What expires and is deleted,
and what we handle while you use the service

01 · What this policy covers

This policy covers the anonymous temporary inbox, long-term email forwarding, and related sign-in and management pages provided by Tmpkey at tmpkey.com. No signup is needed for a temporary inbox. To use forwarding, you’ll need to provide a real email address that can receive sign-in codes and forwarded messages.

“Anonymous” means you don’t need to create a Tmpkey account to use the temporary inbox or share your real email with the party receiving mail at that address. It doesn’t mean your online activity can’t be traced, guarantee that a portal will accept a disposable address, or replace a secure network connection, device protection or identity safeguards.

Before using the service, please also read our separate Terms of Service. If this policy changes, check the effective date shown on this page. Questions about data handling? Contact us at support@tmpkey.com .

02 · Temporary email: from creation to deletion

When you create a temporary inbox, the service generates an address, access credentials and an expiry time. It handles sender information, subject lines, message bodies and any attachments delivered to that address. Your access credentials let you read and delete messages and manage the expiry; no sign-in email is required.

The default expiry is 3 hours, and each extension adds 3 hours. An inbox can be used for up to 24 hours from creation. Check the countdown shown in the inbox on the homepage for the actual expiry time. Extending an inbox won’t keep it indefinitely.

1. 3h

   Created: the clock starts

   Your inbox is available for 3 hours by default. Keep the credentials in your current browser to continue accessing the address.

2. +3h

   Still waiting for a message? Extend

   Each extension adds 3 hours, up to a 24-hour limit per inbox. Closing the page won’t pause the countdown.

3. 24h

   Limit reached: no further extensions

   When the inbox expires, its address and emails are deleted. It can’t receive more mail, and you can’t restore messages with the original credentials.

Deleting an inbox ends its use and removes its emails. Creating a new address gives you a new inbox with the default 3-hour expiry and deletes the old one. Deleting an individual email only removes that message; it doesn’t extend the address’s lifetime or recall anything the sender has already sent or saved.

If you clear your browser data or lose your access credentials, you may be unable to open the original inbox again before it expires. That doesn’t mean a deletion request has been sent to the server. Don’t rely on a temporary inbox to store important information. For services where you may need to recover your account later, use your own email address or a long-term forwarding alias.

03 · Email forwarding: separate account and archive retention

Email forwarding uses your sign-in email to send login codes, identify your account and receive messages forwarded from your aliases. The service also stores the mapping between each alias and its destination email, alias status and delivery status so it can forward messages correctly and let you manage them.

Forwarded emails are archived for nearly 30 days so you can review messages and delivery details. This isn’t the expiry period for your account or aliases: deleting an archived email doesn’t delete its alias, and an email aging out of the archive doesn’t mean your account or alias has been closed.

When you set up two-step verification, the service generates a QR code and key. Scan the code with Google Authenticator, Microsoft Authenticator or 1Password, then enter the 6-digit code to confirm setup. This setting adds a sign-in check; it isn’t a new email address. Never share your QR code, key or verification codes.

In the forwarding dashboard you can manage aliases, view or delete archived messages, and set up two-step verification. Simply signing out won’t delete this server-side data or stop aliases that are already forwarding.

04 · What your browser stores and what requests involve

To let you return to the same temporary inbox after refreshing the page, local browser storage saves its access credentials and related inbox state. Email forwarding separately stores your sign-in token and email address. The ID of the email you’re currently reading is saved in session storage so your selection can be restored during the same browsing session.

This storage isn’t a long-term backup of email contents. Temporary inbox credentials and account tokens grant access, so don’t share or copy them, include them in public screenshots or leave them on shared devices. Clearing local data may prevent you from accessing your temporary inbox.

• Temporary inbox credentials: Used to read and manage the current temporary inbox; signing out of your forwarding account won’t clear them.
• Account token and sign-in email: Used to maintain your forwarding account session. Signing out clears both items saved in the current browser.
• Reading selection: Remembers the email you’re currently viewing; it doesn’t change how long the email itself is retained.

To serve web pages, verify credentials, prevent abuse and handle inbox requests, our infrastructure needs to process IP addresses, request times and paths, and technical information sent by your browser with each request. Processing this connection data doesn’t require you to register, but it does mean a temporary address can’t hide the source of your access.

So “the address and emails are deleted at expiry” doesn’t promise that “all request records are immediately erased” or that “online activity can’t be linked.” When you finish using a shared device, sign out of your forwarding account and clear the site data in that browser if needed. To end a temporary inbox immediately, delete it rather than simply closing the tab.

05 · Email content and third-party services

To let you read incoming messages, Tmpkey processes email subject lines, sender details, message bodies and attachment information. HTML emails are displayed in isolation and stripped of dangerous content; plain-text emails are shown as text. These protections don’t make email content trustworthy or guarantee that every link or attachment is safe.

Remote images, fonts and other external resources in emails may send requests to their providers if your browser loads them, potentially revealing your IP address, access time or tracking identifiers. Clicking links in a message, opening attachments or visiting external verification pages also brings you within the data practices of other services. If you don’t recognise the sender, check the domain and reason for the request first.

Tmpkey’s privacy policy doesn’t replace the policies of portals, senders, your real email provider or websites linked from messages. Read the portal’s privacy notice before entering your email. If it also asks for payment details or unrelated identity documents, check with on-site staff first.

For practical steps and advice on where to use a temporary inbox, see our guide to entering an email address on public Wi-Fi portals. We don’t recommend using an expiring temporary address as the only contact method for banking, work or accounts that require ongoing identity verification.

06 · What you can do and what those actions won’t delete

You can manage each type of data in the inbox or forwarding dashboard. Before taking action, distinguish between “stop future emails,” “delete saved messages” and “clear sign-in state on this device.” These actions aren’t interchangeable.

Delete a temporary inbox

Ends use of the old address and deletes its emails; this can’t be undone. Creating a new address also deletes the old inbox. Closing the page doesn’t delete it.

Delete forwarding archive messages

Removes selected messages from the Tmpkey archive. It won’t recall emails already delivered to your real inbox or delete the sender’s copies.

Disable or delete an alias

Disabling an alias stops forwarding new messages but keeps its settings. Deleting it removes the alias mapping. Neither action automatically deletes existing archive messages or emails in your real inbox.

Sign out

Clears the account token and sign-in email saved in the current browser and returns you to the email sign-in step. It doesn’t delete your account, aliases or archive, or delete a separate temporary inbox.

Request account data

To ask about, correct or request deletion of account data, contact support. We’ll need to verify that your request relates to your account. Don’t send access keys through public email.

When you contact us, say whether you use a temporary inbox or email forwarding and describe what you need help with. You can include the relevant address, when it happened and a description of the error without sensitive information. Don’t send sign-in codes, full tokens, authenticator keys or unnecessary email content.