1. Scope and privacy contact
MailOnce is the service name used in this policy. The service operator is responsible for the processing described here; this policy does not invent a separate legal entity where none has been identified. Privacy questions and applicable rights requests can be sent to support@mailonce.org. Third-party websites opened from messages or links have their own privacy practices.
2. Data MailOnce processes
MailOnce processes only data needed to operate, secure and improve the service.
- Browser-session identifiers, hashed ownership proofs, status and lifecycle timestamps.
- Temporary addresses, domain, creation and expiry state, extension state and owning session.
- Inbound message data such as sender information, subject, bounded text, sanitized HTML when available, size, read state, timestamps and a detected verification-code candidate when one is found.
- Attachment metadata needed for safe handling, such as display name, media type, size, checksum or scan state when available.
- Device-linking state and hashed pairing or continuation proofs used to authorize linked inbox access.
- Client IP addresses and request/security signals used for rate limiting, fraud and abuse prevention.
3. Why data is processed
Data is processed to create and operate temporary inboxes, receive and display mail, maintain session ownership, provide requested features, protect the service against abuse, troubleshoot failures, and meet applicable legal obligations. Where applicable law requires a legal basis, service operation is based on providing the service requested by the user where that basis applies; security, abuse prevention and necessary operations may rely on legitimate interests where permitted; non-essential advertising or measurement relies on consent where required; and legally required processing relies on the applicable legal obligation.
4. Browser storage and cookies
The active MailOnce browser session uses sessionStorage for session and inbox credentials, temporary address and expiry state needed during the tab session. Theme preferences may be stored locally. MailOnce also uses the first-party mailonce.locale cookie to remember the selected language; it uses SameSite=Lax, is Secure on normal HTTPS deployments, and has a maximum age of one year. Advertising or analytics technologies may use additional cookies or identifiers as described below.
Google advertising and measurement
Where MailOnce uses Google advertising or measurement products, Google and other authorized third parties may place or read cookies, use web beacons, IP addresses or other identifiers, and process information to provide, measure and personalize ads where permitted. Google's advertising cookies can use visits to MailOnce and other sites to serve ads. Users can manage personalized-ad choices through Google's Ads Settings. Where consent is legally required, including relevant advertising processing in the EEA, UK and Switzerland, MailOnce obtains the required consent before non-essential advertising or measurement technologies are used. Google explains how it uses information from partner sites and apps in its own privacy documentation.
5. Inbox expiry, retention and deletion
Expiry is not the same event as backend deletion. An address stops being active according to its lifecycle rules. Under the current Free cleanup policy, a closed inbox becomes purge-eligible after a 24-hour retention interval. Messages, sessions and related records are then subject to configured retention, grace periods and bounded cleanup jobs. Operational safety checks can delay destructive cleanup. MailOnce therefore does not promise deletion at the exact moment the visible inbox timer expires.
6. Service providers and other recipients
MailOnce may share or make data available only as needed to providers that host, secure, measure or operate the service; to Cloudflare when Turnstile is enabled for abuse prevention; to Google when Google advertising or measurement products are enabled; to email senders and internet mail infrastructure as inherent in receiving email; or where disclosure is required by applicable law. MailOnce does not treat the contents of incoming mail as an endorsement of the sender.
7. International processing
Internet services and their providers may process data in countries different from the user's country. Where applicable law requires safeguards for international transfers, MailOnce and its providers must use the mechanisms required for the relevant processing. Provider-specific practices are also governed by those providers' notices and terms.
8. Your choices and rights
Rights vary by location. Depending on applicable law, users may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or to complain to a competent data-protection authority. Requests can be sent to support@mailonce.org. Because MailOnce data is intentionally temporary and access is protected by session credentials, some data may already be expired or deleted, and MailOnce may need enough information to verify that a request relates to the requester.
9. Security and data minimization
MailOnce uses ownership checks, hashed proofs, rate limits and other safeguards described by the product, but no internet service can promise absolute security. Do not send passwords, session tokens, inbox tokens or unnecessary private message content to support.
10. Children and local requirements
MailOnce is a general-purpose temporary-email service and is not designed to collect children's personal information for advertising. Age, consent and privacy requirements differ by country. If local law requires parental authorization or imposes an age threshold for a service, that requirement continues to apply.
11. Changes to this policy
This policy will be updated when material processing, providers, retention practices or applicable requirements change. The effective date above identifies the current version.
Privacy contact
For privacy questions or applicable rights requests, contact support@mailonce.org.
See the product lifecycle in practical terms
The Privacy & Data Lifecycle guide explains inbox expiry, access and cleanup as product behavior.
Read Privacy & Data Lifecycle