Is Temp Mail safe? Two hours, public inboxes and a 2023 leak

Short answer: it depends on the job

The question can mean two things. It can ask about the service called Temp-Mail, at temp-mail.org, or about temporary email in general. Wikipedia says a disposable address can be a forwarding alias or a temporary inbox, and that temporary inboxes often have a planned lifespan measured in minutes, such as 10 to 60 minutes. This page answers for the service first, because its privacy policies and terms can be read, and then says what the other sources add for any temporary inbox.

The service’s own terms set the frame. They say Temp-Mail makes no warranty of reliability or suitability for any purpose, and that its availability may be removed at any time by its owners. They say you agree not to use temporary emails for registering important accounts or receiving sensitive data. They also say you can only receive mail, not send it, and that Temp-Mail has no ability to restore emails or domains once removed. Read together, those lines describe an inbox for receiving a message and then letting it go.

Where the service’s pages disagree with each other, this page puts the lines side by side and does not pick a winner. They differ on how long a message stays, on who can open it, and on whether IP addresses are stored. The sections below take those in turn, then the 2023 leak that Cybernews reported, the rating on ToS;DR, and the jobs that the sources do and do not recommend.

We tested nothing: we opened no mailbox and sent no message. The statements come from Temp-Mail’s two privacy policies and its terms, its Premium page and a 2021 blog post, and from Cybernews, ToS;DR, DeleteMe, the abstract of a 2019 IEEE paper, Wikipedia and two pages from sellers of similar services, all read on 4 November 2026.

How long a message stays

Temp-Mail’s web privacy policy says the service does not store email messages for more than 2 hours, and that emails and data stored on the service are permanently deleted after the time expires. The privacy policy for the mobile apps says the apps do not store emails for more than 2 hours. Both carry dates: the web policy says it is effective as of 1 July 2020, and the app policy as of 1 December 2019.

The terms of service give a different range in one place (1 to 2 hours) and, in the Premium paragraph, say that the free version stores emails for 2 hours only. They tie the storage time to volume: the free service handles a couple of million emails per hour, so emails can be stored for 1 to 2 hours, and the domains may be subject to change. A blog post on Temp-Mail’s own site, dated 7 June 2021, says all emails are deleted automatically after one hour. DeleteMe, a data-removal company, repeats one hour in a page updated on 14 September 2026, and words it as what Temp Mail says.

That makes three answers from the same service: two hours, one to two hours, and one hour. The pages we read do not say which one applies today. The service’s own policy and terms carry dates in 2019 and 2020, the blog post is from 2021, and the only 2026 figure is DeleteMe’s, which relays the service and is not the service’s own text. The terms add that there is no warranty regarding the email storage of already arrived emails, so the terms put no promise behind any of these figures.

You can end a mailbox sooner. The privacy policy says you can delete your temporary address at any time with the Delete button, and the 2021 blog post says deleting removes all data, the IP address included. The terms list what the free version does: a list of free domains, a new address at once, copying to the clipboard or a QR code, changing the name of an address, receiving attachments, browser notifications, downloading the source of a message as an .EML file, and deleting or generating addresses. The policy adds that the QR code opens the same mailbox in another browser.

Premium changes the clock. The terms say that free storage is 2 hours and that on Premium emails are stored for 1 month. The same terms list up to 10 mailboxes at once, a list of premium domains that is not blacklisted and checked every day, an address with full ownership, and no ads. They give two prices: $10 a month and $60 a year, in U.S. dollars, subject to change without notice, paid through the Paddle platform. Those figures sit in terms dated 1 July 2020. The same terms add that Premium is still a temporary disposable email service and not traditional fully-functional email software.

The Premium page we read on 4 November 2026 differs from the terms in three places. It says extended 100MB storage for email messages and does not name a month. It mentions mobile apps with Premium and synchronization between desktop and mobile, while the terms say Premium is available on desktop web only. It also adds connecting your own domain, and lists sending, replying and forwarding to a real email as coming soon. The text we read shows no price, so the $10 and $60 come from the 2020 terms alone.

Who can see a message, and what is logged

Two of the service’s own pages say opposite things. The privacy policy says privacy is the highest priority and that access to your data will be provided only to you personally, and only for the lifetime of the temporary email address. The terms say that messages sent through Temp-Mail may not be available, may be altered, and can be viewed at once by any user of the system. They add that emails you send, or induce any other website or person to send, become public domain once in the system, with no expectation of privacy for email content, and that you agree not to use the public system to receive, store or view emails containing private or confidential information.

We do not decide which text prevails, and the pages we read do not describe how a person other than the owner would open a mailbox.

Two sellers of similar services describe the design of temporary inboxes in general, and the pages do not name temp-mail.org, so their lines are not claims about this service. VanishInbox, which sells temporary mail, updated its page on 3 September 2026 and says temporary inboxes are not password-protected or encrypted and are public by design. EmailAlias.io, which sells aliases, says that on many temp mail services the inbox for any address can be viewed by anyone who types that address into the same site, and that addresses come from a small shared pool and are recycled.

On IP addresses the privacy policy speaks twice. It says Temp-Mail does not store your IP address. In the section on information collected it says the service uses log files that include IP addresses, browser type, internet service provider, referring and exit pages, platform type, a date and time stamp and the number of clicks, and that these are not linked to personally identifiable information. ToS;DR lists as approved that the IP addresses of website visitors are not tracked, and also records that the service keeps user logs for an undefined period of time. The pages we read do not say how long the logs are kept.

The policy also says cookies are used to keep track of advertisements and to remember certain information, and that third-party vendors, Google among them, use cookies to serve ads based on earlier visits. It lists the advertising and measurement tools: ironSource, Google Play Services, Apple services, AdMob, Firebase Analytics, AppsFlyer for traffic attribution, and Ezoic. BuysellAds Optimize appears in the web policy list and not in the app policy list. It says Temp-Mail does not sell, trade or transfer personally identifiable information to outside parties, with exceptions for trusted third parties and for legal requirements, and that visitor information that does not identify a person may be handed to other parties for marketing, advertising and similar purposes.

The free version collects no personal data, the policy says, and Premium stores an email address for login and payment purposes only.

A university-hosted abstract adds an outside view of the whole kind of service. Hu, Peng and Wang presented the first measurement study of disposable email services at the IEEE Symposium on Security and Privacy in 2019. Over three months they collected 2.3 million emails from 7 popular services, sent by about 210 thousand domains. They write that accounts registered with disposable addresses can be easily hijacked, which can lead to information leakage and financial loss, and that third-party tracking is highly prevalent, especially in emails sent by popular services. The abstract does not name the seven services, so we cannot say whether Temp-Mail was among them.

The 2023 key leak and the ratings

Cybernews published an article on 14 June 2023, by Paulina Okunytė, updated the next day, under the title “Temp Mail leaves systems wide open”. It says the Cybernews research team found, on 29 April 2023, a publicly accessible environment file (.env) belonging to Temp Mail, and that according to search engines for connected devices the file had been open since 30 December 2022. The article lists what the file held: API keys for internal services, the private keys of the Android and iOS App Store issuers, Google Firebase credentials, SendGrid API keys and AWS secrets. It also says the Android app had more than 10 million installations.

The article is careful about what it does not know. It says the researchers cannot determine which internal services were left vulnerable, and it describes the risks in terms of what malicious actors could potentially do. The pages we read do not say that anyone used the keys. The list of exposed data in the article does not include user mailboxes.

Cybernews quotes the company as saying the leak was caused by one of its developers in the development environment, that the file was removed from public access and that the exposed security keys would be changed. Cybernews says the company fixed the issue. It also advises the company to investigate whether there was unauthorized access and to inform its users. The pages we read do not say whether the company did either.

ToS;DR, a project that rates the terms and privacy policies of online services, shows Temp Mail with a rating of C. Its update log, written by an automatic bot, records a change from A to B on 8 December 2022, B to C on 3 July 2023, back to B on 4 July and to C again on 10 July 2023. The log we read shows no later change. The page lists nine points and labels every one of them approved, among them that visitors’ IP addresses are not tracked, that you can opt out of providing personal information to third parties and that third parties are bound by confidentiality. Two of the nine, logs kept for an undefined period and third-party cookies for advertising, are the ones DeleteMe reports as ToS;DR concerns, although the ToS;DR page we read labels them approved too. The pages we read do not connect the July 2023 changes to the Cybernews article.

DeleteMe gives the friendliest verdict. Its page, updated on 14 September 2026, says Temp Mail is generally considered safe to use. It cites a positive TechRadar review from 2021, which we did not read, and ratings in the app stores. It says the service has no associated data breaches and that a long-standing vulnerability was detected in 2023 and patched. DeleteMe does not cite Cybernews, so the two pages cannot be shown to describe the same event. DeleteMe also says ToS;DR has not graded the policy, while the ToS;DR page we read shows a C. DeleteMe sells data removal, and its page advises against Temp Mail for anything where you will need to open the inbox again.

The three do not answer the same question. Cybernews reports on the company’s own systems, ToS;DR on the wording of its rules, and DeleteMe gives an overall verdict that cites neither the leak article nor the C.

What it is for, and what the sources rule out

The table sets out what each source says about jobs; the lines from sellers are about temporary inboxes in general.

DeleteMe gives two habits for people who use the service. It says to clear your browser’s cookies and cache afterwards, to prevent tracking or re-accessing the same temporary inbox if it is still active in your session, and to avoid creating an account and sharing your actual email address unless you are required to. Temp-Mail’s 2021 blog post recommends pairing a temporary address with a VPN and suggests a service from Privatix, the name that appears as the company in the privacy policy. That is advice from the service’s own site; the post says Privatix is based in Cyprus, and the pages we read do not say how that company relates to the Privatix LTD named in the privacy policy.

Wikipedia adds a point about sign-ups. Some forum and wiki administrators dislike disposable addresses, website operators who expect to earn from selling addresses may ban them, and lists of such domains exist. The page cites blogs among its references, so we use it for definitions only.

If the job is an account you want to keep, the sources point the other way, to addresses that last. Wikipedia names forwarding aliases and sub-addresses as the other methods. On this site, the Mailinator page and the Guerrilla Mail page cover two more inboxes that expire, and SimpleLogin, Firefox Relay, Apple Hide My Email and plus addressing each have a page for the aliases that forward to your real inbox. The temp mail hub places them side by side.

What the pages we read do not say

• They do not describe how a person other than the owner would open a mailbox on the free service. The terms say messages are viewable by any user of the system, and the pages we read do not explain the mechanism.
• They give no current count of users or of messages received. The only figures are app-install counts, more than 10 million on Android alone in the Cybernews article and 10+ million downloads on Google Play in DeleteMe, and the terms mention a couple of million emails per hour, with no date.
• They do not say whether anyone used the keys exposed in 2023.
• They do not say where the servers are or how long the logs are kept.
• They do not say whether the privacy policy is under review. It carries the date 1 July 2020, and the app policy 1 December 2019.
• They do not tell us whether Temp-Mail was among the seven services in the 2019 study.

The answers in the FAQ on Temp-Mail’s site arrived closed in the text we extracted, so we did not use them. We did not read the reviews of the service on review sites, nor the pages of competing temporary mail services.