Privacy

Last updated 18 August 2026. This is short because there is not much of it: there are no accounts here, so there is nothing to attach a history to.

What is stored

• The addresses handed out, and when each was last opened. No name, no account, nothing linking one address to another.
• Messages sent to those addresses, including sender, subject and body. Mail arrives from third parties; whatever they put in it is stored as they sent it.
• Attachment filenames only. The file itself is discarded when the message arrives and is never stored or served.
• A salted hash of your IP address, for one hour, to limit how many addresses one source can create. The address itself is never written down, the salt is not in the table, and the hour is part of what is hashed — so two records from the same person an hour apart cannot be connected to each other.

No analytics, no visitor tracking, no logging of who read which page. That is not a promise to be generous; it is that none of it was built.

How long

• Messages: 7 days, then deleted.
• Mailboxes: 30 days after the last time the inbox was opened. Keep using an address and it keeps working.
• Rate-limit records: 2 hours.

Your browser

Your address is kept in your browser’s local storage so the page can show you your own mailbox when you come back. It never leaves your device except as the address itself, and no consent is asked for it because without it the site cannot do the one thing you came for.

If you allow advertising, your consent choice is stored the same way, so you are not asked again.

Advertising

This site can show advertising from Google AdSense. That script sets cookies and reports your visit to Google, so it does not load at all unless you allow it. Decline and no advertising code runs. You can change your mind by clearing this site’s data in your browser.

When it is allowed, Google’s handling is theirs and is described in how Google uses information from sites that use its services.

Who else sees this

The site runs on Cloudflare, which delivers every request and receives the mail before this service does. The database is hosted by Supabase. Nobody else is given anything, and nothing here is sold — there is nothing worth selling.

What this is not safe for

Anyone who has an address can read its mail. There is no password, because there is no account. Treat any address as public: fine for a signup code, never for a bank, a password reset, or anything you would need back.

Removing something

Everything deletes itself on the schedule above. To have a mailbox or a message removed sooner, or a sender blocked, write to abuse@spareinbox.co with the address concerned.