What data we need to receive your mail

01 · Scope of this notice

This notice covers the web inbox, email verification-code sign-in, and aliases and forwarding available after signing in at inboxonce.com. Temporary inboxes that don’t require sign-in are accessed using inbox credentials held in your browser. Forwarding accounts are accessed using your verified login email and account credentials. These are separate identities.

Email senders and the websites where you register have their own data practices. Inboxonce cannot control their email content, whether they accept disposable addresses, or how they store registration details. Before using one, you can read about disposable and regular email addresses. For accounts you may need to recover later, use an email address you can keep control of.

02 · How each service handles data

Temporary inbox credentials and email

When you create a temporary inbox, the service generates an address, access credentials and an expiry time. To display received messages in your inbox and reader, we process the sender, recipient address, subject, receipt time, message content and information about any attachments.

We use this data to route messages to the right inbox, verify access, and carry out extensions and deletions. You don’t need to provide a regular email address to use a temporary address, but that doesn’t make it completely anonymous: messages may contain your name, order details or other identifying information.

Login email and authentication information

To use email forwarding, you must provide an email address that can receive verification codes. We use it to send sign-in codes, identify your account and issue login credentials after verification. If you enable two-step verification, we also process your authenticator secret and information needed to verify one-time codes.

Email verification codes and authenticator codes verify that you’re authorised to access the account. Never share them with support or anyone else. Signing out removes your account’s signed-in state from the current browser, but does not delete your account, aliases or forwarding records, or remove separate temporary inbox credentials.

Aliases, forwarding destinations and delivery records

When you create an alias, we store its link to your account, its active status and the delivery records needed to forward incoming messages to your account email. We also process message metadata, content and forwarding status to provide the 30-day archive and help you check delivery.

Disabling an alias stops future forwarding from that address; it does not delete archived messages. Messages already delivered to your regular inbox are governed by that email provider. Deleting a record in Inboxonce does not delete its copy there.

03 · Retention periods and expiry

Temporary inboxes are governed by their expiry time. Email forwarding has a separate 30-day archive. An address still visible in your browser, an old screenshot or a sender’s resend history does not prove that the inbox is still active.

The table below describes how long product data can be accessed and the effects of available actions. It does not promise that all backups, security records or records retained as required by law will be removed at the same time. Account and authentication information is not covered by the rule that a temporary address and its contents are deleted after three hours.

After a temporary address expires, don’t keep waiting for verification codes sent to it or rely on it to recover an account. For tasks that may take longer, plan how long your address needs to last. For ongoing correspondence, use email forwarding or your own regular email address.

04 · What your browser stores

Browser storage helps restore inbox access and keep you signed in; it is not a permanent backup of your email. Clearing site data, using a private window or switching devices may cause you to lose your access credentials. Knowing the address alone is usually not enough to regain access to its inbox.

• Temporary inbox credentials: Used to restore the address, request the message list and read email. Anyone with these credentials may be able to access the inbox. Don’t share them or post screenshots publicly.
• Account login token and login email: Used to access aliases and archives and show your sign-in status in the header. Stored separately from temporary inbox credentials.
• Currently viewed message: The session may remember which message you selected so you can continue reading when you return. This is not a separate email archive.
• Language preference: The language you visit is reflected in its language-specific URL. If your browser also stores a language preference, it is used only to select the interface language and does not grant access to email.

On a shared device, closing a tab may not clear this information. Before you leave, sign out of your forwarding account and clear this site’s browser data if needed. Note that clearing local data does not request deletion of messages from the server; carry out any deletion you need first.

05 · Email reading has security limits

The web inbox displays HTML email in an isolated reader and processes message content to reduce the risk of external emails affecting the site interface. This isolation does not verify the sender’s identity or guarantee that the content, links or attachments are safe.

Messages may contain impersonated brands, links designed to trick you into signing in, external images or tracking resources. Opening them may send network requests and related technical information to third parties. Don’t enter passwords, make payments or share verification codes in response to unexpected email. To verify a message, visit the official website directly using an address you know.

For recovery addresses on bank, government, healthcare, work or other sensitive accounts, use an email address you can keep control of. A disposable address is not suitable as a long-term identity credential.

The PayPal and Steam content on the homepage is labelled as a demo. It is not real correspondence and does not imply any affiliation between those brands and Inboxonce. If a real verification code hasn’t arrived, first follow our code delivery troubleshooting guide to check the address, expiry time and sending interval.

06 · Actions you can take

First identify whether you’re managing a temporary inbox, a forwarding account or a message already forwarded to your regular email. Deletion applies differently to each; an action in one place will not automatically remove data everywhere.

• Delete a temporary message: Go to the web inbox, open the message and select “Delete this message”. Deleting a demo message affects only what is displayed on the current page; it does not delete an email from the server.
• Close an old temporary inbox: In the inbox, “Get a new address” destroys the old inbox and its messages after the new address is created successfully. Use this option to discard the old inbox; the newly generated address belongs to a separate inbox.
• Disable or delete an alias: Go to email forwarding settings, find the alias and choose an action. Disabling is not the same as deleting, and deleting an alias cannot recall messages that have already been forwarded.
• Delete forwarding archive records: Open the message details in the dashboard’s 30-day archive and delete the record. Copies in your regular inbox must be deleted there separately.
• Sign out: Use the dashboard’s sign-out option to clear your account’s signed-in state in this browser. Signing out does not close your account or destroy a temporary inbox.

To request access to, correction of or deletion of account data, email support@inboxonce.com with the request type, relevant account email and approximate date. To prevent accidental deletion or unauthorised disclosure, we may ask you to prove control of the relevant email address. Do not include verification codes, login tokens, authenticator secrets or inbox access credentials in your message.

We may be unable to fulfil all or part of a request if we cannot verify your identity, it involves someone else’s data or the law requires us to retain the data. Support will explain what can be done in your specific case; one email is not a promise that all copies will be removed immediately.

07 · Essential processing, legal requests and updates

We process data as needed to provide email receipt, authentication, forwarding, troubleshooting and abuse prevention. Providing these features may also involve infrastructure providers that host the services. “No sign-in required” does not mean “not processed by servers”: messages must pass through our servers to be received and displayed.

If we receive a legally binding request, we may need to retain or disclose data within its applicable scope, after verifying the request’s authority and scope. This notice does not promise that we will never disclose data, keep no operational records or provide identical rights in every region.

We’ll update this page and the date at the top if features or data practices change. For significant changes that clearly affect how user data is handled, we’ll notify you through an in-product notice or another appropriate channel, as required. You can also read our Terms of Service to learn about permitted uses, service limits and responsibilities.