Privacy Policy

Tmail.pk collects the minimum information necessary to operate the service:

• IP addresses — used for rate limiting and abuse prevention. Not stored permanently beyond what abuse-detection logs require.
• Inbox address and password — the address you generate and a one-way password verifier used to authenticate access. For newly created or reset passwords, an authenticated encrypted recovery envelope may also be stored as described below.
• Received email content — messages delivered to your address, stored while the mailbox is active.

We do not ask for your name, phone number, date of birth, payment details, or any other personal identifier. Guest inboxes require no account registration.

Mailbox passwords are never stored as plaintext in the database. Authentication uses a one-way bcrypt hash. Newly created and reset mailbox credentials can also include an AES-256-GCM encrypted recovery envelope, authenticated against that hash. Older records may contain only the bcrypt hash and cannot be reversed.

Access to recovery envelopes is restricted to authorized operators and used only when necessary for support or password reset. If no usable recovery envelope exists, the password cannot be revealed and must be reset. Encryption reduces exposure at rest, but a temporary inbox remains explicitly unsuitable for sensitive accounts — banking, health, government, or anything that matters long-term. Use a real, private email provider and a password manager for those. Tmail.pk inboxes are designed for low-sensitivity receiving where the provider accepts temporary addresses. No credential should be treated as risk-free, so use a unique password and never reuse an important one.

There is no user-facing "forgot password" flow for a guest inbox. Keep your credentials safe and never reuse an important password.

To be explicit about what Tmail.pk does not do:

• We do not sell, trade, or transfer your data to outside parties.
• We never use inbox addresses, inbox passwords, or received email content for advertising.
• We do not build a cross-site profile of your activity.
• We do not use your inbox content to train AI models or for commercial purposes.
• We do not require or collect payment information.

We use the data we collect strictly to:

• Operate and maintain the disposable email service.
• Prevent abuse, spam, and platform misuse.
• Improve product reliability and user experience.
• Respond to valid legal requests under applicable law.

We use a first-party session cookie to keep you signed in to your mailbox. Without it, logging back into a saved inbox would not work between page loads.

For traffic measurement we rely on privacy-friendly, cookieless analytics that count visits in aggregate without profiling you or following you across other sites. We do not use social-media pixels or build cross-site profiles from mailbox activity.

Tmail.pk publishes an AdSense publisher-verification meta tag and ads.txt record so Google can verify site ownership without loading advertising code on the homepage. There are currently no ad units or calls that request ads. If advertising is enabled later, Google may use cookies, device identifiers, or similar technologies as described in Google's own privacy policies.

If advertising is enabled in the future, it may appear only on selected, substantial public editorial pages that pass our content-quality checks. We will not place ads in inboxes, message readers, sign-in or authentication flows, account areas, admin pages, or any other page where a user handles messages or credentials. Inbox addresses, passwords, authentication data, and message content are never used to select or personalize advertising.

For visitors in the EEA, United Kingdom, and Switzerland, any advertising that requires consent will be controlled through a Google-certified consent management platform (CMP). It will collect and communicate the legally required advertising choices before ads or consent-dependent advertising cookies are used. Tmail.pk does not treat first-party interface controls as a substitute for that certified CMP.

Tmail.pk keeps your mailbox and every message for as long as the mailbox stays active. Save your email address and password to log back in anytime and access your full inbox. A mailbox stays active as long as you log in at least once within a 30-day window, or it receives at least one new message. Mailboxes that are never used — no logins and no mail for 30 days — are automatically removed. Registered accounts and their inboxes are kept permanently.

Messages themselves are not purged on a short time limit shorter than the mailbox retention window. The inbox displays the 100 most recent messages.

Tmail.pk is hosted on Vercel (edge network and serverless functions), uses Supabase for inbox data storage, and sits behind Cloudflare for DDoS protection and DNS. These providers process data on our behalf and have their own privacy policies. Data may be processed on servers outside Pakistan.

We select providers that take privacy seriously, but we cannot guarantee the same practices apply universally across their infrastructure.

Access to systems that store inbox data is limited to the small team that operates Tmail.pk, for maintenance, support, and abuse investigations only.

We operate from Pakistan and will respond to valid legal requests under applicable law. Because we deliberately store very little, there is little to disclose — typically only the inbox address, received messages, and limited abuse-prevention data.