Privacy

This page describes what VanishMail stores, why, and when it disappears. We try to be precise rather than reassuring.

When you load the site

Your browser sends the usual HTTP request, including your IP address and user agent. Our web server writes these to an access log that we keep for 7 days for abuse and debugging, then rotate out. We do not use third-party analytics, advertising trackers, or session-replay tools on the public site.

When you generate an address

We create a database row containing a 256-bit access token (stored only in an HTTP-only cookie), the random local part, the 60-minute expiry timestamp, and an HMAC-SHA-256 hash of your visitor cookie under our application salt. The cookie value itself is never stored in the database. We do not ask for or store your name, email, phone, or any other identifier.

When you receive mail

We fetch each message from the catch-all mailbox over IMAPS. We store:

• Sender display name and address
• Subject, date, and a sanitised plain-text or HTML body
• Attachment metadata (filename, MIME type, size, SHA-256)
• Attachment contents, written to a private directory on the server and only accessible through a token-gated API
• A small subset of message headers (From, To, Cc, Subject, Date, Message-ID, Return-Path, Reply-To, Received) for display

We do not store or forward the raw message source.

What we do not do

• We do not run an open relay. You cannot send mail from a VanishMail address.
• We do not expose a public directory of generated addresses.
• We do not run third-party JavaScript on the public site.
• We do not sell or share data with advertisers or data brokers.

When the inbox expires

Sixty minutes after creation (or 120 if you used the one-time extension), the inbox stops accepting new mail. A scheduled job, running every few minutes, hard-deletes the message bodies and attachment files within 10 minutes. Database rows for the inbox are also removed.

What we do not claim

Despite the name, VanishMail is not a tool for sending highly sensitive information. Inbound mail is still processed by an SMTP server that may keep its own delivery logs for up to 14 days, independent of this application. Use a different tool if you need end-to-end encrypted delivery.

Your rights

Because we do not require an account, we have no way to look up your inbox by name. If you still have a valid inbox token, you can destroy it manually and the data will be removed. For anything else, contact us at the address on the Contact page.