Privacy Policy

• You do not create an account. We never ask for your name, your real email address, or a password.
• Mail sent to your temporary address is stored on our servers in readable form and can be read by the people who operate this service.
• Do not use this service for anything sensitive — banking, government identity, medical, or account-recovery mail.
• Your IP address is sent to a geolocation provider to work out your country, but is not stored alongside your inbox or your visit.
• One cookie is used, and only to remember which inbox is yours.

Your address is a variation of a Gmail mailbox that we control. Mail sent to it is delivered to that mailbox, fetched by our server over IMAP, and matched back to your address.

Your claim on that address is a cookie called gm_inbox. It is signed, and marked httpOnly so that scripts running on the page cannot read it. It contains an internal reference to your address and nothing else — no name, no email, no tracking identifier. It lasts one year.

This cookie is strictly necessary: without it the service cannot tell which inbox is yours, and there is no version of the product that works without it. If you clear it, your address and its mail become unreachable to you. We cannot restore that link, because nothing connects you to the address except the cookie itself.

When a message arrives at your address, we store its sender, recipients, subject, date, and full body.

This mail is not encrypted at rest in a way that hides it from us. The people who run this service have an administrative console that can list and read every message the system has received, including yours. This is how the service is operated and supported. We are telling you plainly because a temporary-mail service that implies otherwise is misleading you.

Treat anything you receive here as readable by a stranger. Use it for sign-up confirmations, download links, newsletters, and one-off verifications — not for anything you would mind another person seeing.

Remote images in messages are blocked until you choose to load them, so senders cannot confirm that you opened their mail simply by embedding a tracking pixel. Scripts inside messages are stripped and the message is displayed in a sandbox that cannot execute code.

To understand where visitors come from, we record one row when you first arrive in a browsing session:

• The site that linked you here, and any campaign tags on the link.
• The page you landed on.
• Your device type and browser family, from the user-agent your browser sends.
• An approximate country, worked out from your IP address or, failing that, inferred from your browser's timezone setting. See Country lookup below.
• A random identifier stored in your browser, used only to tell a returning browser from a new one. It is generated locally, is not derived from anything about you, and is not shared.

We do not store your IP address with this record. Your IP is visible to our servers, as it is to every website you visit. It is used to work out your country as described below, and briefly and in memory to enforce rate limits that keep the service from being abused. It is not written to the analytics data.

These visit records are deleted automatically after roughly 13 months.

To record which country a visit came from, your IP address is sent to ipapi.co, a third-party geolocation service, which returns a two-letter country code. Only that code is stored. Your IP address is not.

This means your IP address is disclosed to ipapi.co, who process it under their own privacy policy and not ours. The lookup result is cached on our server for up to a week so the same address is not sent repeatedly.

Where our hosting provider already tells us the country, no lookup is made and your IP is not sent anywhere. If the lookup is unavailable, your country is instead guessed from your browser's timezone, and no IP address leaves our server.

• Google — the mailboxes behind every address are Gmail accounts, so mail sent to you passes through and is retained by Google under their own terms.
• MongoDB Atlas — our database, where messages and visit records are stored.
• ipapi.co — receives your IP address in order to return the country it belongs to, as described above.
• Our hosting provider — runs the site and processes requests, including your IP address in transit.

We do not sell your data, and we do not share it with advertisers or data brokers.

• Messages are kept until an operator deletes them. There is no automatic expiry today, so assume mail persists until removed.
• Addresses persist until an operator deletes them, or until you abandon them by clearing your cookie.
• Visit records expire automatically after about 13 months.

• Leave. Clearing your cookies for this site ends your session and detaches you from your address.
• Start over. Creating a new address replaces the old one for this browser.
• Ask us to delete something. Write to us at the address below with the temporary address in question and we will remove it and its mail.

Because we hold no identifying information about you, we usually cannot verify that a given inbox is yours beyond your holding the address. This is a deliberate trade-off in your favour, but it does limit what an access or deletion request can be checked against.

This service is not directed at children and should not be used by anyone under 13.

If this policy changes materially, the date at the top of this page changes with it. Questions, or a deletion request, go to admin@geekmails.online.