Last updated 29 October 2026

Privacy Policy

Temp Mails is built to keep as little data as possible for as short a time as possible. There are no accounts, no analytics and no advertising. This policy explains what is processed, why, and for how long.

1. Who is responsible

Temp Mails (tempmails.net, together with the mail domains mailuniverse.org and mailboxhosting.org) is operated by a private individual based in Norway, who is the data controller under the EU General Data Protection Regulation (GDPR) as it applies in Norway. Contact: privacy@tempmails.net.

2. Data we process

Inboxes

When an inbox is created we store its email address, the time it was created and the time it expires. Each inbox has a random access key. The key itself is kept only in your browser; our database stores a one-way hash of it, so we cannot read your inbox without the key.

Email you receive

Messages sent to an active inbox are stored so you can read them: sender, subject, plain-text and HTML content, and attachments of the supported types (PDF, PNG, JPEG, GIF and WebP). Other attachment types are discarded on arrival. Mail sent to an address that does not exist or has expired is rejected and not stored. Anyone who knows an inbox address can send mail to it; only someone holding the access key can read it.

Abuse prevention

To enforce rate limits we derive a keyed hash (HMAC) from your IP address and use it as a counter key. Your IP address itself is not stored in our database, and the counters expire after at most one hour. When you create additional addresses, Cloudflare Turnstile may check your browser to tell people and automated traffic apart.

Technical logs

The service runs on Cloudflare, which processes connection data such as IP address, browser user agent and requested URL in order to deliver and protect it. A sample of application logs is kept by Cloudflare for a limited period, currently up to 7 days, for troubleshooting.

We do not use analytics, advertising or tracking cookies, and we do not build profiles.

3. Storage on your device

The site stores the following in your browser. They are needed for the service to work or to remember your settings, and are never used for tracking:

• tm-inboxes and tm-current (local storage): your inbox addresses, access keys and the inbox you last viewed.
• tm-lang (cookie and local storage, kept for one year): your chosen language.
• tm-theme (local storage): light or dark mode.
• tm-create-until and tm-storage-epoch (local storage): the five-second wait between new addresses, and a marker that clears stale inboxes after a service reset.

You can remove these at any time by clearing site data in your browser. Doing so removes your access to existing inboxes.

4. Why we process data

We process the data above to provide temporary inboxes on request, and to keep the service secure and available by preventing abuse. The legal basis is our legitimate interest in operating a functioning, secure service (GDPR Article 6(1)(f)). Storage on your device is strictly necessary for the service you request or holds preferences you set.

5. How long we keep it

• An inbox and everything in it becomes inaccessible one hour after the inbox is created. It is then deleted from our database and file storage by an automatic cleanup that runs every five minutes. If a file deletion fails it is retried automatically.
• You can delete a message or a whole inbox yourself at any time, with immediate effect.
• Rate-limit counters expire after at most one hour.
• Technical logs are kept by Cloudflare as described above.

Deleted inboxes and messages cannot be recovered.

6. Who else processes data

• Cloudflare, Inc. hosts the website, database and file storage, receives email for our domains and provides Turnstile. Cloudflare acts as our processor and may process data outside the EEA under the EU Standard Contractual Clauses and the EU–US Data Privacy Framework.

Fonts and all other site assets are served from tempmails.net itself. We do not sell or share data with anyone else, except where we are legally required to.

7. Security

All traffic uses HTTPS. Access keys are stored only as hashes, file storage is private, and incoming HTML is sanitised and shown without scripts or remote images. No system is perfectly secure, so do not use Temp Mails for sensitive information.

8. Your rights

You have the right to access, correct and erase your personal data, to restrict or object to its processing, and to data portability. Because there are no accounts we can usually only link data to you if you give us the inbox address and its access key. The quickest way to erase an inbox is the delete button in the app, and everything is erased automatically within about an hour regardless.

To exercise your rights, write to privacy@tempmails.net. You may also complain to the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no, or to the authority where you live.

9. Children

Temp Mails is not directed at children under 13 and we do not knowingly process their data.

10. Changes

We may update this policy when the service changes. The date at the top shows the latest version.