Privacy Policy

• Free tier: a randomly generated address, an access token in your browser, and the IP we saw the request from (used only for rate-limiting). All three are deleted automatically after 12 hours.
• Pro tier: your email address, a bcrypt hash of your password, the addresses you create, the emails you receive at those addresses, and your USDC payment transaction hash.
• Telegram: if you use the bot, your Telegram chat ID is stored and linked to your account so we can DM you new mail.
• Forwarding: if you opt in to forwarding, the real email address you give us is stored and used to relay mail via Cloudflare Email Routing. We never read or analyze the forwarded mail.

• No name, phone, address, or government ID.
• No credit card data — we accept USDC on-chain only.
• No third-party tracking pixels, no advertising scripts.
• No cross-site cookies. The only cookies we set are the session cookie (to keep you signed in) and a short-lived helper cookie that survives the upgrade flow.

Everything sits on a single VPS we operate ourselves (Hostinger, Frankfurt). The website is hosted on Vercel as a stateless renderer and never touches the database directly from the browser. Inbound mail flows through Cloudflare Email Routing, then is forwarded to our VPS via a Cloudflare Worker. Outbound forwarding (when enabled) goes back through Cloudflare Email Routing to the address you specify.

Email hi@burnermails.xyz and we will delete your account, every address you own, and every email we hold for you within 24 hours, no questions asked. There is no “deletion form” or three-step recovery process. Just email us.

If we update this policy materially, we'll change the date at the top and post a banner on the homepage for at least seven days. We will not silently broaden what we collect.