Two clocks, then the mail is gone.

The default on this system is 3,600 seconds to receive and 3,600 seconds to keep a message. An operator can change those values. The inbox screen shows the time you have left, which is the number to trust for that address. If the mail you are waiting for is slow, the window can close before it arrives. That is a reason to use a longer plan, not a reason we restore the message later.

Delete revokes the session’s access at once. Message objects, extracted codes, and grants are queued for purge. We do not keep a spare copy so you can ask for the mail back the next day.

After purge, the address is not handed out again. We store a keyed hash of the address for that rule. The hash is not the message, and it is not a public lookup of who used the inbox.

• The account email, password hash or Google subject, and plan stay while the account is open.
• A recovery secret, if you saved it, can reopen an inbox only while that inbox still exists.
• Stripe invoice and subscription records stay as long as tax and accounting rules require. They do not include the body of your temporary mail.
• An abuse or security report is kept while we investigate it, then removed when the matter is closed, unless a law tells us to keep it longer.
• If a lawful request arrives before a message expires, we may hold that message past the normal clock for the request, and only for that request.

To close an account, write to support@mailby.app from the account email. We delete the account data we are not required to keep. Inbox content that already expired is already gone.

Some disposable services leave every message readable by anyone who knows or guesses the name, and their policies disagree with each other about whether mail lasts an hour or several years. Mailby does not work that way. The address receives. The session reads. The clock deletes. The privacy page and the terms use the same clocks as this page.