Information we process
When you use Omailo, we process the temporary address, inbox identifier and access-token verification data, expiry time, incoming message headers and bodies, and any attachments sent to the address. Standard server records may include time, requested page, network address, browser information, response status, and security events.
If outgoing mail is enabled, we also store queued recipients, subjects, message text, sender and reply addresses, and sending status until the associated inbox is deleted. Developer keys are stored as hashes with their permissions, limits and usage metadata. The sending key entered in the compose dialog stays in memory and is cleared when the dialog closes. Delivery providers and recipients may retain their own copies of sent mail.
Information stored in your browser
Your inbox details are stored in browser session storage so the page can recover after a refresh without persisting them across a closed tab. A recovery copy is also placed in the URL fragment—the portion after #, which is not normally sent to the web server in an HTTP request. Clearing the inbox or its browser data removes the local copy.
Why we process it
We use this information to deliver and display requested messages, authenticate access, enforce expiry and resource limits, prevent abuse, diagnose failures, and protect Omailo and its infrastructure. We do not need you to create an account.
Retention and deletion
Inbox content is temporary. It becomes unavailable at the displayed expiry time and is scheduled for deletion from active storage. Short-lived operational and security logs may remain longer where needed to diagnose incidents, prevent abuse, comply with law, or maintain backups. Backup copies rotate and are not intended as a way to restore an expired inbox.
Sharing and service providers
Information may be processed by hosting, network, email-delivery, security, and infrastructure providers that help operate Omailo. We may disclose limited information when required by a valid legal process or when reasonably necessary to investigate serious abuse, protect rights and safety, or secure the service. We do not sell temporary inbox content.
Message privacy
A sender necessarily knows the address used. Anyone who obtains your private inbox link may be able to access messages until expiry. Remote images are blocked in Omailo's message viewer to reduce sender tracking, but no internet email service can promise absolute confidentiality.
Administrative inbox management
Administrators can change an inbox address or expiry, revoke its private access token, or delete its content. Administrative changes are recorded with the actor, inbox address and before/after expiry values. Private access tokens are not recorded in this change history.
Your choices
You can delete an active inbox immediately from the inbox page, clear Omailo data from your browser, or simply allow it to expire. Do not send personal or sensitive information to a temporary address when deletion timing or third-party mail routing would be unacceptable.
Contact
For privacy questions, email privacy@omailo.net. Include enough detail for us to understand the request, but do not email passwords, full identity documents, or sensitive message content.
Last updated: October 10, 2026