Privacy policy
This page explains what the site stores when you use it and why.
Mailboxes and emails
Emails sent to an address are stored so its mailbox can display them. Received emails are kept; attachment files are deleted after 15 days. A public mailbox can be read by anyone who opens the same address. A private mailbox can only be read by its owner and the people it is shared with.
Access key and sessions
Using the site creates a 16-digit access key and a session cookie, with no sign-up. The access key is stored as a keyed hash, used to check it when you restore it, and as an encrypted copy, so you can export it again. The cookie is only stored as a keyed hash. Your display preferences, such as theme and language, are saved on the server and follow your access key.
Technical data
To protect the service against abuse, the site records the IP address and the user agent of the browser or app for sessions, the first opening of each mailbox (with the referring page, when one is sent), attachment downloads, mailbox visibility changes, and contact form messages. For its notifications, the mobile app also stores a device token, its language, and its time zone. This technical data is kept with no time limit; a device's notification data is deleted with its session.
Remote content and tracking
Remote images, audio, and video in emails are not loaded until you allow them, and the server never fetches them. The site shows no ads.
Service providers
The site runs behind Cloudflare, which delivers the pages, provides the anti-bot check, and measures anonymous traffic statistics. Incoming emails are received by our own mail server, hosted by Hetzner. In the mobile app, notifications go through Expo and Google's Firebase Cloud Messaging: they only carry the mailbox address and an email identifier, never the sender, subject, or content.
Questions about your data
To ask a question about your data, use the contact form at the bottom of every page.
Last updated: October 31, 2026