Privacy Policy

TempMailPortal ("we", "us", "the Service") provides free temporary inboxes on the web and Android, privacy guides, and an account dashboard. This policy explains what data the Service handles, how browser storage and advertising work, and the choices available to you.

For the Android app and its account security, notifications and advertising features, see the separate Android App Privacy Policy.

Web and Android inbox access

The homepage provides a private temporary inbox without sign-in. The browser stores the mailbox address and secret access credential locally so you can return to it. Its account dashboard uses Google sign-in through Firebase Authentication over HTTPS, then uses an account token to request your own usage totals or account deletion. Session tokens remain in page memory and are removed when you sign out or reload. No mailbox messages or attachments appear in the dashboard. See the Android privacy policy for account identifiers, app verification, retention and deletion details.

1. The short version

• Reading the website requires no account. The account dashboard requires Google sign-in. The updated Android app supports guest inboxes without Google sign-in, with optional sign-in for higher allowances.
• Email sent to a temporary address is stored only briefly and is automatically expired after about 24 hours and removed by scheduled cleanup.
• The website uses Google Analytics for aggregate page and feature-usage measurement. It never sends email addresses, mailbox credentials or message content as analytics events.
• The inbox and message reader do not load advertising code. Eligible editorial guides may use Google AdSense only with the required consent controls.
• Temporary inboxes are unsuitable for confidential or important accounts. New private inboxes require access credentials; older public inboxes are being retired.

2. Who we are

TempMailPortal operates the website and the temporary email service at tempmailportal.com. For any privacy question you can reach us via our contact page.

3. Information we handle

Information you are not asked for

Browsing the website requires no sign-in or payment details. Google sign-in shares your profile, email address and account identifier with Firebase. The dashboard uses an identity token to show your allowance and manage account deletion. We never receive your Google password.

Email received at your temporary address

When someone sends a message to a temporary address generated by the Service, the service code receives and stores that message (sender, subject, body and attachment metadata; attachment bytes only when file storage is enabled) so it can be displayed to you. These messages are short-lived: they expire and are permanently deleted automatically, normally within 24 hours, by an automated cleanup process. Message bodies are not sent to Google AdSense or used to build advertising profiles, and we do not sell message content.

The reader shows plain text by default. If you choose the safe formatted view, it removes active and form elements and blocks remote images, fonts and other external message resources so opening a message does not request tracking pixels from the sender.

Technical and log data

Like most websites, our infrastructure and service providers may automatically process limited technical data — such as IP address, browser type, device information and timestamps — for security, abuse prevention and reliability. This data is not used to build a personal profile of you.

Local storage

The website saves your active private inbox credential and up to five saved inboxes in local browser storage. Anyone with access to your browser profile may be able to use them. Clear site data to remove these local credentials. The dashboard keeps its session in memory until sign-out, reload or tab closure. Google handles its own sign-in cookies. Compatible private inbox entries from an earlier website version can be reused; older public inbox credentials are not reopened.

Website usage analytics

Google Analytics measures page views and a limited set of product interactions, such as copying an address, refreshing an inbox, opening a message, changing or deleting an inbox, using a pairing control, and opening a privacy guide. Analytics events use fixed action names and page paths. They do not include an email address, mailbox or message identifier, sender, recipient, subject, message body, attachment, verification code, search text, label, bearer token, Google account identifier or TempMailPortal account identifier.

Analytics is enabled by default where local rules allow. Advertising storage, advertising user data and ad personalization remain denied by default everywhere. In the EEA, UK and Switzerland, analytics storage is denied by default and Google receives cookieless measurement signals unless consent is provided through an applicable Google-certified consent flow. Google may process device, browser, approximate-location and interaction information under its own terms. See How Google uses information from sites that use its services.

4. Advertising and consent

Advertising code is not loaded on the temporary inbox, message list, message reader, API documentation, contact page or legal pages. If Google AdSense is enabled on an eligible editorial guide, the following disclosures apply:

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this and/or other sites on the Internet.
• You may control personalized advertising through the consent choices shown on the eligible guide and at Google Ads Settings.
• You can also opt out of some third-party vendors' use of cookies for personalized advertising at aboutads.info/choices and, in Europe, at youronlinechoices.eu.
• For more on how Google uses data, see How Google uses information from sites that use its services.

5. How we use information

We use the limited data described above only to: deliver incoming email to the correct temporary inbox; understand aggregate website and feature usage; operate, secure and maintain the Service; prevent abuse and spam; comply with law; and, when enabled on eligible guides, display advertising. We do not sell your personal information.

6. Data retention

Temporary email messages are deleted automatically, normally within 24 hours of receipt. Selecting Delete removes the current inbox's stored messages immediately. Generating or changing to a new address does not immediately delete the previous address; its messages remain until their normal expiry unless you delete first. Technical logs held by our providers are retained only as long as needed for security and operations.

7. Security and important limitations

The Service is designed for convenience, not confidentiality. Anyone who knows an older public address may be able to read its messages during the migration. New random private inboxes require secret credentials, and the Android security update adds app and account verification. Never use a temporary address for banking, work, government, healthcare or any account that matters to you.

New random inboxes use private bearer credentials with 30-day access. Message retention can be 10 minutes, 1 hour or 24 hours. Custom-name and older inboxes remain public. Private inbox access tokens and five-minute, one-use pairing codes are stored as hashes on the server. Pairing grants another device access; the original owner can revoke those sessions. The Android app encrypts saved inbox labels, addresses and credentials locally. The website stores saved labels, addresses and bearer credentials in your browser profile; it does not offer the Android app’s encrypted local vault. Local deletion does not itself delete server messages.

8. Children

The Service is not directed to children and is not intended for use by anyone under the age of 16 (or the minimum age in your country). We do not knowingly collect data from children.

9. Your rights

Depending on where you live (for example, under the GDPR in the EEA/UK or the CCPA/CPRA in California), you may have rights to access, correct, delete or restrict the processing of personal data, and to opt out of the "sale" or "sharing" of personal information. Temporary messages auto-expire, while account and security records have their own retention described in the Android privacy policy. You can request account deletion through the dashboard or exercise applicable rights, including questions about advertising cookies, via our contact page.

10. International transfers

Our infrastructure providers, and Google when analytics or advertising is used, may process data in countries other than yours. Those providers apply their own safeguards for such transfers.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above. A change to this policy does not replace a separate consent choice where one is required.

12. Contact

Questions about this policy or your privacy? See our contact page.