Privacy policy
Last updated 26 September 2026
Inboxspam exists so you don’t have to hand your real address to a site you don’t trust. A policy for a service like that ought to be short and specific, so this one is.
The short version
- A free inbox needs no account, no password and no name. You never tell us who you are. Accounts are optional, for Premium, and ask for an email address and a password — nothing more.
- A free inbox and every message in it is deleted an hour after it’s created. That’s the product, not a setting.
- No analytics, no advertising, no tracking on the site. One cookie for your inbox, and a second only if you sign in.
- Your IP address is used as a counter to stop one person making thousands of inboxes or accounts, or trying password after password — and for nothing else. It is never stored next to your inbox or your mail.
- We don’t sell data to anybody. There’s nothing here worth selling.
1. What this covers
This policy covers the website at inboxspam.com, the disposable addresses we hand out on inboxspam.net, inboxspam.org and junkmaildrop.org, the mail sent to them, and the optional accounts used for Premium.
Inboxspam is run by one person in the United States, not by a company. “We” throughout this policy means that person. The quickest way to get in touch is the contact form, which reaches them directly.
2. What we hold, and for how long
Everything the service stores is in this table. There is no other collection happening behind it.
| What | Why | How long |
|---|---|---|
| Your inbox address, and the times it was created and expires | To accept mail for you and show it to you | Deleted when the inbox expires — an hour after it’s created, on the free plan. With Premium, the address is kept while Premium is active and for 7 days after it ends, then deleted |
| A random token, kept in your browser as a cookie | So that your browser, and only your browser, can open the inbox it made | Until the inbox expires. We store only a SHA-256 hash of it, never the token itself |
| Mail sent to your address: sender, subject, headers, body and attachments | Because showing it to you is the service | Deleted with the inbox. A storage rule clears anything a failure leaves behind within 24 hours. With Premium, each message is deleted 30 days after it arrives, or with the address if that goes first, and the storage rule clears what a failure leaves within 32 days |
| The address on its own, held back after the inbox is gone | So that nobody who claims it later can receive the previous owner’s mail — a password reset arriving late, say | 30 days, as an address and nothing else. The messages were deleted at expiry |
| Your IP address, as part of a counter | To stop one person creating thousands of inboxes or accounts, asking for code after code, guessing at passwords or codes, or flooding the contact form | An hour at most, and two minutes for name-availability checks. Removed automatically |
| Whatever you type into the contact form | To answer you | Kept in the mailbox we reply from, for as long as the conversation is live |
| If you create an account: its email address and password | So you can sign in. Accounts are optional and exist for Premium; a free inbox never needs one | Until the account is deleted. Both are held by Amazon Cognito. Our code passes the password to Cognito when you create the account, sign in or reset it, and never stores or logs it. An account whose address is never confirmed is deleted by a daily clean-up once it’s five days old |
| If you sign in: a second random token, kept in your browser as a cookie | So you stay signed in, and so Premium can attach to the inbox you had open | 30 days, or until you sign out. We store only a SHA-256 hash of it, with your account’s email address and the inbox you had open when you signed in — so for that long, the account can be matched to that inbox’s address |
| An account record: its email address, when you first signed in, and when its password was last reset. With Premium, also which inbox Premium keeps: its internal id, not its address | So that resetting a password signs out every device that signed in before the reset, and so Premium keeps the right address | Until the account is deleted. The kept inbox’s id is removed when that inbox is deleted |
| A count of password-reset attempts, kept against a keyed hash of the email address they were for | To stop anyone guessing a reset code by spreading their guesses across many connections | About a day, then removed automatically. The address itself isn’t stored, and without the service’s secret key the hash can’t be matched to one |
| Operational logs | To notice when something has broken | 3 days. They record internal inbox identifiers — never email addresses, message contents or IP addresses |
About that counter
It’s worth being exact, because it’s the only place your IP address goes. It is stored as a number against a key built from your address and the current hour, with nothing else alongside it. It isn’t written to a log, isn’t attached to your inbox, and doesn’t outlive the hour. It can’t be used to work out which inbox was yours or what arrived in it.
3. What we don’t do
- No analytics and no advertising. No measurement scripts, no fingerprinting, no tracking pixels and no third-party cookies on the site. The one exception is the email that carries an account code: the service that sends it adds a pixel we can’t remove, set to count opens only as an anonymous total. Section 5 has the detail.
- No mailing list. Giving us an address — on the contact form, or for an account — subscribes you to nothing. An account gets its codes and nothing else.
- No selling, renting or sharing of personal data, in any form, to anyone.
- Nobody reads your mail. It’s parsed automatically so it can be shown to you, and then deleted on schedule. The one exception is a message reported to us for abuse, which we may look at if it still exists.
- Nothing is ever sent from your address. An inbox only receives; there is no reply, forward or send, and no way to add one. Apart from answering you when you write to us, the only mail Inboxspam sends is a one-time code for an account — to confirm its address, or to reset its password.
4. Cookies and browser storage
There is one cookie for your inbox, named __Host-sid. It holds the random token that proves your browser is the one that made the inbox. It’s marked HttpOnly, so scripts on the page can’t read it, and Secure, so it only travels over HTTPS. It expires with the inbox. Without it you can’t open your inbox — and neither can anyone else.
If you sign in to an account, there’s a second, named __Host-acct. It holds a different random token that proves this browser is signed in, with the same two protections. It lasts 30 days, or until you sign out, and we store only a hash of it. Without an account you never get it.
Your browser also keeps a short note of which messages you’ve opened, so the “New” tags survive a reload. That note stays on your device; it is never sent to us and we can’t see it. Clearing site data removes it, along with the cookies — which loses the inbox and signs you out.
There’s no cookie banner because there’s nothing to consent to: the only cookies we set are the ones needed to give you the thing you asked for.
5. Who else is involved
- Amazon Web Services hosts the site, stores the mail, runs the code and, through Amazon Cognito, holds accounts, in the US (Northern Virginia).
- Cloudflare provides our DNS and the mail routing that accepts a message before it reaches our storage. It also provides the anti-spam check on the contact form, which receives your IP address when you press Send on that form.
- A form-delivery service passes contact-form messages to the mailbox we reply from.
- Brevo, an email-delivery service whose servers are in the EU (France, Germany and Belgium), sends the one-time codes for accounts from no-reply@mail.inboxspam.com. It receives the address each code goes to and the message itself, which holds the code and nothing else about you. It’s set to keep no copy of the message, only a delivery log — the address, the time, whether it arrived — for a month. It also adds a small tracking image to every message, which can’t be switched off on the plan we use; it’s set to count opens only as an anonymous total, never against your address, and there are no links in the message to track. Like any image, loading it shows Brevo the IP address it was fetched from, which blocking remote images in your mail app prevents.
- Google Fonts. The site’s three typefaces load from fonts.googleapis.com and fonts.gstatic.com. Your browser fetches them directly, so Google sees your IP address and browser details. This one is different from the others — it’s a public asset service rather than a supplier we have an agreement with — which is why we intend to serve the fonts from our own domain instead.
Because the service runs in the United States, using it means data about you is transferred there. If you’re in the UK or the EEA, that transfer is part of providing the service you asked for. An account’s one-time codes are the exception: they are sent through Brevo, in the EU.
6. What a disposable inbox can’t protect you from
The honest limits, in one place:
- An inbox is only as private as the browser that made it. Anyone who can use that browser profile can open it, because the cookie is the only credential there is.
- Clearing cookies loses the inbox, permanently and immediately. We can’t restore it: the cookie was the only key to it, even if you were signed in.
- Mail isn’t end-to-end encrypted. It’s encrypted in transit where the sending server supports that, and encrypted at rest in our storage, but treat anything arriving at a disposable address as readable.
- The sender always knows the address they sent to, and what they put in the message.
- Don’t use a disposable address for anything you’d mind losing or anything you’d mind a stranger reading. Not banking, not medical or legal mail, and not account recovery for anything you care about.
7. Your rights
If you’re in the UK, the EEA, or a US state with a privacy law, you have rights to access, correct, delete and object to the processing of your personal data.
Here is the awkward part, stated plainly: for an inbox, we usually can’t act on them, because we have no way to tell that a given inbox is yours. A free inbox has no account to prove it with, and we’d rather that stayed true than invent an identity to check requests against. What exists instead is a Delete button that removes the inbox and every message in it straight away, and an expiry that does the same thing within the hour whether you ask or not.
An account is different, because it has an email address to check a request against. To see what we hold about your account, or to have it deleted, write to us through the contact form, giving the address the account uses, and we’ll reply to that address to confirm before we act. There’s no button for this; a person does it. Deleting an account removes it and its password straight away, and every device signed in to it is signed out at once. The records of those sessions, and the account’s own record, are deleted within about a month, once the sessions would have run out anyway. Brevo’s delivery log of the codes sent to it is deleted on its own after a month.
The contact form itself is the other place we can act. Write to us and we’ll delete your message, and our reply, on request.
Where UK and EU law applies, our lawful basis is legitimate interests: providing the service you asked for, and keeping it from being abused.
8. Children
Inboxspam isn’t for children. Don’t use it if you’re under 13, or under 16 in the UK and the EEA. We don’t knowingly collect anything from a child — and since we collect no names or ages at all, and nothing but an email address and a password even for an account, we have no way to detect one, which is why this is a rule rather than a check.
9. Abuse reports and legal requests
Mail that claims to have been sent from one of our disposable addresses is forged: they can only receive. So is any automated mail claiming to be from Inboxspam other than a one-time account code from no-reply@mail.inboxspam.com — which never asks you to click anything or to give us your password. The only other mail we send is a personal reply to something you wrote to us. We’d still like to know about forgeries, because they mean our domains are being used as a return address. Report them through the abuse form, which is read.
We respond to valid legal requests with whatever exists at the time. For an inbox, usually that is nothing. A free inbox, its mail and the rate-limit counter are all gone within the hour, the logs hold no addresses, and there is no identity for anyone to hand over. For an account, it is what section 2 lists: the email address, the sessions and record kept with it, and, with Premium, the inbox Premium keeps and the mail in it.
10. Changes
If this policy changes, the date at the top changes with it. If we ever start collecting something that isn’t in the table above, it’ll be listed here before we start.
11. Contact
Questions about this policy, or about anything we hold: use the contact form. It reaches a person.
See also the terms of use.