Privacy Policy: How We Handle Your Data
OnceEmail's core promise: collect as little as possible, delete on schedule, and never sell or share your information. Everything is spelled out here — no hidden clauses.
Near-zero personal footprint
Disposable email needs no signup — we do not know who you are. Even when you add forwarding aliases, we store only the email address you provide and nothing else.
Data deleted on a clock
Temp addresses and their mail are destroyed on expiry (24 hours max). Relay archive entries auto-clear after 30 days — no action required on your part.
Never sold or shared
Your mail exists only to display to you and, for aliases, to forward to you. We do not sell it to advertisers or hand it to third parties for their own use.
Data collection & retention at a glance
Every data type OnceEmail touches — what we collect, why, and how long it stays — row by row.
Swipe to see all columns
| Data type | When collected | Purpose | Retention |
|---|---|---|---|
| Temporary email address | Auto-generated when you open the homepage | Display inbox address, receive mail | ≤ 24 hours, deleted on expiry |
| Mail received at a temp address | Someone sends to that address | Show messages to the address holder | ≤ 24 hours, deleted with the address |
| Real email for forwarding | You provide it to register or sign in | Send login codes, forward mail, identify account | Until account deletion |
| Forwarding alias addresses | You create them in the console | Receive mail and relay to your real inbox | Until you delete the alias |
| Relay mail online archive | Auto-saved when an alias receives mail | 30-day online viewing and download | 30 days, then auto-deleted |
| Login verification codes | Generated when you request sign-in | Confirm email ownership, complete login | Deleted immediately after use or expiry |
| IP address (request source) | Any page visit or API request | Abuse prevention, rate limiting | Not kept separately after the request is handled |
| Browser local storage | When you use temp mail or sign in | Restore inbox, remember language, keep session | Until you clear site data in the browser |
Attachments: temp inboxes do not store attachment content; relay aliases handle attachments by message size tier — see the limits reference.
Full privacy policy
The following sections are the complete data-handling agreement between OnceEmail and you, with the same force as the summary table above.
Scope
This Privacy Policy applies to all features offered by OnceEmail ("we," "us," or "the Service") at onceemail.com, including disposable email and permanent forwarding aliases.
By using the Service, you acknowledge that you have read and accept this Policy together with our Terms of Service. If you disagree with any part, please stop using the Service.
This Policy does not govern how third-party sites or services handle your data when you interact with them via email — that falls under their own privacy policies.
Information we collect
Using disposable email (no registration)
We ask for no personal information. Opening the homepage auto-generates a temp address; a browser LocalStorage token lets you restore the inbox — that token stays on your device. On our servers we keep only the address and its mail, deleted within 24 hours at most.
Registering and using forwarding aliases
Sign-in requires a real email address to receive a one-time verification code. After login, we store:
- Your real email address (for forwarding and account identification);
- The forwarding aliases you create;
- Mail received through those aliases (30-day online archive);
- If you enable two-factor authentication: your TOTP secret (stored in encrypted form only).
Technical data collected on every visit
Each server request briefly logs IP address, timestamp, and HTTP status code for abuse prevention and rate limiting. We do not permanently link IP addresses to accounts or use them to track browsing behavior.
How we use information
Everything we collect is used only to:
- Deliver the Service: generate temp addresses, receive and display mail, forward alias mail to your real inbox;
- Verify accounts and secure access: send one-time codes, maintain 7-day sessions, support two-factor authentication;
- Prevent abuse: detect and limit abnormal request rates, block spam abuse of the platform;
- Maintain reliability: diagnose technical failures.
We do not use your data for advertising, profiling, behavioral analytics, or any purpose unrelated to the items above.
Sharing and third parties
We do not sell, rent, or trade your personal data. Exceptions are limited to:
- The forwarding function itself: mail sent to your alias is delivered to the real email you provided — that is the product, not a "third-party share";
- Legal requirements: if a court or authority issues a valid lawful order, we will disclose only the minimum data required and, where permitted, attempt to notify you;
- Infrastructure providers: hosting and mail transport vendors may technically process data under contract and may not use it for their own commercial purposes.
The Service integrates no third-party advertising, analytics, or social tracking tools — so there is no data sharing of that kind.
Cookies and local storage
We do not use browser cookies to track you. OnceEmail uses LocalStorage on your device for three items only:
- Inbox token (
oe_box): restores the same temp address after refresh; once the address expires server-side, the token no longer maps to live data; - Login token (
oe_pass): a 7-day JWT session credential, cleared on sign-out or expiry; - Language preference (
oe_lang): remembers your last language choice for the next visit.
You can clear all of the above anytime through your browser's site-data settings.
Data security
We apply these measures to protect your data:
- HTTPS enforced site-wide — no plain HTTP;
- Passwordless login via one-time codes — no fixed password to breach;
- Optional TOTP two-factor authentication for relay accounts;
- Strict lifecycle on temp mail — automatic deletion on expiry, no manual retention;
- Restricted server access; logs do not long-term link IPs to accounts.
No online service can guarantee absolute security. Do not use disposable addresses for banking, government, medical, or similarly sensitive correspondence.
Children
The Service is not directed at anyone under 16. If you are a guardian and believe a child used the Service without permission, contact support@onceemail.com and we will help remove related data.
Deletion and account closure
You may delete your data at any time, for any reason:
- Temp mail: tap "Get a new address" to destroy the old address and all its mail instantly; individual messages can also be deleted from the inbox;
- Relay archive: delete single messages or clear the entire archive from the console;
- Forwarding aliases: deleting an alias permanently retires that address;
- Account closure: email support@onceemail.com to request deletion — we remove the account and all linked data within 14 business days and confirm by reply.
After closure, former alias prefixes may become available again in the future; no new holder can access your historical data.
Policy changes
If we make a material change (such as new data types or new uses), we will post notice on this page at least 30 days before it takes effect and update the "Last updated" date at the top.
Continued use after the effective date means you accept the revised Policy. If you disagree, you may close your account and stop using the Service before it takes effect.
Prior versions are available on request at support@onceemail.com.
Your rights over your data
Wherever you are, using OnceEmail gives you the following rights — no special request form required.
Delete anytime
Messages, aliases, and archive entries can be removed in the console instantly; account closure clears everything within 14 business days.
See what we hold
Sign in to the console to view every alias and archived message we store; contact us if you need an export.
Correct your details
If your registered email is wrong, start verification with the correct address; for anything else, write to us.
Object to processing
We process data only to run the Service — no optional marketing or tracking to opt out of; tell us if you have concerns.
Raise a privacy complaint
If you believe we handled your data incorrectly, contact support@onceemail.com first — we will investigate and respond.
Data portability
Need a machine-readable export of aliases or archive mail? Email support@onceemail.com and we will help where we can.
Privacy questions? Write to us
If this Policy does not cover your situation, or you think something is wrong with how we handle data, email support@onceemail.com — we read every message.