How to use Tmail.pk safely, how to report abuse, and what to expect from a free, receive-only temporary email service — plus the infrastructure and liability limits that apply.
Tmail.pk is built for legitimate privacy: one-time signups, email verifications, password resets, developer testing, and keeping your primary inbox free of marketing. It is a receive-only service — you cannot send mail from it.
Please do not use Tmail.pk to harass, defraud, or impersonate anyone, to distribute malware, or to systematically abuse another service's free tier. We may block addresses or clients that misuse the service and cooperate with valid abuse reports.
Temporary email does not override another service's rules. Follow each service's age, identity, account-limit, trial, payment, verification, and moderation requirements.
If a service blocks disposable domains, requires a permanent address, or asks for additional verification, use an accepted method. Do not rotate domains to bypass the restriction or use Tmail.pk to evade a ban or create deceptive accounts.
Tmail.pk uses publisher metadata and ads.txt to verify AdSense ownership without loading advertising code on the homepage. No ad units are currently active. Any future ads will be limited to public editorial pages and will not appear in inboxes, message readers, authentication or account areas, or admin pages.
Do not generate automated visits, repeated refreshes, impressions, or clicks. Never click an advertisement to support Tmail.pk, ask someone else to click, or use paid-to-click, bot, proxy, or incentivized traffic.
If you see a Tmail.pk inbox being used for phishing, harassment, fraud, or anything illegal, tell us and we will investigate. Send the address involved — and a screenshot or message headers if you have them — to abuse@tmail.pk.
Because inboxes are receive-only and disposable, the fastest remedy is usually to block the offending address and the client behind it, which we can do once we can identify them.
We store and display messages — including attachments — as we receive them. We do not open, execute, or virus-scan attachments on your behalf, and we cannot verify that a file or link is safe.
Treat everything in a disposable inbox as untrusted. Do not download or run files from senders you do not recognise, be cautious with links, and never enter real passwords, card numbers, or personal details into a page you reached from a message in a temporary inbox.
Each inbox is protected by a password. Anyone who has both the address and its password can read that inbox — so treat the password like any other credential: keep it private, do not paste it into untrusted sites, and never reuse a password you use anywhere else. Use a unique, throwaway password for a throwaway inbox.
A temporary inbox is designed to be low-stakes, not a secure vault. Do not use one to receive sensitive documents, long-term account recovery codes, or confidential information — those belong in a real, private mailbox.
Privacy has a trade-off: we do not ask for a phone number or a real backup email, so there is no self-service "forgot password" flow for a guest inbox. Limited authorized operators may assist with recovery or reset when an encrypted recovery envelope is available; older bcrypt-only credentials cannot be revealed.
Save your credentials when you create an inbox — the credentials card has a one-click copy button. If you want a single place to manage several inboxes under one login, create a free account instead of relying on individually saved guest credentials.
We collect the minimum needed to run the service: your inbox address, a bcrypt password verifier and, for new or reset credentials, an encrypted recovery envelope; the messages the inbox receives; and limited data for rate limiting and abuse prevention (such as IP addresses). Passwords are never stored as plaintext. We do not sell your data, and we never use inbox data or received email content for advertising. See the Privacy Policy for the full breakdown.
Access to the systems that store inbox data and password recovery envelopes is limited to the small team that operates Tmail.pk, and only for maintenance, support, password reset, and abuse investigations. Because inboxes are meant for throwaway use, do not treat them as private encrypted storage — operators can access inbox data when required to run the service.
If we become aware of a security issue affecting inbox data, we investigate promptly, take affected components offline where necessary, and fix the root cause. Given the disposable design of the service, your strongest protection is keeping nothing sensitive in a temporary inbox in the first place.
We operate from Pakistan and will respond to valid legal requests under applicable law. Because we deliberately store very little, there is little to disclose — typically only the inbox address, the messages it has received, and limited abuse-prevention data. We do not retain a broad profile of your activity.
Notice of infrastructure dependency
Tmail.pk relies on third-party infrastructure providers (Vercel, Supabase, Cloudflare). The policies, free-tier limits, and uptime of those platforms are outside our direct control. We do our best to keep the service available and your data safe, but we cannot guarantee perfect uptime or persistence.
Something look wrong or need help? Report abuse or reach the team from the contact page.