Temporary addresses expire
New inboxes last 3 hours by default, and each extension adds 3 hours. An address expiring is not the same as the underlying copies being erased.
Temporary inbox dataPrivacy policy · Data practices
Clear about how we handle data
The cloak hides the email address you share—not the processing of your messages. This page explains what InboxCloak handles for temporary inboxes, long-term alias forwarding, and account security, and what you can do.
Effective date:
Forwarding archives aren't permanent backups
Long-term aliases can stay active, but email archives in the dashboard cover a rolling 30-day period. Save anything important elsewhere.
Forwarding dataLogging out doesn't delete your data
Emails, aliases, temporary inboxes, and login credentials each serve a different purpose. Choose the action that matches what you want to stop.
What each action does01 · What this policy covers
This policy applies to the temporary inboxes, long-term email alias forwarding, related account sign-in, and dashboard features provided at inboxcloak.com. When you access or use these features, InboxCloak processes data to create addresses, receive and display email, forward messages, verify identity, and keep the service secure.
Temporary inboxes don't require registration. Long-term forwarding requires you to receive a verification code at your real email address and sign in. These modes differ in how data is used and accessed: the first relies on temporary inbox access credentials, while the second relies on account login credentials. If you're unsure which type of address to use, read Disposable email addresses and email aliases: what's the difference?.
Hiding your address doesn't make you completely anonymous
Websites you sign up with generally see the temporary address or alias you provide. However, the service still needs to access the necessary address and message content to process your email. A sender may also identify you from the name, order details, or other information you submit to that website. This service cannot remove those connections.
This page explains how the product handles data; example emails shown on the page are not messages sent to your inbox. For service restrictions, availability, and limits of responsibility, also read the separate Terms of Service.
02 · Temporary inboxes: addresses, credentials, and message content
When you create a temporary inbox, the service processes its address, access credentials, and expiry information to route incoming messages to the right inbox and verify later requests to read, delete, or extend it. Once an email arrives, the sender address, subject, receipt time, message content, and attachments are used to display the inbox list and message details and to provide attachment downloads.
Temporary inbox access credentials are the key to that inbox. Anyone with valid credentials may be able to access its messages. Don't share your credentials, request URLs that contain them, or full debugging screenshots with anyone. Not requiring registration doesn't mean it's safe to share your emails publicly.
What the three-hour expiry, extensions, and deletion mean
| Status or action | What happens | What it does not mean |
|---|---|---|
| Default expiry | New addresses last 3 hours by default. The live countdown in the inbox and the expiry returned by the server are authoritative. | Closing the tab immediately destroys the inbox, or that you can recover emails after it expires. |
| Extend | Each successful extension adds 3 hours. Extend before expiry and check that the confirmation appears. | The address is kept forever, or an expired inbox can be restored. |
| Delete one email | Deletes the corresponding email record from the service. It does not replace your current temporary address. | Copies held by the sender or downloaded to your device are also withdrawn. |
| Manually destroy the entire inbox | This destroys the whole temporary inbox. Selecting “Change address” on the home page creates a new inbox and requests destruction of the old one. | The inbox is merely hidden from the list, or all logs and backup media are physically erased at the same time. |
After expiry, don't rely on the address to receive messages or access existing emails. Losing access in the interface, a successful deletion request, and the cleanup of underlying backups or operational logs may happen at different times. This policy does not promise a physical deletion time that has not been confirmed.
Save anything you need in the temporary inbox before changing addresses or waiting for expiry. Temporary inboxes aren't suitable for bank notifications, recovering important accounts, or ongoing security alerts. If a verification code doesn't arrive, follow the verification code troubleshooting checklist instead of repeatedly changing addresses.
03 · Long-term forwarding: your real email address is still involved
Long-term forwarding requires your real email address to receive sign-in verification codes, link your account, and receive messages forwarded from your aliases. Alias settings include the address and whether forwarding is enabled, so the service can determine where an incoming message should go—or whether forwarding should stop.
Forwarding records show delivery status and help troubleshoot failures. The email archive provides a 30-day window for viewing recent records; it is not a promise of permanent storage. Copies delivered to your real inbox are managed by that email provider and won't disappear automatically if you delete records in InboxCloak.
| Data | Purpose and visibility | What you can do |
|---|---|---|
| Real recipient email address | Used to sign in and receive forwarded messages. The service processes this address, and the email provider receiving forwarded messages also processes delivered emails. | Check which email address you're signed in with; sign out after using a shared device. Contact support to request access to or changes to account data. |
| Aliases and forwarding status | Links the address you share with your account and recipient inbox. Websites you give the alias to will know that address. | Create, copy, disable, restore, or delete aliases. |
| Forwarding records and status | Used to show the sender, subject, time, and delivery result. You can view these records in the relevant dashboard after signing in. | Filter records by status, open their details, and delete individual records or clear them all. |
| 30-day email archive | Provides recent message details and available attachments during the 30-day window. Messages may not remain accessible after that period. | Save anything you need in advance; delete unwanted records in the dashboard. |
Disabling an alias stops future messages to that alias from being forwarded, but doesn't recall emails already delivered to your real inbox. Deleting an alias and deleting existing archived messages are separate actions. To remove existing copies, check both the archive and your real inbox.
Go to long-term forwarding to access your account and view aliases and recent records. Don't use the 30-day archive as a legally required record or your only backup, and don't assume you can get the same address back after deleting an alias.
04 · What your browser stores
To avoid making you sign in every time you open the page or losing your current temporary inbox, the site stores necessary state locally in your browser. This state is not an offline backup of your email. Clearing browser storage may remove your way to access it, but it does not send a deletion request to the server.
- Account login credentials and sign-in email
- Used to identify your account, authorize dashboard requests, and show your sign-in status. They're stored in your browser's local storage. Signing out clears this account information saved on your device.
- Temporary inbox credentials and expiry information
- Used to restore your current temporary address and make inbox requests; these are stored separately from account login credentials. Signing out of long-term forwarding won't automatically destroy this temporary inbox.
- Identifier for the email you're currently reading
- An email identifier in session storage helps the page remember which message you're reading and prevents polling from switching away from it. This identifier is not the message content itself.
- Language selection
- The page's language is determined by its language path. Your browser's language settings or a language preference saved on your device may be used to choose the starting language; neither is account authentication information.
On a shared device, save anything you need, sign out, and then clear local site data if appropriate. If you no longer need a temporary inbox, delete it or change the address first. Simply closing the window may not clear local storage, and private browsing does not stop someone with valid credentials from accessing the associated resources.
Don't send credentials stored in your browser as support attachments. To return to long-term forwarding, use email verification code sign-in, rather than asking someone for or borrowing their login credentials.
05 · Security measures and third-party boundaries
Verification codes and optional two-step verification
Long-term forwarding uses email verification codes for sign-in, so you don't need to set a password for InboxCloak. Anyone who controls your real email account may be able to receive sign-in codes, so protect that account. Only enter a code on a sign-in page you opened on this site. Never share it with someone claiming they need to verify you on your behalf.
You can enable authenticator-based two-step verification in the dashboard. Scan the QR code with a mobile app such as Google Authenticator, Microsoft Authenticator, or 1Password, then enter the 6-digit code shown in the app to confirm. The setup key and QR code are security credentials. Before enabling the feature, securely save any recovery information you may need. Don't share screenshots publicly or with support staff.
We don't endorse email content
Sender names, subjects, and message content can be forged. Receiving an email doesn't mean its links, attachments, or payment requests are trustworthy. External images and links may include tracking parameters set by the sender. When an external resource loads, or you click a link or download and open an attachment, a third party may receive information about your network request or device.
Email senders, websites where you submit an address, your real email provider, and external pages you choose to visit each have their own data practices. Deleting something in InboxCloak can't control copies already held by these parties. Check the destination domain before leaving this site, and handle executable attachments with care.
Operational data and limits of our commitments
Providing an online service, preventing abuse, and troubleshooting may involve operational information such as IP addresses, request times, errors, and delivery status. Browser-stored credentials and this operational information should be understood separately. This page does not claim “no tracking,” nor does it guarantee an unverified data location, zero risk, or complete anonymity.
To ask about records involved in a specific request, applicable retention arrangements, or third-party processing, contact us at the email below with a clear question. Don't send message content or keys to prove you've encountered a problem. Start with the page path, approximate time, and an error description that contains no credentials.
06 · What happens when you delete something
First, distinguish between stopping future incoming mail, deleting existing content, and ending your sign-in on this device. These are separate goals, not one switch; taking one action won't automatically take care of the others.
- Delete one email: Delete the relevant record from the temporary inbox details or forwarding archive. This doesn't invalidate the address. You must separately handle downloaded files and copies already delivered to your real inbox.
- Destroy a temporary inbox: This action applies to the entire temporary inbox. Choosing “Change address” on the home page creates a new inbox and requests destruction of the old one. Save anything you need first; clearing your browser cache is not the same as destroying the inbox.
- Disable or delete an alias: Stops that alias from forwarding or removes its configuration. Existing forwarding archives and emails in your real inbox aren't automatically deleted.
- Sign out: Clears the account login credentials and email display state saved in this browser. It doesn't delete your account, aliases, archives, or separately stored temporary inbox credentials.
- Make a broader data request: To access, correct, or delete account-related data, or ask how a specific record was handled, contact support. Don't treat deleting one record as a substitute for a complete account data request.
Deletion generally affects the corresponding accessible record in the service. It can't recall copies saved by others or guarantee the immediate physical erasure of all operational logs or backups. Information that needs to be retained for security, dispute resolution, or applicable legal requirements must be assessed on a case-by-case basis; don't assume it disappears at the same time as the record in the interface.
Privacy requests
Tell us what you need—no secrets required
Tell us whether your request concerns a temporary inbox or long-term forwarding, what action you'd like us to take, and approximately when it happened. We may need to verify that you control the relevant account or resource. Don't send sign-in verification codes, access credentials, authenticator keys, or unnecessary email content.
Send privacy inquiries and access, correction, or deletion requests to support@inboxcloak.com. The scope and outcome depend on identity verification and the records available; this page does not promise an unverified completion time.
If this policy changes, we'll update this page and its effective date. Before using the service again, you can return here from the footer's “Privacy Policy” link to check for updates. Product use and restrictions are still governed by the Terms of Service.