tmailrPrivacy
What a mail service should tell you it stores
8 July 2026 · 2 min read · TMailr
Any service handling your mail should be able to answer two questions without hedging: what is kept, and for how long. Here are ours, and the reasoning, because the reasoning is what tells you whether the answer will still be true next year.
What is kept for a message
- The original file, exactly as it arrived, in object storage under a key nobody can guess.
- Who it was from and who it was to, taken from the envelope and the headers.
- The subject, and the time it arrived.
- What our server concluded about SPF, DKIM and DMARC.
- The IP address of the server that connected to deliver it.
That last one is the sending server, not you. It is kept because it is the only way to answer why did this land in spam, and because it is what abuse handling runs on.
What is kept about you
A hashed form of the IP address that created an inbox, so repeated abuse from one source can be stopped without holding anyone’s address in the clear. A hash is not anonymous against a determined attacker with a list of every IPv4 address, and it is meaningfully better than the alternative, which is a column full of addresses.
No account, no name, no password, because a guest inbox has none of those. The secret in the link is the only credential, and we store a hash of it rather than the token itself, so a copy of the database does not open anybody’s inbox.
How long
A guest inbox lives one hour by default and can be extended to twenty-four. When it expires, or you delete it, the stored files and the database rows are removed within a few minutes.
The delay is deliberate and small: a short grace so a tab left open shows expired rather than a blank error. After that the deletion is real. The object goes first, then the row, so a failure at the storage end leaves the row behind and the next sweep tries again rather than losing track of a file nobody can account for.
What is kept longer
Counters and events, with no message content in them: how many inboxes were created in an hour, how many messages a domain sent, when a purge ran and how much it removed. These are what abuse controls and capacity planning run on, and none of them can be turned back into a message or an address.
The limit worth stating
Mail arrives over the public internet. We require modern transport security where the sender supports it and encrypt what we store, and a message is still not end-to-end encrypted just because it is held carefully. Anything you would mind a service operator being able to read should not go through a disposable inbox, ours or anybody else’s.
More on privacy
