Privacy

Last updated 15 October 2026

This page describes what the Service stores, why, for how long and who can see it. Words such as "Service", "we" and "inbox owner" have the meaning given in the terms of use.

Inbox owners decide what their inboxes receive and why. To report an inbox that holds data about you or is used for abuse, see the contact page.

What is stored, why and for how long

• Requests sent to inbox URLs, with everything they contain and the sender's IP address, so that the inbox's owner can see them. The inbox's settings choose how much of the IP address its owner sees, and the whole address is kept either way. They are deleted with the inbox.
• DNS lookups of names under an inbox, so that its owner can see them, deleted with the inbox.
• Inbox settings and the notes added to requests, deleted with the inbox.
• Who created each inbox: their network address and browser details, to limit how many inboxes each user can have, deleted with the inbox, apart from the usage records below.
• How the Service is used: who creates, reads or changes inboxes and what they did, with their network address, country and browser details, to run the Service, plan its capacity and handle abuse. These records are kept for a limited time and then deleted.

Creating an inbox doesn't need an account or any personal details. The Service can't work without your network address and the headers your browser sends, which reach any website you visit. We use the data of inbox owners to provide the Service as its terms describe.

How long inboxes are kept

Every inbox is deleted together with its requests 1 day after it is created, or after a different time of at most 3 days chosen by its owner, whether or not it is used. A full inbox deletes its oldest requests first. Destroying an inbox deletes it and its requests immediately. Deleted data cannot be recovered from the Service.

In your browser

The dashboard keeps what it needs to work in your browser's local storage, such as your inboxes' private links and your preferences. Clearing your browser data removes it. The Service sets no cookies and loads nothing from other websites.

Who can see it

The webhook URL can only send requests to an inbox. Anyone with the inbox's private link can read, change and delete everything in it, so share that link only with people who should have that access. Requests in an inbox are stored encrypted with a key from its private link, but no system is completely secure. To keep the Service operational, we may hold a master recovery key off-site. We use it when we have to, such as for a report of abuse, a security incident or an order from an authority.

Like any website, the Service relies on other providers, such as its hosting provider, its e-mail provider and the internet providers that carry its traffic. They may process data to provide their services and keep their own logs under their own policies, independent of us. Data may also be handed over to courts and authorities when the law requires it.

Your data

You can ask us about the data the Service keeps about you, or ask us to delete it, see the contact page. As the Service has no accounts, we may need further details from you to find it, such as an inbox's URL, your IP address and when you used the Service. Inbox owners can read, export and delete everything in their inboxes themselves, as long as they have each inbox's private link.

Your choices

With an inbox's private link, you can:

• choose how long the inbox and its requests are kept, up to 3 days
• choose whether you see sender IP addresses in full, shortened, or not at all
• delete single requests, delete all of them, or destroy the inbox

Changes

We may update this page. The date at the top shows when it last changed.