What Does a Temp Mail Service Know About You?

What any temp mail service can technically see

To receive email on your behalf, a temp mail service must control the domain, run a mail server, and store incoming messages. This means every temp mail service can see:

• Your IP address when you access the service
• The email address you were assigned or chose
• Every email that arrives at that address (sender, subject, content)
• Timestamps of when you accessed the inbox and when emails arrived

What TempMailGrab collects

TempMailGrab is built on Cloudflare Workers and D1. Here is what is actually stored:

• Email address: stored in D1 with an expiry timestamp. Deleted when the inbox expires (automatic, server-side).
• Incoming emails: stored in D1 (metadata and parsed body) and R2 (raw MIME). Both are deleted with the inbox.
• IP addresses: TempMailGrab's application code does not write IPs to the database. Cloudflare's own access logs may retain IPs per their data processing agreements.
• Session cookies: an HMAC-signed anonymous session cookie is set on first visit. It links your inboxes to your browser session without identifying you.

There is no account creation required, no email address collected from users, and no analytics trackers (Google Analytics, Facebook Pixel) in the page bundle.

How to evaluate any temp mail service

1. Is there a privacy policy that specifies what is and is not logged?
2. Is the codebase open source so logging claims can be verified?
3. Where are servers located? What jurisdiction's law applies?
4. What happens when a legal request is made?
5. What analytics and tracking scripts are included in the page bundle?

The strongest privacy posture is a service that has as little data as possible — not just a service that promises not to share what it has.