Privacy

What we hold

Messages sent to your address

The whole message, including headers and attachments, for 5 days. Then it is deleted.

The address itself

Only for as long as it has a message. When the last one expires, nothing records that the address was ever used.

The sending server’s address

Kept with the message, because it is part of the message and because abuse reports are unanswerable without it. It goes when the message goes.

Custom domains

The domain, its key and its billing record, for as long as the subscription lasts.

If you create an account

Your email address, a hash of your password, your sessions and API keys and, unless you turn it off, the list of inboxes you open while signed in — on the site, with your API key or over MCP. The list holds addresses and dates, never your mail. You can clear it or switch it off at any time, and deleting the account deletes all of it.

What we do not hold

Not as a policy that could be relaxed later — these things are never collected, so there is nothing to hand over, leak or sell:

• No account needed. Without one: no name, no password, no email address of yours.
• No analytics. No Google Analytics, no Plausible, no pixel, no fingerprinting.
• No third-party scripts. Every file this site loads comes from this site. Nothing else is contacted while you read it.
• No advertising identifiers, and no data sold or shared with a broker. There is no second business model here.
• No tracking cookies — which is why there is no cookie banner. Without an account, the address you picked is kept by your own browser for the tab’s lifetime. Signing in sets one session cookie, and nothing else.

Public mailboxes are public

The most important sentence on this page: on a public domain, anyone who knows or guesses an address can read that mailbox. Through the website, through the API, from anywhere.

That is not a weakness to be fixed; it is what a shared, account-free service is. Treat a public address as a postcard on a noticeboard. If a message must be private, point your own domain here — those mailboxes answer to your key alone.

Server logs

Our servers keep operational logs — connections, errors, the ordinary record any mail server needs to work and to be debugged. They are used for keeping the service running and for handling abuse, and for nothing else.

Logs are short-lived and rotated. They are not joined to message content, not used to profile anyone, and not shared.

Who else is involved

A content delivery network

Sits in front of the website and sees requests for pages, as any CDN does. It never sees the mail path — messages reach us over SMTP directly.

Nobody else

No analytics provider, no advertising network, no support platform, no data processor with a copy of your mail.

Your rights, practically

Data-protection law gives you rights of access, correction and erasure. Here is what each means in practice, honestly:

Access

Open the mailbox. Everything we hold about a public address is on that page — there is no shadow record behind it.

Erasure

Delete the message, from the inbox or through the API. It is gone, and it was going anyway within 5 days.

Correction

Not applicable to received mail: we would be altering a message someone else sent you.

Identification

We cannot tell you who used an address, because we do not know — unless that person was signed in with inbox history on. Then the account’s own list holds it, visible to its owner alone, and gone when they clear it or delete the account.

Legal requests

A valid order from an authority with jurisdiction over us is complied with, and we can only ever hand over what exists at that moment: messages currently within their 5-day window, the subscription record of a custom domain, and — for an account — what its own dashboard shows, inbox history included when it is on.

Nothing older survives to be requested. Formal notices are served through the registrar of record for grabmail.io.