Temporary email privacy, honestly

What it genuinely protects

Your email address is the single most useful key for linking your activity across services. Data brokers and ad networks match on it, breach dumps are indexed by it, and a leaked list turns into targeted phishing precisely because the address is stable and identifying.

Handing a low-trust service an address you will abandon breaks that key. If the service is breached or sells its list, what leaks is an address with no history and no connection to your real identity — and, once the inbox is gone, no route to reach you at all.

What it does not protect

A temporary address is not encryption. Messages are stored in readable form because reading them is the entire feature. It is not anonymity either: the service you sign up with still sees whatever you type into its forms, your payment details, your IP address and your behaviour on its site.

It also does nothing about the content of what you receive. Phishing still arrives; the sandboxed renderer limits what a malicious HTML message can do to this page, but it cannot stop you from following a bad link.

• Never use a temporary inbox for banking, government or medical correspondence.
• Never use it for account recovery on anything you would be upset to lose.
• Never assume a deleted message is unrecoverable everywhere — the sender still has it.

Retention

Guest inboxes and their messages expire around two hours after creation. Inboxes belonging to a signed-in account persist until you delete them, as do their messages and attachments, because a permanent address that silently discarded mail would be worse than useless.

Deleting a message removes it from your inbox; deleting the inbox removes the address and its contents. Operational logs needed to run and secure the service are kept separately from message content and are not used to profile you.

Shared-domain reality

Addresses here sit on domains shared with other users. Usernames are unique, so nobody else can read your inbox, but the domain itself is public knowledge — which is exactly why some services reject it, and why you should never treat the address as secret.