Valid for three hours by default; deletion begins after expiry or when you change the address.
Privacy boundaries · Effective August 19, 2026Collect less,
Collect less,
keep it only as long as needed
This policy explains how MsgMask handles information when providing temporary inboxes, email forwarding aliases, and support. It also explains the limits of the anonymity we can offer and how to submit a data rights request.
Account email records are kept for up to 30 days for viewing and troubleshooting.
We do not build our business around selling personal information or creating advertising profiles.
Send access, correction, or deletion requests to support@msgmask.com.
1. Scope and Our Role
This policy applies to the public website at msgmask.com, temporary inboxes, and the forwarding dashboard available after login. How other websites handle forms and account data when you submit a MsgMask address is governed by their own policies.
We control the operational data for this service. When a sender delivers content to an address you created, we process that content only to receive, display, or forward it. Do not use the service to collect communications you are not authorized to receive.
2. Information Handled by Temporary Email
When you create a temporary inbox, the system generates a random address, an access token, and creation and expiry times. When an email arrives, we process the sender, recipient, subject, body, attachment metadata, and delivery time so it can be displayed in the current inbox.
The temporary tool does not require your name, primary email address, or password. The access token is stored in your current browser. Clearing site storage or sharing the device may make you lose access and may let another device user see the emails.
3. Information Handled by Forwarding Accounts
When you use forwarding, we process your login email, verification results, account security status, aliases, destination addresses, and forwarding records. If you enable two-step verification, we also process the TOTP secret and verification results, but we never ask for your authenticator account password.
Archives may contain email bodies, delivery status, attachment names, and sizes. They help you trace senders and forwarding results; they are not used to train advertising profiles.
4. Technical and Support Data
To prevent abuse and maintain reliability, servers may log request times, IP addresses, user agents, API results, and security events. We use these records to investigate attacks, unusual rate-limit activity, and outages; we do not use them to claim that visitors cannot be tracked.
When you contact support, we process the email address, issue description, and necessary diagnostic information you choose to provide. Do not send complete verification codes, account passwords, or unrelated private message content in support emails.
5. Processing Purposes and Legal Bases
We process inbox creation, receipt, forwarding, login, and account actions to provide services you request. Based on legitimate interests, we monitor security, prevent abuse, troubleshoot faults, and plan capacity while limiting the scope and retention of data.
Where the law requires consent, we send optional communications only after obtaining it and provide a way to withdraw consent. Withdrawal does not affect earlier lawful processing or transactional notices needed to complete a request you initiated.
6. Retention and Deletion
Different information has different retention windows based on its purpose; we do not keep data indefinitely because it might be useful later. Deletion may pass through a short technical queue, and restricted backups are overwritten on a rotation schedule. During that period, they are not used except for routine recovery.
| Data category | Typical period | After the period ends | Boundary |
|---|---|---|---|
| Temporary addresses and email | 3 hours by default | Deleted after expiry or when the address is changed | Not for long-term account recovery |
| Forwarding email archive | Up to 30 days | Rolling deletion | Copies in the destination mailbox are managed by its provider |
| Accounts and aliases | While the account exists | Cleared after a deletion request is completed | Legal obligations may require limited retention |
| Security logs | Shortest period necessary | Aggregated or deleted | Major incidents may require a lawful extension |
| Support correspondence | As long as needed to resolve the issue | Cleared on the ticket cycle | You may request early deletion of nonessential content |
8. International Data Processing
Internet infrastructure and service providers may be located outside your country or region. When processing occurs across borders, we use applicable contractual safeguards, access controls, and data-minimization measures.
Privacy rights vary by location, but you can always use the contact details on this page to ask where data is handled and what safeguards apply. We will explain the available procedure based on your request location and account relationship.
9. Access, Correction, Deletion, and Objection
You may ask whether we process information about you and, where applicable law allows, request a copy, correction, deletion, restriction, or objection to processing. To prevent impersonation, we may ask you to verify control of the relevant email address or account.
Requests should normally be sent to support@msgmask.com. Please say whether they concern a temporary tool or a forwarding account. If a temporary inbox has expired and been deleted, we may no longer have data that can be retrieved.
10. Children’s Privacy
The service is not intended for children below the local age of digital consent, and we do not knowingly ask children to provide personal information. If a guardian believes a child submitted information by mistake, they can contact us with limited details sufficient to locate the data.
We will first protect the privacy of both parties to the request, then assess the scope of deletion. Do not use temporary email for important, long-term records involving school, healthcare, or guardianship.
11. Security Measures and Responsibility Boundaries
We use measures such as encryption in transit, access controls, token isolation, rate limiting, and log reviews to reduce risk, but no system can guarantee absolute security. A temporary address is not a password; anyone with the address and valid access credentials may be able to read its contents.
You should protect your device, browser storage, and forwarding account, and use a unique password and two-step verification for important accounts. MsgMask reduces exposure of your real email address, but cannot hide your IP address, payment details, device fingerprint, or information held by senders.
12. Cookies and Local Storage
We use necessary browser storage to save temporary inbox access credentials, forwarding login tokens, and authentication cooldown status. Without this data, refreshing the page may prevent you from continuing the same session.
This site does not require cross-site tracking cookies for advertising profiles. The deployment environment may provide aggregated operational metrics, which should be handled according to data-minimization and access-limitation principles.
13. Automated Decisions and Abuse Prevention
The system may automatically rate-limit or block actions based on request frequency, unusual patterns, and known attack signatures. These measures protect delivery and other users; they do not make credit, employment, or similarly significant legal decisions about you.
If normal use is blocked by mistake, contact support with the time, action type, and error message. Do not send a password or complete verification code as proof.
14. Contact, Complaints, and Policy Updates
Send privacy questions and rights requests to support@msgmask.com. We will confirm the request, explain the verification steps, and respond within the applicable time limit. You may also complain to your local supervisory authority.
When the service or legal requirements change, we will update this policy and its effective date. We will highlight significant changes in a reasonable way; before continuing to use the service, review changes involving retention periods or processing purposes.