Privacy Policy

Test-Emails.com is a free disposable inbox for receiving test messages. This policy explains exactly what data passes through the service, who else handles it, and what we keep. It is written to describe how the service actually works rather than to cover every hypothetical.

1. No account, no personal details

You do not register, and we never ask for your name, your real email address, a password of your choosing, or payment details. Inboxes are generated on demand with a random local part and a random password created by the server.

2. Your inbox is provided by a third party

This is the most important disclosure on the page. Test-Emails.com does not operate its own mail servers. Temporary addresses and the messages sent to them are provided by mail.tm. When you generate an address, our server asks mail.tm to create it; when you open your inbox, our server fetches the messages from mail.tm on your behalf.

In practice this means the contents of every message you receive are stored on mail.tm's infrastructure, not ours, and are subject to mail.tm's own handling and retention. We do not copy message bodies into a database of our own, and we do not read them.

Because mail.tm controls storage, we cannot promise a specific deletion time for a message, and we cannot delete a message on your behalf. Treat every disposable inbox as impermanent and non-confidential.

3. What your browser stores

Your current inbox - its address, its generated password, and its access token - is kept in your browser's local storage so the inbox survives a page reload. This never leaves your device except when it is sent to our server to fetch your messages. Clearing your browser storage, or pressing the button to generate a new inbox, discards it permanently and we cannot recover it.

4. Security and abuse prevention

Some data is recorded for every visitor because it is what keeps the service usable and lets us act when someone misuses it. This rests on our legitimate interest in running the service securely, and it is a narrow set:

• Web server request logs containing your IP address, the time, the page or endpoint requested, the referring page and your browser's user agent string.
• A record of each inbox generated: the IP address it was created from, the country that IP maps to, the domain used, and how many messages it received. The address itself is stored only as an irreversible SHA-256 hash, so this cannot be read as a list of which address a person used, while an abuse report naming an address can still be matched by hashing it.

We use this to enforce rate limits, investigate technical faults, and respond to reports of an address being used for phishing, harassment or fraud. We do not use it to build a profile of you, to target advertising, or to sell to anyone. Inbox records are deleted after 30 days, sooner than the analytics below, because data kept on this basis should not outlive the purpose it was collected for.

5. Analytics

We run our own analytics on our own server. There is no Google Analytics, no third-party tracking script, and nothing about your visit is sent to another company. Every visit to the site is recorded. We rely on our legitimate interest in understanding how the service is used and keeping it working, and we have kept the set of data below deliberately narrow for that reason.

Each page view records:

• Your IP address, in full. We are naming this explicitly because it is the most identifying item on the list.
• The country, region and city that IP is associated with.
• Your browser and its version, your operating system and its version, and whether you are on desktop, mobile or tablet.
• Your browser's user agent string, language setting, and time zone.
• Your screen and window dimensions.
• The page you viewed, the page that referred you, and any campaign parameters in the link you followed.
• Two random identifiers, one kept in your browser to recognise a returning visit and one that lasts only for the current tab. They are random values, not derived from anything about you, and are not shared with anyone.

We also count actions in the app itself: inboxes generated, addresses copied, messages opened, and whether the HTML view was used. We record how many messages an inbox received and which domain it was on, so we can tell which of our domains are delivering reliably. We never record the subject line, the body, or the full sender address of any message. Sender domains are counted in aggregate only, per day, with no link to any inbox or visitor.

This data is used to understand how the service is used and to improve it. We do not sell it, we do not share it with advertisers, and we do not use it to build a profile of you or to target you.

6. How long we keep analytics

Analytics rows, including IP addresses, are deleted automatically 90 days after they are recorded. This is enforced by a scheduled job, not by hand. Aggregate daily counts that contain no personal data, such as how many messages arrived from a given sender domain, are kept longer as a long-run trend.

Server request logs, described in section 4, are separate from analytics and are kept on their own schedule, because they are required to run the service securely and enforce rate limits.

7. Opting out

Clearing this site's data in your browser discards the two random identifiers, so later visits are not linked to earlier ones. Any browser setting or extension that blocks analytics requests also works here: the site is built so that a blocked request changes nothing about how the inbox behaves.

You can also write to us at the address at the bottom of this page and ask us to delete the analytics rows associated with your IP address, and we will.

8. Advertising and cookies

We may display advertising on this site to keep it free. When advertising is served:

• Third-party vendors, including Google, may place and read cookies on your browser, or use web beacons and your IP address, to collect information as a result of ads being served on this site.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this and other sites.
• You can opt out of personalised advertising from Google in your Google Ad Settings, and you can opt out of many other vendors at aboutads.info.
• You can read how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites.

Where the law requires consent for non-essential cookies, advertising cookies are set only after you have given it.

9. The API waitlist

The developer API is paused, and the page for it offers a waitlist. This is the only place on the site where we ask for a real email address, and it is worth separating from everything else here: the disposable inboxes are throwaway addresses we issue, whereas this is a mailbox belonging to you that you have chosen to hand over.

If you join, we store the address, the optional note about what you would use the API for, your IP address and country at the time of signup. The legal basis is your consent, given by submitting the form.

We use it for exactly one thing: sending you a single message when the API is available again. It is never shared, never sold, and never added to any other list. Reply to that message, or write to the address at the bottom of this page, and we delete your entry.

10. What we never do

• We do not sell or rent any data about you.
• We do not send you marketing email. The one exception is the API waitlist described above, which you opt into by typing your address, and which is used for a single message.
• We do not attempt to identify you or link your inbox to your real identity.

11. Do not send sensitive information here

This service exists for testing signup flows, receiving one-time codes, and keeping marketing mail out of a real inbox. It is not private communication infrastructure. Do not route password resets for accounts you care about, medical or financial records, identity documents, or anything you would be harmed by losing or exposing. Use an address on a domain you control instead.

12. Children

This service is not directed at children and is not intended for anyone under 16. We do not knowingly collect information from children.

13. Your rights

Depending on where you live, you may have the right to ask what data we hold about you, to ask for it to be deleted, or to object to how it is used. Because we hold no account for you, in practice the only data tied to a request is a server log entry containing an IP address. Write to us at the address below and we will act on it.

Requests about the contents of a mailbox need to go to mail.tm, since that is where messages are stored.

14. Changes

If this policy changes materially, the date at the top of this page changes with it. Continuing to use the service after an update means you accept the revised policy.

15. Contact

Questions about privacy, or a request under section 13, can be sent to contact@test-emails.com.