Content page
Privacy Policy
Effective date: 8 November 2026 · Last updated: 9 November 2026
TmpMailer ("TmpMailer", "we", "us", "our") provides a free temporary email service, a set of browser-based tools, a public API, a browser extension and mobile apps. This Privacy Policy explains what we collect, why we collect it, how long we keep it, who we share it with, and the choices and rights you have.
We have tried to write this in plain language. If anything is unclear, contact us using the details at the end of this page.
1. Who we are
TmpMailer is operated by MD ANWAR JAHID.
- Privacy contact: ajr.jahid@gmail.com
- Website: https://tmpmailer.com
2. The short version
- You do not need an account, name or phone number to use the website.
- A temporary inbox is not private. Anyone who knows the address can read the messages in it. Never use TmpMailer for banking, medical, legal, employment or other sensitive accounts.
- We do record technical information about visits (IP address, approximate location, device, browser, pages viewed) to run the service, prevent abuse and measure advertising.
- We show advertising through Google AdSense and use analytics (Google Analytics and Cloudflare). These providers may set their own cookies.
- You can reject non-essential cookies, change your language, or delete an inbox at any time.
3. Information we collect
3.1 Temporary inbox content
When you generate an address, we process the address itself, the messages delivered to it, message metadata (sender, subject, time, size) and any attachments. Messages are stored only so that you can read them in the web inbox, app, extension or API. Your inbox is normally available for about 24 hours; it may be deleted earlier when it expires, when you delete it, or during maintenance. Free addresses are limited to a small number per day (currently up to 10 generated addresses per day per visitor).
Do not send or receive sensitive personal data through a temporary inbox. The address is shared by design: anyone who guesses or obtains it can open the same inbox while it exists.
3.2 Technical and usage data
When you open a page, call the API, use the extension or app, or interact with an ad, our servers automatically record:
- IP address, and the country and city derived from it;
- device type, device brand and model, operating system and version, browser and user-agent string;
- the page or API endpoint requested, the referring page, and the time and date;
- language and locale selection, and how it was chosen (URL, manual choice, browser or country);
- bot/crawler signals used to keep analytics and advertising clean;
- for advertising: a first-party random browser identifier, ad slot, page, country, device, whether an ad was rendered, and whether an ad blocker was detected.
3.3 API and device data
Developers can create a device identity for the public API. We store the device identifier you choose, a hashed form of the device password, issued access tokens, request timestamps and rate-limit counters. API keys and tokens are credentials: keep them secret and revoke them if compromised. If you build an application on the API, you are responsible for the data you submit and for your own users.
3.4 Browser extension and mobile apps
The browser extension inserts a temporary address into signup forms you choose to use it on. It does not collect your browsing history, and it does not read the contents of pages beyond what is needed to detect and fill an email field. The Android app may collect crash and usage diagnostics through the same systems described in this policy. Store listings (Google Play) have their own data-safety disclosures.
3.4.1 Android native app (versions 5.x)
The Free Android app does not require account registration. It uses a device session and access credentials to request the inboxes assigned to that session. Our servers process temporary addresses, incoming messages, sender and subject metadata, and attachments to provide the inbox. Credentials and saved app preferences are stored on your device; read markers, favourites, theme settings and offline-tool inputs are not sent to advertising providers.
Addresses saved by an earlier app version can be opened through a read-only Classic-service viewer. Choosing an address sends that address to the service to load its messages. Preserving an address record does not transfer ownership or grant deletion rights. Classic-service inboxes remain subject to the public-inbox warnings elsewhere in this policy.
App-access leases are separate from the lifetime of an address and from message retention. The app does not promise automatic address expiry or a fixed 24-hour retention period for its inboxes. Mail availability is managed by the mail service; keep important mail in a permanent inbox. Disconnecting a device revokes its app access and does not delete the underlying mail.
New-mail notifications are optional and require your permission where Android requires it. The app checks for mail while open when auto-refresh is enabled. Background delivery additionally depends on server activation and is not guaranteed. If background push is enabled, Firebase Cloud Messaging uses a registration token and connection/device metadata to deliver generic notification events. You can turn off notifications in Settings. The optional home-screen widget and address shortcut display the address you choose on your device.
The app integrates Google Mobile Ads (AdMob) and Google's User Messaging Platform for advertising and consent choices. Depending on your consent and the SDK's operation, Google may collect or share IP-derived approximate location, app interactions, device or other identifiers, crash logs, diagnostics and other performance data for advertising, analytics and fraud prevention. We do not provide inbox message bodies or attachments to advertising providers. See Google's Privacy Policy and Google Mobile Ads data disclosures. Where required, advertising privacy choices are available from the app's Settings.
Android offline tools process their inputs on the device. Privacy questions or requests about data processed by TmpMailer can be sent to the privacy contact in sections 11 and 16. Uninstalling the app removes its local records and may remove access credentials; it is not a request to erase server-held messages or provider records.
3.4.2 Optional email autofill and images
On supported Android devices, you can choose TMPMailer as an email autofill provider. Android supplies the structure of the form you are using so that TMPMailer can identify the focused email field. This is processed on your device, is not saved or sent to our servers, and is not used for advertising or analytics. The address is inserted only when you choose an autofill suggestion. TMPMailer does not save form submissions or fill password and payment fields. You can change or disable the provider in Android settings.
Embedded email images can be displayed locally. External images are hidden until you choose Show images for that message. Loading an external image contacts its HTTPS server from your device and can reveal your IP address and the image URL, including any identifier in that URL; it may let the sender know that you opened the mail. TMPMailer does not attach inbox access credentials or browser cookies to these image requests.
3.5 Tools
Most of our free tools run entirely in your browser (for example password generation, hashing, JSON formatting, image compression and QR codes). In those tools the input is not sent to our servers. A small number of tools need a server request (for example domain, DNS, WHOIS, SSL, HTTP header and redirect checks); those requests are processed to return the result and are subject to the same technical logging described above. Do not submit confidential data to a network-checking tool.
3.6 AI assistant and support messages
If you use an AI chat feature, the messages you send and the replies are processed to provide the answer. Prompts may be sent to our AI model provider (currently DeepSeek) for processing. Do not include personal, confidential or sensitive information in AI prompts. If you email us for support, we keep the correspondence for as long as needed to resolve the request.
3.7 Cookies and local storage
We use a small number of first-party cookies and browser storage entries. Third-party cookies are set by the providers listed in section 6.
| Name | Purpose | Type / duration |
|---|---|---|
tmpmailer_session | Keeps your session working | First-party, session / up to 2 hours |
XSRF-TOKEN | Protects forms against cross-site request forgery | First-party, up to 2 hours |
tm_locale | Remembers the language you chose manually | First-party, up to 1 year |
tm2_bid | Random browser ID used to count ad impressions, hits and ad-block status without identifying you | First-party, up to 1 year |
email, emails | Remembers the temporary address or addresses currently open in your browser | First-party, up to 1 month |
tm2-theme | Remembers light or dark mode | Local storage, persistent |
tm2-saved-tools-v1 | Stores the tool shortcuts you choose to save, only in your browser | Local storage, persistent |
| Cookie-consent and ad-block choices | Remembers that you accepted/rejected non-essential cookies, or dismissed the ad-block notice | First-party storage, up to 1 year |
| Google / AdSense cookies | Ad delivery, frequency capping and (where permitted) personalisation | Third-party, see Google's policy |
| Cloudflare cookies | Security, bot protection and performance measurement | Third-party, session to 1 year |
You can clear or block cookies in your browser settings. Blocking the session and security cookies may break the inbox. Where required, we ask for consent before setting non-essential cookies; you can change or withdraw that choice at any time through the cookie banner or your browser controls.
4. How we use information
- Provide the service: create addresses, deliver and display messages, run tools, serve the API, apps and extension.
- Keep it secure and available: detect abuse, spam, scraping, invalid ad traffic and attacks; enforce rate limits; debug errors.
- Measure and improve: understand which pages and tools are used so we can fix and improve them.
- Advertising: show ads that fund the free service, measure whether ads were rendered, and detect ad blockers (we only show a dismissible notice).
- Legal compliance: respond to lawful requests and enforce our terms.
5. Legal bases (EEA, UK and similar laws)
Where the GDPR or UK GDPR applies, we rely on:
- Contract / steps at your request — to provide the inbox, tools, API and apps you ask for.
- Legitimate interests — security, abuse prevention, service reliability, and measuring advertising needed to keep the service free, balanced against your rights.
- Consent — non-essential cookies and personalised advertising where consent is required. You may withdraw consent at any time.
- Legal obligation — where we must keep or disclose data by law.
6. Advertising, analytics and third parties
We use the following providers. Each has its own privacy policy and may process data in countries outside yours.
| Provider | Purpose | Data |
|---|---|---|
| Google AdSense / Google Ads | Advertising that funds the service | Cookies, device and approximate location, ad interactions, IP |
| Google Analytics 4 (via Google Tag Manager) | Aggregated traffic measurement | Pages, device, approximate location, cookies |
| Cloudflare | CDN, security, bot protection, Web Analytics (RUM) | IP, request metadata, performance measurements |
| WebSocket infrastructure provider | Real-time inbox updates | Connection metadata and message events |
| cdnjs, unpkg, Google Fonts | Delivering fonts, icons and front-end libraries | IP and request metadata |
| DeepSeek | Processing AI assistant prompts | The text you submit to the assistant |
| Google Play | Android app distribution and diagnostics | Store and app diagnostics data |
We do not sell your inbox content. We do not share message contents with advertisers. Advertising and analytics providers receive technical and interaction data as described above, not the contents of your temporary inbox.
6.1 Personalised advertising and opt-outs
Where permitted, Google may use cookies to show personalised ads. You can opt out of personalised advertising in Google Ads Settings, or manage participating providers at Your Online Choices (EU/UK) and aboutads.info (US). You can also reject non-essential cookies in our banner. Opting out does not remove ads; it makes them less personalised.
7. When we share information
- Service providers listed above, under contracts that limit their use of the data to providing the service.
- Legal and safety — if required by law, court order, or to protect the rights, safety and security of TmpMailer, our users or the public.
- Business transfer — if the service is sold or merged, data may transfer as part of that transaction, subject to this policy.
- Aggregated statistics — we may publish aggregated, non-identifying statistics (for example total messages delivered).
We do not sell personal information for money, and we do not share inbox contents with third parties for their own marketing.
8. International transfers
Our servers and providers may process data in the United States, the European Union, the United Kingdom and other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses. Data protection laws in those countries may differ from those where you live.
9. How long we keep data
- Temporary inboxes and messages: normally up to 24 hours; deleted earlier on expiry, manual deletion, or maintenance.
- Visitor and security logs: up to 24 months, then deleted or aggregated.
- Advertising events (browser ID, slot, page, country, device, impressions, ad-block status): up to 24 months.
- API device records and tokens: while the device is active, and for a short period afterwards for security and rate-limiting; revoked tokens stop working immediately.
- Server and error logs: typically 30–90 days, unless needed to investigate an incident.
- Support correspondence and AI prompts: as long as needed to answer you, then deleted or anonymised.
- Backups: rotated within about 90 days.
We may keep limited records longer where the law requires it or to defend legal claims.
10. Security
We use HTTPS, access controls, hashed device passwords, rate limiting, bot protection and monitoring. No service is completely secure. Temporary email is designed for low-risk signups, not for confidential communication, and you should assume that anyone with the address can read the inbox. If we become aware of a breach affecting your data, we will notify you and the authorities where the law requires it.
11. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- delete data (for example, delete your inbox or ask us to erase logs);
- restrict or object to processing;
- data portability;
- withdraw consent for cookies or personalised advertising;
- not be discriminated against for exercising these rights;
- complain to a data protection authority in your country.
To exercise a right, email ajr.jahid@gmail.com with enough information for us to locate the data (for example the temporary address and approximate time). We may ask for verification. We aim to respond within 30 days. You can also use an authorised agent where the law allows it.
11.1 California and similar US rights
If you are a California resident, you may request to know, delete or correct personal information, and to opt out of "sharing" for cross-context behavioural advertising. We do not sell personal information for money. To opt out of personalised advertising, use the cookie banner, the Google Ads Settings link above, or email us. We will not discriminate against you for making a request.
11.2 Do Not Track and Global Privacy Control
We honour opt-out preference signals where our systems can read them, such as Global Privacy Control, by treating them as a request to disable non-essential advertising cookies. Because some features rely on first-party storage, we may still use essential cookies to keep the inbox working.
12. Children
TmpMailer is not directed to children under 13 (or under 16 where local law requires a higher age). We do not knowingly collect personal information from children. If you believe a child has used the service, contact us and we will delete the relevant data.
13. Automated decisions
We use automated checks for bot detection, abuse prevention and ad-block detection. These checks can block automated requests or show a notice, but they do not make legal or similarly significant decisions about you.
14. Links to other sites
Our pages link to third-party sites and services. Their privacy practices are their own; read their policies before providing personal data. We are not responsible for third-party sites.
15. Changes to this policy
We may update this policy as the service changes. The effective date at the top will change, and material changes will be announced on this page. Continued use after an update means you accept the revised policy.
16. Contact
Questions, requests or complaints about privacy:
Email: ajr.jahid@gmail.com
If you are in the EEA or UK and are not satisfied with our response, you may complain to your local data protection authority.