Acceptable use
A throwaway address is not a permit.
You may use Mailby to catch a signup or a code, or to test mail you are allowed to receive. You may not use it to harm someone, to hide a crime, or to send mail.
Phishing and fraud
Pages, codes, or messages meant to steal a login, a payment card, or someone’s identity.
Malware
Links or files that install malware, or using an inbox as a drop for stolen data.
Harassment
Threats, stalking, or signing someone else up for a flood of mail they did not ask for.
Child sexual abuse
Any sexual content involving a minor. We report it and we preserve what the law requires.
Relay and sending
Trying to turn the MX into an open relay, scanning for SMTP login, or spoofing mail from our domains.
Attacks on Mailby
Breaking rate limits on purpose, scraping inboxes you do not hold, or probing for another person’s mail.
Allowed
Ordinary use
Opening an inbox, pasting the address into a form, reading a code, and deleting the inbox is the use we built. A developer may create inboxes from the API to test mail their own app sends. You still have to follow the other site’s rules. Some sites block temporary domains. We do not bypass those blocks.
Not yours
Mail you had no right to receive
Do not point someone else’s private correspondence at a Mailby address, and do not use an inbox to collect data you are not allowed to hold. If a message arrives that you should not have, delete the inbox and, if someone is at risk, tell us at abuse@mailby.app.
Enforcement
What we may do
We may drop the connection, delete the inbox, revoke a key, disable an account, and refuse new inboxes from the same pattern. We may keep a narrow record past the normal retention clock while an investigation is open, including when the law requires us to preserve it. We do not need your permission to stop abuse that is already underway.
These rules sit under the terms. Breaking them is a breach of the contract, and it can also be a crime that these pages do not shield you from.