What we see, what we don't, and why.

Last updated August 2026. Written in plain language on purpose — no filler.

The short version

We don't have accounts, so we don't have your name, your real email, or a password to leak. We can't read the body of your mail once it's encrypted, because the key never leaves your browser. When your inbox's timer runs out, we delete the address and everything in it.

What we actually store

The address itself (e.g. swift-otter-42@e-tempmail.com) and its expiry time, for as long as the inbox exists.
Encrypted message bodies. Every message is encrypted before it's written to the database — either with a key generated in your browser that we never receive, or, if you supplied one, with your own PGP public key. We store ciphertext. We do not hold a copy of the key that opens it.
The sender address and subject line of each message, unencrypted, so the inbox list can show who a message is from without you having to open it. If you'd rather subjects were encrypted too, use the PGP option and encrypt end-to-end through your own client instead of reading in-browser.
Attachments, encrypted, in object storage, deleted on the same schedule as the inbox.

What we strip on the way in

Every incoming email is parsed and rebuilt before storage. We discard routing headers, server hops, and originating IP information from the message itself, keeping only the From address, subject, body, and a received timestamp. We also strip embedded scripts and 1×1 tracking pixels from HTML mail before it's stored, and we block a short list of executable attachment types outright.

What we can't avoid seeing

Being honest about the limits matters more than sounding reassuring. A few things are true of any host on the internet, including us:

Cloudflare's edge network sees the IP address of anyone who loads this site or sends mail to it, as ordinary connection metadata, for the brief window needed to route the request. We don't log this ourselves or store it alongside your inbox.
We can see the existence of a message — that something arrived, from what address, with what subject — even though we can't read its body. If that metadata itself is sensitive, use the PGP option, which is the closest thing we can offer to us seeing as little as technically possible.
We run on Cloudflare's infrastructure. We trust their platform-level operational logging the same way any site built on it does; we don't have visibility beyond what they publish about their own practices.

Retention

You choose an inbox's lifetime when you create it: 10 minutes, 1 hour, or 24 hours. A scheduled job checks every 5 minutes and permanently deletes any inbox, message, and attachment past its expiry — this isn't a soft delete or an archive, the rows and objects are removed. You can also delete an inbox immediately yourself with "Burn now."

What we don't do

No accounts, no passwords, no persistent identifiers tying inboxes together.
No analytics scripts, ad SDKs, or third-party trackers anywhere on this site.
No selling, sharing, or otherwise monetizing any data that passes through this service.

Questions

This project is open source. If you want to verify any of the above, read the code — that's a more reliable answer than anything written here.