Privacy Policy

1. Who we are

Mail Vanish ("we", "us") operates the temporary and private email service at mail-vanish.com. This policy explains what data the service touches, why, and for how long. For anything this policy does not answer, contact us at hello@mail-vanish.com.

2. Free temporary inboxes - no account, no identity

The free service requires no signup and collects no personal details. When you visit, we generate a random email address and bind it to a random token stored in a signed, HTTP-only cookie in your browser. We store only a one-way hash of that token; we do not know who you are, and the address is not linked to any identity.

A free temporary address has no expiry timer: it keeps working for as long as its domain is active, and you can delete it or replace it at any time - a replaced address stays in this browser's history (linked only to that cookie token, or to your account if you are signed in) until you delete it, it ages out, or newer ones push it past the history limit. An address that receives no new mail for 7 days is deleted automatically, including one saved to a free account. Each message in it is deleted automatically 24 hours after it arrives. An address nobody opens for 30 days is removed automatically; addresses saved to an account are not.

The separate 10 minute mail inbox works on a countdown instead: it lives for 10 minutes by default, you can extend the timer a limited number of times, and using it never replaces your main temporary address.

3. When messages and inboxes are deleted

Mail delivered to a temporary address is parsed, sanitized and stored so you can read it while the inbox is alive. A message past its automatic deletion time is removed by an hourly purge, together with its body, attachments and raw source file. When you burn an address, when a 10 minute mail timer ends, or when an idle or unopened address is retired, the mailbox is closed within about a minute and stops being readable. After a short grace window of roughly 10 minutes, a scheduled purge permanently deletes the mailbox and everything in it: message rows, message bodies, attachments, and the raw source files of each email held in object storage. This is deletion of the stored data itself, not a hidden archive flag.

Message content is not retained after deletion, is never used for advertising or profiling, and there is no recovery path - which is why we tell you never to use a temporary address for accounts you may need to recover.

4. How messages are processed while an inbox is alive

Incoming email is checked against anti-abuse blocklists, sanitized server-side (scripts and dangerous markup are stripped), and rendered inside a sandboxed frame. Remote images and tracking pixels are blocked by default: our servers do not fetch remote content on your behalf, and nothing loads in your browser unless you press "Load images" for a specific message. Attachments are size-limited, their true content type is detected server-side, and executable file types are rejected. Downloads are streamed with content-type validation.

5. Accounts and Private Emails

Creating an account (needed only for paid plans) stores your name, email address and a hashed password. If you enable two-factor authentication, the TOTP secret and recovery codes are stored encrypted. Private mailboxes do not expire; their messages are retained for your plan's retention window (up to 90 days on current plans) and then pruned on schedule. Optional mailbox PINs are stored as one-way hashes. Forwarding to an external address only activates after that address confirms a verification link, and forwarded mail is rate-limited.

You can also sign in with Google. If you choose "Continue with Google", Google shares your name, your email address, whether Google has verified it, and an ID for your Google account. We use these only to create your account and sign you in. We never see your Google password, and we do not ask for your contacts, Gmail or any other Google data. An account created this way has no Mail Vanish password until you set one in Settings. You can remove Mail Vanish's access at any time under "Third-party apps & services" in your Google Account, and deleting your Mail Vanish account also deletes the stored Google account ID. Our use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements.

6. Payments

Payments are handled by external payment processors: card payments by Stripe, and cryptocurrency payments by a crypto payment processor. Your card number never touches our servers. We store transaction metadata - plan, amount, currency, status, and processor references - to operate your subscription and meet accounting obligations. The processors act as data processors/independent controllers under their own privacy policies.

7. Operational data we keep briefly

Running an email service that is constantly probed by spammers requires a small amount of operational memory: IP-based rate-limit counters, delivery de-duplication guards, aggregate metrics (counts, not content), and standard server logs. These exist for abuse prevention and reliability, are not used to profile you, and age out on short schedules. Anti-abuse blocklist entries (sender domains and addresses that abuse the service) are retained, because they describe the abuser's infrastructure, not you.

Notifications. If you turn on new-mail alerts and allow notifications, your browser gives us a push address at its push service (Google, Apple, Mozilla or Microsoft). We store it with a hash of your inbox cookie so new mail can reach you with the tab closed, and we may occasionally use it for a short Mail Vanish update. The notification is encrypted so only your browser can read it. Your browser tells us when a notification arrives and when it is clicked; we only add these to daily totals and never link them to you or your inbox. Turning the bell off deletes it, and a browser we have not seen for 180 days is deleted too.

8. Cookies

Our own cookies are essential ones: the session cookie, the CSRF protection cookie, and the signed inbox token cookie described above. Our public pages also load Google services that set cookies of their own.

Analytics. We use Google's analytics tags to count visits and see which pages people use. They set their own cookies and report usage in aggregate; we do not use them to identify you.

9. Where data lives and who we share it with

The service runs on cloud infrastructure: application servers, a database, and object storage (Cloudflare R2) for raw email files and attachments while an inbox is alive. Email for our domains is routed to us by our email-routing provider. These infrastructure providers process data on our behalf under their terms. Beyond infrastructure, the payment processors above, and the Google services described under Cookies, we do not share, sell, rent, or trade your data. We may disclose data if legally compelled to, to the extent it still exists - deleted inbox content cannot be produced because it no longer exists.

10. Your rights

Depending on where you live (for example under the GDPR or UK GDPR), you have rights to access, rectify, export, restrict, object to the processing of, and erase your personal data, and to complain to your supervisory authority. For free temporary inboxes there is usually nothing to exercise these rights against - you can burn an address and its mail at any time, and the rest is deleted on schedule. For accounts, you can change your details in the dashboard and delete your account (with typed confirmation) at any time, which removes your account data and private mailboxes. For anything else, email hello@mail-vanish.com and we will respond within 30 days.

11. Children

Mail Vanish is not directed at children under 16, and we do not knowingly collect their data - the free service collects no identity data from anyone.

12. Changes to this policy

If we change this policy, we will update this page and its "last updated" date. Material changes affecting account holders will be announced by email before they take effect.

13. Contact

Questions, requests, or abuse reports: hello@mail-vanish.com.