Privacy Policy

Free tier.We collect nothing about you personally. No account, no name, no password. The only data that exists is the transient mail delivered to the inbox you generate — sender, subject, body, and any attachments — held so you can read it in the browser. Your inbox address and its secret token live in your browser's local storage; the token is stored on our side only as a one-way SHA-256 hash, so we cannot reconstruct it.

Premium tier. If you upgrade, we create an account and collect the minimum needed to run it: your account email address and the billing identifiers returned by our payment processor, Stripe (a customer id and subscription id). Card details are entered directly with Stripe and never touch our servers.

Operational logs. Like any web service we keep short-lived technical logs (for example, request rates used for abuse prevention and rate limiting). These are not used to profile you and are not sold.

Free inboxes and mail are deleted automatically 24 hours after the address is created. When an inbox expires, every message in it — and any stored attachment — is purged by a scheduled job. There is no way to recover a free inbox after it expires.

Premium mail is retained according to your own inbox settings — a custom expiry, or no expiry for long-term addresses. An expired premium address is held in a 30-day restore grace window before it is released, so you can bring it back. Mail is retained until you delete it or your subscription lapses.

Account data is kept while your account is active. Cancel and request deletion and we remove your account email; billing records may be retained where required for tax and accounting law.

• We never sell your data or your mail to anyone.
• We never use the contents of your mail to build advertising profiles.
• We never require personal information to use the free disposable inbox.

The free inbox itself sets no cookies — your inbox token and theme preference live only in your browser's local storage. Premium sign-in uses functional session cookies, and the ad-supported free pages may set Google AdSense advertising cookies (with consent where the law requires it). The full list, with opt-out links, is in our Cookie Policy.

All traffic is served over HTTPS. Incoming HTML mail is sanitized and rendered inside a sandboxed iframe with scripts disabled and remote images blocked by default, so a malicious message cannot run code or silently track you. Secret keys stay server-side and are never exposed to the browser.

Disposable-mail domains attract abuse. If you believe a TempMaily address is being used to harm you, or you have a DMCA/copyright concern, email [email protected]. We investigate reports and may blocklist abusive addresses or domains.

Questions about this policy? Reach us at [email protected]. See also our Terms of Service.