Privacy policy

Who we are

Poofy ("Poofy", "we", "us") operates the website and temporary email service at poofy.email and the email domains it provides. For privacy questions, write to privacy@poofy.email.

The short version

• You don't create an account and we don't ask for your name, phone number or personal email address.
• Mail sent to your Poofy address is stored so you can read it. Message bodies are encrypted at rest.
• We keep your IP address and browser type for a short time to stop abuse and enforce rate limits.
• We use only essential cookies. No advertising and no cross-site tracking. Our own visitor statistics are cookieless and never run inside your inbox.
• Premium is bought with crypto and unlocked by a license key, not an account. We keep only what's needed to confirm and support your order.
• Anyone who has an inbox's password (or a share link to it) can read that inbox, so keep them private.

What we collect

Mail you receive. When someone sends email to a Poofy address, we store the sender, subject, a short preview, the message body and, where present, attachments. We automatically detect verification codes and sign-in links so we can show them to you. Message bodies and stored files are encrypted with AES-256 before they are written to disk.

Inbox credentials. Each inbox gets a random password. We store only a one-way hash of it (Argon2id), so we cannot see or recover your password.

Browser session. When you use Poofy we set a session cookie that remembers which inboxes this browser has opened. Alongside it we record the IP address, the country that address is in, the browser's user-agent string, and when the session was created and last used. Our team can see these to spot and stop abuse.

Security and abuse data. We record security-relevant events (for example inbox creation, failed logins, share-link creation) with a timestamp and IP address. We keep short-lived counters per IP address to limit how fast inboxes can be created or logins attempted.

Things you choose to create. Labels, alert rules and read-only share links you set up are stored with your inbox or browser session.

Website statistics. On our public pages (home, blog, pricing and similar) we run a self-hosted, privacy-friendly analytics tool. It sets no cookies and stores no IP address: it records the page, the referring site, the country, and the browser and device type, and counts a visitor using a daily-rotating hash that can't be traced back to you. It does not run inside inboxes, share links or the admin console, and no mail content is ever sent to it.

Premium purchases. If you buy Premium you pay on OxaPay's hosted page; we never see your wallet or card. We store an order record (a reference, the price, the payment status, the coin and transaction id OxaPay reports, and the time), and a one-way hash of your license key. We don't ask for your name or email. We keep order records as long as needed for support, refunds and bookkeeping.

API keys, webhooks and your own domains. If you use the API we store a one-way hash of each key (never the key), its label, scope, expiry and the IP addresses you allowed, and when it was last used. If you register a webhook we store its URL and an encrypted signing secret, and when mail arrives we send that URL the sender, subject, a short preview and any code or link (never the message body). If you connect your own domain we store its name, the DNS check results and who it belongs to (an account, not a person).

What we don't collect. We don't ask for your name, phone number, email address or any identity documents. We don't run advertising scripts or third-party trackers, and we don't buy data about you.

How we use it

• To deliver mail to your inbox and show it to you, including codes, links and alerts you set up.
• To keep the service secure: rate limiting, blocking abuse, detecting attacks, and investigating reports.
• To comply with the law and respond to valid legal requests.

We do not sell, rent or share your data for advertising, and we do not read your mail except where needed to investigate a specific abuse report or a legal obligation, or to fix a technical problem you asked us to look at.

Legal bases (EEA and UK visitors)

We process data because it is necessary to provide the service you asked for (performance of a contract), for our legitimate interests in keeping the service secure and free from abuse, and where required, to meet legal obligations.

Cookies and local storage

We use only what the service needs to work:

Name	Type	Purpose	Lifetime
poofy_sid	Cookie (essential)	Remembers which inboxes this browser has opened	Up to 30 days, renewed on use
Inbox keyring	Browser local storage	Keeps your inbox addresses and passwords on your device so you can reopen them	Until you clear it or press "Forget this browser"
Theme	Browser local storage	Remembers light or dark mode	Until you clear it

Because these are strictly necessary, we don't show a cookie banner. Remote images inside emails are blocked by default, so senders can't track when you open a message unless you choose "Load images".

How long we keep data

• Messages stay until you delete them, the inbox's retention period ends, or the inbox runs out of space (the oldest messages are then removed automatically and permanently).
• Deleted inboxes and messages disappear for you at once, and share links to a deleted inbox stop working. So that an accidental delete can be undone, we keep a copy that only the Poofy team can see and restore, until you ask us to erase it permanently. Premium owners can restore or permanently erase their own deleted inboxes themselves under "Recently deleted". Everyone else can email privacy@poofy.email with the inbox address and we will erase it for good.
• Browser sessions expire after 30 days of inactivity and are deleted about a week later.
• Rate-limit counters are deleted within two days.
• Security logs are kept as long as needed to protect the service and investigate abuse.
• Encrypted backups are kept for up to 14 days, after which deleted data is gone from backups too.

Who else processes data

We use a small number of infrastructure providers, bound by their own data protection terms:

• Cloudflare — content delivery, DDoS protection, DNS, and forwarding of mail sent to our contact addresses.
• Hetzner — server hosting in the European Union.
• OxaPay — processes Premium payments in cryptocurrency on its own hosted page, under its own privacy policy.

We don't use any other third parties to process your data. Email you receive naturally involves the sender's own mail systems before it reaches us.

Sharing and disclosure

We share data only when:

• you create a read-only share link (anyone with the link can read that inbox until you revoke it);
• the law requires it, for example a valid court order, and then only what is required;
• it is necessary to prevent serious harm, fraud or abuse of the service.

Security

Mail is encrypted at rest, inboxes are isolated from each other at the database level, email HTML is sanitized and shown in a sandbox, attachments are scanned and risky files are blocked, and all traffic uses HTTPS. No system is perfectly secure, so please don't use a temporary inbox for accounts that hold money, health data or anything you can't afford to lose.

Your choices and rights

• Delete any message or whole inbox, remove an inbox from your browser, or press Forget this browser to end your session on our side. Deleted items are hidden from you immediately and recoverable by us until you ask for permanent erasure (see above).
• Access, correction or deletion requests: email privacy@poofy.email with the inbox address and, where possible, proof you control it (for example the inbox password or a message it received). Because there are no accounts, we can't verify requests any other way.
• Depending on where you live (for example under the GDPR or the California Consumer Privacy Act), you may have rights to access, delete, correct, restrict or object to processing, and to complain to your data protection authority. We don't sell or "share" personal information as defined by the CCPA.

Children

Poofy is not intended for children under 16, and we don't knowingly collect data from them.

International transfers

Our servers are in the European Union. Our infrastructure providers may process data in other countries under appropriate safeguards such as the EU Standard Contractual Clauses.

Changes

If we change this policy we'll update the date at the top of this page. Significant changes will be highlighted on the site.

Contact

Privacy questions: privacy@poofy.email. Abuse reports: abuse@poofy.email.