Privacy by design

Privacy by design: the full lifecycle of a message on Foxtemp

"Is a disposable email safe?" "How long is mail kept?" — instead of leaving you to dig through terms of service, here's the entire data path laid flat: what's stored, for how long, and who can see it, at every step from arrival to destruction.

Every record ships with an expiry dateData carries its own deletion time the moment it lands; the system enforces destruction automatically, not "whoever remembers to delete it."

What we don't need, we don't storeThe temp inbox drops attachments, requires no sign-up, collects no name or phone number — data that was never stored can never leak.

Zero third parties on the pageNo third-party ad or tracking scripts load; every static asset is self-hosted — nothing you open here reports on you to anyone else.

Path one · Temp inbox

From creation to ashes, in 24 hours at most

T+0 · Address generated

You open the homepage, and an address is born with its own destruction countdown

The system generates a realistic-looking address plus a random access token, written into your page URL and browser local storage. We don't require sign-up and don't know who you are — the only link between this inbox and your identity is the one you hold yourself.

T+0 to 3 hours · Receiving window

Mail arrives: body stored, attachments discarded on the spot

Incoming mail lands in your inbox live. The message body (including HTML and image layout) is stored temporarily for display; attachment content is never written to storage — the list just carries a "has an attachment" flag. Anything over 100MB total is rejected at the door.

Bodies render inside an isolated sandboxed iframe, so any script embedded in a message never executes on our pages.

24-hour cap at most · Refill limit

You can extend it, but there's a ceiling

You can refill the timer back to 3 hours as often as you like, but an address's total lifetime from creation is capped at 24 hours — this is enforced server-side, not a front-end suggestion. The point of the cap: any piece of temporary data in the system has a fixed, non-negotiable end date.

On expiry · Automatic destruction

Address, mail, and token — all deleted together

Whether it's natural expiry, hitting the 24-hour cap, or you tapping "New address," the handling is identical: the inbox and every message are removed from storage, and the access token is invalidated with it. No recycle bin, no "call support to recover it" — deleted means deleted, and that's exactly the point.

Path two · Forwarding alias

A 30-day archive, counting down day by day

Arrival · Filtering and forwarding

Spam filter first, then your real inbox

Mail sent to an alias passes through spam filtering first: legitimate mail forwards to your real inbox, while suspicious mail is held back but stays fully visible to you — the archive shows the block reason and score, and a false positive is one click from being reinstated. Mail sent to a paused alias is dropped outright, not forwarded and not archived.

Archive window · Days 1–30

Online archive, attachments tiered by size

Every message stays in the archive for 30 days, with a live remaining-days count on its detail view. Attachment rule: total ≤50MB keeps the attachment and stays downloadable; 50–100MB still forwards with the attachment but the archive drops it; over 100MB is rejected. You can manually delete a single message or clear everything anytime, and manual deletion takes effect instantly.

Day 30 · Automatic purge

Deleted automatically on schedule, no backup archive kept

Once day 30 ends, the message is deleted from the archive automatically. We don't run any "cold storage" or "historical archive" — the point of forwarding is for mail to live in your real inbox; the 30-day archive is a safety net, not a second mailbox.

Data ledger

What we keep, and what we flatly refuse to keep

Laid out item by item so you can check it against any privacy policy. Full legal wording is on the privacy policy.

Kept (time-boxed)

Temp inbox message bodiesUsed for on-page display; up to 24 hours, deleted with the inbox
Forwarded-mail archive (with attachments ≤50MB)30 days, deleted automatically on expiry, deletable manually anytime
Your real email address (signed-in users only)Used as forwarding destination and sign-in credential; deleted on account closure
Alias list and forward countsNeeded for console features; deleted with the alias

Never stored (by design)

Temp inbox attachment contentDiscarded on arrival, never written to any storage
Name, phone number, ID informationThere has never been a collection point for these
PasswordsSign-in is passwordless via emailed code, so there's no password database to steal
Third-party ad and cross-site tracking dataNo third-party script ever loads, so there's nothing to collect

Every retention window in one table

Retention periods at a glance

Data	Retention	How it's deleted	Can I delete it early?
Temp inbox + message bodies	3 hours (refillable, 24-hour cap)	Destroyed automatically on expiry	Yes: "New address" destroys the old box instantly
Temp inbox attachments	0 (never stored)	Discarded on arrival	—
Forwarded-mail archive	30 days	Deleted automatically on expiry	Yes: delete a single message or clear all
Archived attachments (total ≤50MB)	Tied to the message, 30 days	Deleted automatically with the message	Yes: deleted along with the message
Account (real email + aliases)	For the life of the account	—	Yes: email to request closure, deleting everything with it

These periods are enforced server-side consistently across all five language sites and every user; if any page's wording ever conflicts with this table, this table and the privacy policy take precedence.

Let's say the hard part up front

Three honest boundaries

The temp inbox is not a confidential channel. Its access model is "whoever has the link can view it" — it guards against spam and profiling, not eavesdropping. Always use your own real email for banking, payments, or government-related mail.

The security of the far end of a forwarding chain depends on your real inbox. An alias hides your address and isolates leak sources, but the mail ultimately lands in your inbox — give it a strong password and two-factor authentication; that's a layer we can't cover for you.

"Automatic destruction" means even we can't get it back. Deletion on expiry has no backup and no exceptions. Read and save anything you need before the countdown hits zero — this rule protects you, and it binds us too.

Design explained — now verify it yourself

Generate an address, receive a message, watch the countdown hit zero — nothing is more convincing than seeing it happen. Want the legal-grade version? The privacy policy leaves nothing out.

Try it on the homepage Read the privacy policy