Message expiry vs. mailbox expiry
A message expiry timer begins when that message arrives. A mailbox expiry timer governs whether the address remains active. These can be different rules: a mailbox can stay active while older messages are deleted, or an inactive mailbox can be removed along with its remaining messages.
How MailTemporary applies retention
- Message expiry: the API stops returning a message as soon as its configured expiry timestamp passes.
- Mailbox inactivity: opening the inbox renews its configured inactive lease.
- Hourly cleanup: a scheduled Worker deletes expired messages, mailboxes, and stale rate-limit records.
Why cleanup may not happen at the exact second
The API can hide an expired row immediately by checking the expiry timestamp. A scheduled deletion task runs on an hourly cadence, so the physical database row may be removed at the next cleanup execution. Storage-provider backups and platform-level logs can have separate lifecycles.
Do not use expiry as a security boundary for secrets
Retention limits reduce the period during which a message is available, but they do not make it safe to send a password, one-time code for a sensitive account, health data, or financial information. The sender, provider infrastructure, browser, or an exposed session may retain other copies.
How to keep a useful record
For important receipts or account notices, use an email account you control and an appropriate retention or archive process. Temporary email should be treated as ephemeral by design.