Privacy Policy

This policy describes information handled by TempGenerator when you use the website. A temporary inbox is intended for short-lived, low-sensitivity tasks. Do not use it for banking, health information, password recovery, confidential correspondence, or anything you need to keep.

About TempGenerator and privacy contact

TempGenerator is the name under which this website and its tools are provided. In this policy, “we” and “our” refer to the operator of TempGenerator.

Contact TempGenerator about your personal data through our privacy request form. The form opens with “Privacy request” selected as the subject and sends your request to the site's administration. You can use it to ask about access, correction, deletion, or other privacy rights. Provide only the information needed to locate your account or request, never a password, access token, or private message content.

Information you provide

If you contact us, we receive the name, email address, subject, and message you submit. The site stores that message so it can be reviewed and answered. Once your message has been handled, it is deleted automatically 12 months later. An administrator can also delete it sooner. Please do not include passwords or sensitive personal information.

When you use an inbox, the mail service processes the temporary address and incoming message data, which can include sender details, message text, and attachments. This browser’s local storage keeps the current inbox reference and a short list of recent live random inbox references (address, inbox ID, and expiry time), but no messages, so you can reopen them while they last. For a chosen email name it also records that the address is a custom one and your account’s numeric ID, so only your signed-in account reopens it; signing out removes that reference. Anyone who can access that inbox may be able to read its messages. Address expiry and automated cleanup are intended for short-term use; records may remain until cleanup runs, so do not treat the inbox as a secure archive or rely on a particular message being recoverable.

Optional accounts and custom addresses

A random temporary inbox can be used without an account. If you register to choose an email name, we store your username, permanent email address, password hash, language preference, and confirmation status. We also keep a normalized version of your registration email to prevent duplicate accounts using equivalent Gmail aliases. Your password is hashed; it is not stored as readable text.

Custom address reservations connect a chosen name to your account. On the website, a chosen name’s inbox messages still expire under the normal cleanup rules. A name reservation remains after its inbox expires so another account cannot claim that name. If an account is removed, the name can remain reserved without its account reference to prevent reuse. Account records do not have an automatic deletion period. You can delete your account yourself on your account page by entering your password and typing your username, or in the Temp Mail app. Deletion removes your account details, your custom inboxes and their messages on the website and in the app, your sign-ins on the Temp Mail app, your API keys, developer inboxes and test sessions, and queues your collections and their files for cleanup. It cannot be undone. You can also contact us about account information using the contact page.

Email codes. To confirm your email address or reset your password, we email you a one-time 6-digit code. We store only a one-way hash of the code, never the code itself. It works once, for 15 minutes, and is deleted when it is used, replaced or has expired. After 5 wrong tries a new code is needed. If someone tries to create an account with an email address that already has one, that address receives a short notice instead of a code.

Sign-ins on the Temp Mail app. When you sign in to the Temp Mail app, that phone gets its own sign-in key. Our server keeps only a one-way hash of it, linked to the phone’s random device record and the time it was last used. It is deleted when you sign out, reset your password, sign the phone out on your account page, erase the phone’s data, delete your account, or after 180 days without use.

Names are never given out twice. So that nobody can ever receive mail meant for someone else, such as a password reset, we keep a permanent list of every address name that has been used, random or chosen, on the website or in the app. It holds only the name, the domain, where it came from and when it was first and last used. A name in this list is never given to a second person; only the account that reserved a name can use it again.

Addresses chosen in the Temp Mail app. Mail sent to an address you chose in the app stays until that address ends, up to its newest 100 messages, and is then deleted with the address. Such an address opens only in the app, on one phone signed in to your account (or, for a name chosen without an account, on the phone that made it).

Account confirmation codes, password reset codes and account notices are sent from our own mail server, from an address on tempgenerator.com. No email delivery service receives your address or the code: our server hands the message directly to the mail server of your email address. These operational emails do not subscribe you to a newsletter. Never share a code or your password; TempGenerator will never ask you for them.

Sharing, Collections, and developer tools

Share processes the text, files, filenames, and transfer status you send through a paired session. It stores files on our server so the paired browser can download them; it is not an end-to-end encrypted transfer service. The session normally lasts 15 minutes and can be extended up to 60 minutes from creation. Ending or expiring a session retires access and triggers cleanup. Small session records can remain for about a day after the session ends, and failed file deletions are retried.

Collections associates uploaded files and incoming email attachments with the collection owner. It processes filenames, file contents, sender details, and upload or delivery metadata. Collections last up to 60 minutes, bounded by the associated inbox expiry. An upload link lets other people contribute; an owner-created download link lets its holder access the files it covers. Only share those links with intended recipients. Expired or deleted collections and their files are removed by cleanup.

Developer Mail and Test Sessions process temporary mail, request or webhook data, and the access credentials needed for the requested integration. Developer inboxes last up to 60 minutes for members and 10 minutes for anonymous trials. A Test Session lasts up to 30 minutes, subject to its inbox expiry. Ending a Test Session removes event content and retires its mailbox; limited quota or pending-cleanup records can remain until cleanup completes. Account API credentials persist until revoked or expired. Connecting an external API or MCP client lets that client access the data allowed by the credential you give it, under that client's own privacy practices.

The password generator, username generator, random picker, and synthetic test-data generator perform their generation in your browser. Saving username favourites stores them in that browser. The address generator requests location choices and generated address data from our server. Do not enter real confidential information into example or test data.

Technical information

The web server and hosting providers process technical request data needed to deliver pages, protect the service, and diagnose problems. This can include an IP address, browser information, requested page, referring page, and request time. Rate limits use request or account information to prevent abuse. Public fonts and icons are served from this website.

Our hosting infrastructure is provided by Contabo. The emails we send, such as account codes and replies to your messages, go out from our own mail server on that infrastructure, from addresses on tempgenerator.com; we do not use an email delivery service. Google processes advertising and consent information when its services load. These providers may process information in countries other than your own; the locations and transfer arrangements depend on the provider and service. See Contabo’s privacy information and Google’s privacy policy. You can ask us for information about the providers used for your request.

Cookies, browser storage, and advertising choices

Cookies and browser storage have different purposes:

• Service and security: session and CSRF cookies support sign-in, forms, and protection against forged requests. Their current configured lifetime is 120 minutes, renewed through use. The current temporary inbox reference (its ID, address, and expiry, plus your account’s numeric ID for a chosen email name, but no messages) is kept in this browser’s local storage so the inbox reopens when you come back, until it expires, is deleted, or, for a chosen name, you sign out. If local storage is unavailable, it is kept in session storage for the current tab only. The recent random-inbox list requires local storage and is unavailable when that storage is blocked. Forgetting a recent inbox removes its local reference without deleting its server messages. Clearing site data or closing a private window removes saved references, and anyone using the same browser profile can reopen the saved inboxes while they last, so delete them before leaving a shared computer. Share references are kept in session storage for the current tab. Rate-limit information supports the service’s cooldown.
• Preferences: language, theme, saved username favourites, and Share notification preferences can be stored in your browser. The language cookie can last up to one year; local-storage preferences remain until cleared or changed. Browser notification permission is optional.
• Advertising and consent: Google’s consent service records applicable choices. Advertising cookies or similar identifiers may be used on eligible article pages when permitted by those choices and applicable rules.

You can clear cookies and site storage in your browser. Doing so can sign you out and remove access to a temporary inbox or Share session; it does not delete server records or undo a recipient’s downloaded copy. Refusing optional advertising consent does not prevent use of the inbox or tools.

TempGenerator uses Google AdSense for advertising on editorial article pages. The inbox, message-reading interface, contact pages, and sign-in screens do not load the AdSense advertising tag. When the tag loads on an eligible article, Google may receive technical request information such as your IP address, browser details, and the page requested. Third-party vendors, including Google, may use cookies to serve ads based on a visitor’s previous visits to this website or other websites. Google’s advertising cookies allow Google and its partners to serve personalized ads based on visits here and elsewhere on the Internet, where permitted by your consent and applicable rules. Cookies and similar technologies can also support ad delivery and measurement. See how Google uses information from sites that use its services.

A European regulations consent message is published through Google’s certified consent platform for visitors in the European Economic Area, the United Kingdom, and Switzerland. Where shown, you can choose “Consent”, “Do not consent”, or “Manage options”, including choices about listed partners and purposes. On an article page, the “Privacy choices” control in the footer becomes available when Google’s consent interface is ready; use it to reopen the message and change your choice. If this page shows a link to these instructions instead of a consent button, open our email privacy guide and use “Privacy choices” in its footer once Google’s interface is ready. A browser content blocker or an unavailable Google service may prevent the interface from loading. The consent message’s partner list provides information about participating advertising providers and their privacy policies. You can also opt out of personalized Google advertising in My Ad Center, or visit AboutAds choices for participating vendors. These controls do not necessarily stop all advertising.

How information is used

Information is used to provide inbox and contact features, respond to requests, maintain security, and keep the website working. We do not ask you to use a temporary address to bypass another service’s eligibility, payment, or verification rules.

European privacy rights

Where European data-protection law applies, the purposes above include providing the service you request, our legitimate interests in securing and maintaining the service and answering enquiries, and consent for optional advertising data uses that require it. You may object to processing based on legitimate interests. You may withdraw consent through the advertising controls without affecting processing that was lawful before withdrawal.

Depending on the law and the circumstances, you can request access to your personal data, correction, deletion, restriction of processing, or a portable copy, and object to certain uses. Use the contact form for these requests. We may need proportionate information to verify ownership; do not send identity documents unless a necessary, appropriate verification method has been agreed. You may also complain to your local data-protection authority, including an EEA supervisory authority or the UK Information Commissioner. These rights can be subject to legal exceptions.

Retention and your choices

Handled contact messages are deleted automatically 12 months after they are handled. Temporary inbox content is subject to address expiry and the service’s cleanup settings, so its exact availability can vary. Expiry stops normal access; cleanup timing and failed deletion retries can delay physical erasure. Restricted operational backups and logs may outlive the active record. Downloaded copies held by recipients are outside our cleanup controls. You can avoid submitting personal information that is not needed for your task.

For a question about information you submitted, use the contact page. We may need enough detail to identify the relevant request. Do not send passwords or the contents of sensitive messages.

Changes to this policy

This page will be updated when the site’s data practices materially change. Check the date at the top for the latest revision.