Privacy Policy

Last updated: May 1, 2026.

This Privacy Policy explains how PocketInbox ("we", "us", "our") collects, uses, and protects information when you use tempmails.dev (the "Site"). We are committed to giving you a clear, honest, and complete picture of what we do with your data.

1. Who we are

PocketInbox is an independent project that aggregates publicly available temporary-email providers behind a single iOS-style interface. PocketInbox is operated by a single legal entity reachable at hello@pocketinbox.app. We do not have offices, employees, or affiliates beyond what is listed here.

2. Information we collect

2.1 Information you provide directly

Inbox addresses you generate. When you tap "Generate," we contact a third-party temp-mail provider on your behalf. The address that comes back is stored in your browser's localStorage. We never receive a copy on our servers.
Custom local-parts. If you type a custom local-part (e.g. yourname), it is sent to the upstream provider only.
Contact form submissions. If you write to us via /contact, we receive your name, email, and message text. We use these to reply, and we keep them for at most 12 months.

2.2 Information collected automatically

Server logs. When you load a page, our hosting provider (Vercel or Cloudflare) records standard request metadata: timestamp, IP address, user-agent, and URL path. We do not retain these logs longer than 30 days.
Cookies and similar. See our Cookie Policy for the full table. In short: we set a small set of strictly necessary cookies, and only set analytics or advertising cookies after you opt in.
Local storage. We use the browser's localStorage to remember your inbox addresses, theme preference, haptics setting, and cookie-consent choice. None of this leaves your device.

2.3 Information processed by upstream providers

Email content itself is delivered to and stored by upstream providers (Mail.tm, Mail.gw, Guerrilla Mail, Maildrop, TempMail.lol and others) according to their own retention policies. Most providers retain messages between one hour and seven days. Please consult each provider's privacy policy:

3. How we use information

To create, list, and read inboxes you ask us to create.
To prevent abuse via per-IP rate limiting on our API routes.
To answer your contact-form messages.
To measure, in aggregate, how the site is used (only with your analytics consent).
To display advertising (only with your advertising consent).

We do not sell your personal information.

4. Legal bases (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR/UK GDPR:

Contract — to create and manage inboxes that you explicitly request.
Legitimate interests — to keep the service running, secure, and free of abuse.
Consent — for analytics and advertising cookies. You can withdraw consent at any time.
Legal obligation — to respond to lawful requests from public authorities.

5. Sharing your information

We share information only when necessary:

Upstream temp-mail providers receive the inbox address you generate. Each provider has its own data-protection posture.
Hosting and CDN providers (Vercel, Cloudflare) process server logs to deliver pages.
Advertising partners, exclusively Google AdSense, receive an anonymous identifier and limited contextual signals — only after your advertising consent.
Analytics providers, exclusively Google Analytics 4 (with IP anonymisation), only after your analytics consent.

6. International transfers

Some of our processors (Vercel, Cloudflare, Google) operate from the United States. When we transfer personal data outside the EEA, we rely on the European Commission's Standard Contractual Clauses or, where applicable, the EU-US Data Privacy Framework.

7. Your rights

If GDPR or UK GDPR applies to you, you have the right to:

Request access to your personal data.
Request correction or deletion.
Object to processing or request restriction.
Receive your data in a portable format.
Withdraw consent for non-essential cookies at any time.
Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email hello@pocketinbox.app. We respond within 30 days.

8. Your California rights (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, the right to delete, the right to correct inaccurate information, and the right to opt out of the "sale" or "sharing" of personal information. We do not sell personal information. To exercise CCPA rights, email hello@pocketinbox.app with the subject line "CCPA Request" or use our Contact page.

9. Children's privacy (COPPA)

PocketInbox is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

10. Security

We use HTTPS site-wide, set HSTS, sanitise all rendered HTML, and host our static assets with Subresource Integrity where applicable. We rate-limit our own API endpoints to prevent abuse. No system is perfectly secure: do not use a disposable inbox to receive sensitive personal data.

11. Retention

Server logs: 30 days.
Contact-form submissions: up to 12 months.
Browser-side data: until you clear your browser storage or use Settings → Clear local data.
Email content: as set by each upstream provider.

12. Changes

We post material changes to this page with an updated "Last updated" date. Significant changes will also be announced via the cookie banner the next time you visit.

13. Contact

Questions, requests, or complaints? Email hello@pocketinbox.app or use our contact form.