Privacy and data retention

What we store

For each generated address we store the address itself, the domain, a creation timestamp and a message count. For each received message we store the sender, subject, plain-text body, sanitized HTML body, extracted links, attachment metadata (filename, size and MIME type only) and two timestamps: when it arrived and when it must be deleted. Nothing is stored about the person reading the inbox.

What we do not store

No account records, because there are no accounts. No passwords. No email address of yours. No cookies of any kind, including analytics cookies. No advertising identifiers set by us. No browser fingerprint. Your generated address is kept in your own browser's sessionStorage, which is discarded by the browser when you close the tab, and it is never written to a cookie or synced anywhere.

Retention

Every message carries a deletion timestamp set 60 minutes after it arrives. Once that timestamp passes the message is no longer served or readable through any interface, and it is erased by an automatic time-to-live policy at the storage layer, in practice within 24 hours of expiry. Expiry applies whether or not the message was read. There is no archive, no interface through which an expired message can be retrieved, and no copy is kept once the deletion has run.

The ten-minute mode is a shorter clock on the address, not on the message: the address stops being offered to you after ten minutes, while any message it already received is deleted on the same 60-minute schedule as everything else.

Attachments

Attachment contents are not retained or served. Only the metadata listed above is kept, so the inbox can tell you a file was attached without ever handing you an executable.

Message safety

Incoming HTML is sanitized on our servers before it is stored: scripts, forms, iframes, event handlers, remote images and tracking pixels are removed at write time rather than at render time, so a tracking pixel never gets the chance to report that you opened the mail. The remaining HTML is displayed inside an iframe with an empty sandbox attribute and its own default-src 'none' content-security policy, which blocks every network request the message could attempt. Links are listed outside that frame so nothing is fetched unless you deliberately click it.

Inboxes are public to whoever knows the address

There is no authentication, so anybody who knows or guesses an address can read its inbox. The local part is ten random characters from a 32-symbol alphabet, which makes guessing impractical, but it is not a secret worth relying on. Never send anything sensitive to a temporary address.

Third parties

Advertising is not enabled at present. If fixed-size advertising units are enabled later they will be served non-personalised in the EEA and UK, and this page will be updated before that happens. Hosting and mail routing are provided by Cloudflare; message storage and the inbox API run on Google Cloud.

Contact

This service is operated as part of Webmail. Abuse reports and data questions: see the acceptable use page.