Privacy Policy

• We store the messages sent to your disposable address so we can show them to you.
• Those messages are permanently deleted 7 days after they arrive.
• Your mailbox name is stored on your own device. We never ask for your name, your real email address or any other detail about you.
• We do not sell, rent or transfer your data to anyone.
• A disposable mailbox is not private. Anyone who knows or guesses the name can read it.

A DropMails mailbox is protected by nothing but its name. There is no password and no login, which is what makes it instant to use, and it means any person who knows or guesses your mailbox name can read every message in it. Short or predictable names are especially easy to guess.

Treat every message that arrives as public. Do not use DropMails for password resets, banking, medical or government correspondence, work or confidential material, or anything else you would mind a stranger reading. Use a real mailbox for those.

Messages sent to your disposable address

When an email arrives at an address ending in @dropmails.org, we store the mailbox name it was sent to, the sender address, the subject line, the full message content and the time it arrived. This is the service: we cannot show you your mail without holding it. Anything a sender chooses to put in a message is stored along with it, so what ends up in our database is determined by whoever writes to you, not by us.

Your mailbox name

The website keeps your mailbox name in the page address. The extension saves a single value on your device using the browser storage API: the name of your current mailbox, for example k3p9w2xq. That is what lets the same inbox be waiting the next time you open it, instead of a new one each time. The name is sent to our server each time we fetch your mail, because it is how the server knows which mailbox to return. Nothing else is stored on your device, and no other storage is used.

IP address, for abuse protection only

Our server limits how many times a single internet connection can request mail each minute, which stops the service being scraped or overwhelmed. Doing that requires recognising your connection, so your IP address is passed to our hosting provider’s rate limiter as it happens. We do not write your IP address into our database and we do not use it to build a profile of you or link it to a mailbox.

Standard server logs

Our hosting provider records ordinary request logs for reliability, security and debugging, in the way any web server does. We use these only to keep the service running and to investigate abuse.

We never ask for and never collect your name, your real email address, your phone number, your location, payment details or any account credentials. We do not use cookies, we do not run analytics or advertising scripts, and we do not fingerprint your device.

The extension in particular does not collect your browsing history, the addresses of pages you visit, the contents of pages you visit, anything you type, or any data from any form. It registers one right-click menu item, “Fill with temp address”, which appears only on editable fields. When you choose it, the extension writes your disposable address into the field you right-clicked, in that tab only, at that moment only. It reads nothing back from the page, runs no code when pages load, and contacts no website other than our own mail server.

Stored messages are used for exactly one thing: displaying them back to you in the inbox you opened. Your mailbox name is used to route and retrieve the right mail. IP addresses and server logs are used only to rate limit, secure, debug and keep the service available.

We do not use any of it for advertising or personalised advertising, we do not use it to assess creditworthiness or for lending purposes, and we do not use it to build profiles of users. No human at DropMails reads your messages as a matter of course; we would access message content only where necessary to investigate abuse or a security problem, or where the law requires it.

We do not sell, rent, trade or transfer your data to any third party for their own purposes, and we do not share it with data brokers, advertising networks or information resellers.

One infrastructure provider processes data on our behalf, because the service runs on them:

• Cloudflare, Inc. — receives the incoming email for @dropmails.org, hosts our server and database, applies the rate limiting described above, and keeps the request logs. See the Cloudflare Privacy Policy.

Beyond that, we may disclose information if we are legally required to, or where it is necessary to protect the service against fraud, abuse, spam or security threats.

• Messages: 7 days. An automated job runs every hour and permanently deletes every message older than 168 hours from our database. This happens whether or not you ever opened them.
• In the inbox view: the 50 most recent messages for a mailbox are shown.
• Your mailbox name: kept on your own device until you change it, clear your browser data, or uninstall the extension. Removing the extension removes it.
• Rate limiting data: transient, and expires within minutes.
• Server logs: kept briefly by our hosting provider under their retention schedule, then discarded.

You can switch to a different mailbox at any time by typing a new name, which immediately stops you using the old one. You can clear the stored mailbox name by uninstalling the extension or clearing your browser data. Every message deletes itself within 7 days without you doing anything.

If you want a specific mailbox or message deleted sooner, email us at ayush@007qr.dev with the mailbox name and we will remove it. Because mailboxes are not tied to any identity, we cannot verify who owns one, and anyone can ask for any mailbox to be cleared.

All traffic between your browser and our server uses HTTPS. Message content is rendered inside a sandboxed frame with no access to the extension or to your browser, and remote scripts in email are not executed. The extension ships all of its code in the package and downloads no code at runtime.

That said, please re-read “Mailboxes are public by design” above. The main risk to your data here is not interception; it is that a disposable mailbox has no lock on it.

DropMails is not directed at children under 13, and we do not knowingly collect personal information from them.

Our collection and use of information received from the DropMails extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically:

• We limit our use of the data to providing and improving the extension’s single purpose, which is providing disposable email addresses and displaying the messages they receive.
• We do not transfer the data to third parties, except as necessary to provide or improve that single purpose, to comply with applicable law, or to protect against malware, spam, phishing, fraud or abuse.
• We do not use or transfer the data for serving advertisements, including personalised or retargeted advertising.
• We do not sell the data, and we do not transfer it to data brokers or other information resellers.
• We do not use or transfer the data to determine creditworthiness or for lending purposes.
• We do not allow humans to read the data, except with your explicit consent for specific messages, where necessary for security purposes such as investigating abuse, where the data has been aggregated and anonymised, or to comply with applicable law.

If our data practices change, we will update this page and move the date at the top. The current version is always available at dropmails.org/privacy.

Questions about this policy, or about data in a particular mailbox, can go to ayush@007qr.dev.