Last updated: October 22, 2026
Information processed
To operate the service, MailTemporary processes the chosen mailbox username, a randomly generated mailbox identifier, a hash of the browser session token where applicable, an optional locked-claim lease, creation and activity timestamps, message sender label, subject, message body content, receipt time, expiry time, and limited API rate-limit data. Incoming messages are processed for the controlled reading view. Active external content and attachments are not exposed through the user interface.
If you contact us, the form submission stores the name you provide (if any), your email address, topic, subject, message, submission time, and review status in the service database. Contact-form content is available to authorized operators for handling the request; it is not exposed through a public API. Do not submit passwords, sign-in codes, or unnecessary sensitive information.
Network and abuse-prevention data
The Cloudflare platform processes network information required to deliver requests and protect the service. The Worker uses the connecting IP address to calculate a keyed hash for rate limiting; the raw IP is not intentionally written to the application's D1 rate-limit table. Cloudflare may process request metadata under its own service terms and privacy documentation. The operator should verify log settings and retention in the Cloudflare dashboard before launch.
Why data is processed
- To create and authenticate the current browser's inbox.
- To route incoming email to the correct active mailbox.
- To display messages and enforce the expiry policy.
- To rate-limit automated abuse and protect service reliability.
- To troubleshoot technical failures without intentionally logging email bodies.
- To review and respond to contact-form support, privacy, security, or feedback requests.
Retention and deletion
Each message is hidden when its configured expiry passes and removed by scheduled cleanup. An inactive mailbox record also expires according to the current settings and is then removed with any remaining messages. Rate-limit entries older than 24 hours are cleaned up. Backups, platform-level logs, provider systems, or disaster-recovery copies may follow separate retention schedules; do not claim instant deletion from every underlying system unless that has been verified.
Cookies and local storage
The application uses a session cookie named __Host-mt_session with HttpOnly, Secure on production hosts, Path=/, and SameSite=Strict attributes. The standard-mode cookie remembers the current address for this browser, while a separate cookie is used only for Locked Inbox claims. The application does not require advertising cookies or browser local storage for inbox authentication. Browser settings, extensions, or session restore can affect how session cookies behave.
Sharing
Mailbox content is processed by Cloudflare Workers and Cloudflare D1 as part of providing the service. The operator should list any additional vendors introduced in production. MailTemporary does not intentionally sell mailbox content, but this statement is not a substitute for reviewing applicable legal requirements and Cloudflare's terms.
Children and sensitive information
This is a general-purpose utility, not a service designed for children or sensitive personal information. Do not send or receive health, financial, government-ID, account-recovery, or other confidential content through a temporary inbox.
Your choices and requests
Because inboxes are not associated with registered user accounts, the service may not be able to identify or restore an expired inbox. For privacy requests, use the contact form. Contact submissions are retained in D1 for operator review and should be deleted by the operator when no longer needed, in line with applicable law and the operator's retention procedures.
Changes to this policy
This policy may change as the service changes. The current version and its last-updated date will be published on this URL.