What we store
For an active inbox, the service stores its temporary email address, creation and expiry times, a session ownership hash, and incoming message content and metadata. This version does not store email attachments. Avoid sending sensitive information to a temporary inbox.
Your browser session
A secure, HttpOnly session cookie connects your browser to your inboxes. It is used for access control, not advertising. The cookie lasts up to seven days; each inbox still expires after 60 minutes. Clearing the cookie removes your browser’s access to those inboxes.
Expiry and deletion
Inbox access ends at expiry. Scheduled cleanup removes expired inboxes and messages, normally within the following 15 minutes when the cleanup Worker is deployed and running. Deleting an inbox removes its active records immediately. Infrastructure providers may retain backups or operational logs under their own policies.
Retired addresses
A keyed hash of each claimed address is retained to prevent the address from being reassigned. This reservation does not include the message body or browser session. Retiring addresses reduces the risk of a future visitor receiving recovery emails intended for an earlier user.
Abuse prevention
The service uses short-lived keyed hashes of network and session identifiers to apply request limits. If enabled by the operator, Cloudflare Turnstile also processes security signals to check for automated abuse.
Service providers
The deployed service uses Vercel for the website, Neon for its PostgreSQL database, and Cloudflare for receiving and processing incoming email. These providers process the information necessary to operate the service. No advertising scripts or analytics trackers are included in this version.
Demo mode
Demo mode uses generated sample messages and temporary process memory. Its .demo addresses cannot receive external email. Demo data may disappear whenever the preview server restarts.