Privacy Policy

Temporary Mail stores short-lived mailbox metadata in Cloudflare D1 and temporary plain-text message bodies in a private Cloudflare R2 bucket. Mailboxes expire after 10 minutes.

Session ownership is proven with an HttpOnly cookie containing a private token. The raw token is never stored in the database—only an HMAC hash is retained while the mailbox is active.

Connecting IP addresses are not stored in raw form. When rate limiting requires an IP identifier, an HMAC of the IP is stored temporarily.

We do not intentionally log email addresses, subjects, bodies, session tokens, Turnstile tokens, or raw IP addresses.

Cloudflare Turnstile is used to reduce automated mailbox creation. Refer to Cloudflare’s privacy documentation for Turnstile processing details.