of the relevant safeguards is available on request.

4.3 A sending mail server necessarily sees the recipient address it delivers to. That is inherent to email and is not a disclosure by us.

5.1 Retention is short by design, and the number is visible inside the product rather than buried here.

5.2 Deletion is a hard delete with a maintenance purge behind it. Expired mailboxes are swept continuously and the sweep is logged by count, not by address.

5.3 Content of a temporary inbox is deliberately not backed up. If you need to keep a message, forward it or download the raw source before the timer ends. This is why the interface shows the expiry time on every mailbox.

6.1 Subject to applicable law, you may request access to your personal data, rectification, erasure, restriction, portability, and you may object to processing based on legitimate interest. Write to [email protected].

6.2 A request about a guest mailbox must include the address string and the approximate date, because a deleted mailbox leaves nothing to search on. We answer within 30 days and usually much sooner.

6.3 You may lodge a complaint with your local data protection authority. We would appreciate the chance to resolve it first.

6.4 We do not make automated decisions with legal effect about you. Plan enforcement (quota, rate limit) is mechanical and reversible by contacting support.

7.1 This site sets one cookie and one local storage key. The detail lives in the Cookie Policy.

7.2 Advertising slots on this site serve creatives from our own domain and count clicks through a server redirect. No third-party advertising cookie is set by us. If the operator of this deployment connects an external ad network, that network's own notice applies to the creatives it serves.

7.3 Blocking the session cookie breaks the inbox: mailboxes are bound to the cookie, so a blocked cookie produces a new empty inbox on every page load.

8.1 A material change to this Policy is announced on the site and, for Customers, by email before it takes effect. The effective date and version at the top of this page always describe the text you are reading.

8.2 The Service is not directed at children and we do not knowingly process data of anyone under the age required to consent to online services in their jurisdiction.

8.3 Operator details, including the legal entity and registered address for this deployment, are published on the main site and in the footer of every invoice.

8.4 Contact: [email protected].