No account, no profile
There is no signup, no password and no user record. Your inbox is identified by a random reference and a secret token held in a cookie in your browser.
What is stored while an inbox is alive
- The generated address, its creation and expiry times, and a hash of its access token.
- Messages delivered to it: sender, recipient, subject, plain text, sanitised HTML, arrival time and size.
- Attachments, within the configured size limit, on disk outside the web-servable directory.
- A keyed hash of the network address that created the inbox, used only for rate limiting and abuse handling. Raw IP addresses are not stored.
- Daily counters for product events such as "an inbox was generated". These are counts only and contain nothing personal.
Retention
Messages and attachments are deleted when the inbox expires. Mailbox records are removed entirely within about a day after that. Abuse and rate-limiting records are kept for up to 30 days so repeated abuse can be handled, then deleted.
Processing
Mail is parsed and sanitised automatically to display it — that processing is the service. Nobody reads your mail as a routine matter, though operators can see message metadata in an administrative interface when investigating abuse.
Tracking
Remote images in email are blocked by default, so open-tracking pixels do not fire. The site itself sets one functional cookie for your inbox session and does not use third-party analytics.
What we do not claim
This service is not anonymous, not untraceable, and not encrypted end to end. Email travels the internet in the ordinary way, your connection is visible to the sites you use, and anyone who obtains your temporary address can attempt to send to it while it is alive. Treat a disposable inbox as a convenience, not a shield.
Contact
Privacy questions and deletion requests: see the contact page. Abuse reports: report abuse.