Privacy Policy

This service is built around data minimisation: it keeps as little as it can, for as short a time as it can.

What we store

• Your inbox. Keyed hashes (HMACs) of the generated address and your session token, together with mailbox lifecycle metadata. The token itself exists only in a cookie in your browser.
• Messages sent to your inbox. Sender, subject, timestamp, size and the sanitised body, until the inbox expires.
• Operational metadata. Request timings, error records and a salted, non-reversible hash of the IP address that created an inbox, used for rate limiting and abuse handling.

What we do not store

• No account, name, password or phone number — there is nothing to sign up for.
• No attachments; they are stripped before a message is written to storage.
• No message content in logs or analytics.
• Expired mailbox metadata may remain to prevent address reuse and support abuse handling.

Retention

Access ends when the inbox expires; the countdown shows its lifetime. The expiry cleanup removes messages, while mailbox metadata may remain to prevent address reuse. Deleting an inbox removes its messages. Operational and abuse records follow the operator’s retention settings.

Backups

Backup schedules and retention depend on the hosting operator. Deleting messages from the live service does not establish when an existing backup copy is removed. Contact the operator through the report form for deployment-specific details.

Cookies

One functional cookie per inbox holds your session token. It is HttpOnly, Secure and SameSite=Lax, is not readable by scripts, expires with the inbox, and is not used for advertising or cross-site tracking.

Anyone can send to your address

The address is not a secret; anyone who learns it can send mail to it. Reading the inbox still requires your session token. Do not use a temporary inbox for sensitive or irreplaceable mail.

Contact

Privacy questions and abuse reports can be raised through the abuse report form.