Privacy Policy
Last updated: 17 September 2026.
This policy explains what Tempx (“we”, “us”) does with data when you use tempx.uk and the mail domains tempx.uk, a8bt.win, t.rdsql.com, t.newkitapp.com, t.createinvoice.app, t.jsonforge.app and t.jsonforge.app. Plain language is used on purpose.
The short version
- No registration is needed. An optional Google sign-in exists only to “keep” a private inbox across devices.
- Two kinds of inbox exist: named public inboxes (you pick the name, messages kept up to 7 days, anyone who knows the address can read or delete them) and Private Access inboxes (a one-click opt-in: unguessable address, only your browser can read it, access lasts 3 hours, messages kept 1 hour).
- All mail domains (tempx.uk, a8bt.win, t.rdsql.com, t.newkitapp.com, t.createinvoice.app, t.jsonforge.app) are aliases of the same inbox: the part before the @ identifies the mailbox.
- Messages and attachments are deleted automatically when they expire, or instantly when you delete them.
- We do not sell data, and we do not build tracking or behavioural-advertising profiles of our own. Where advertising is shown, it is served by third-party vendors under the rules in the “Advertising and cookies” section below.
- Temporary email is a convenience tool, not a private or secure channel. Read “Public inboxes” and “Limits of this service” below.
What we collect
Email messages and attachments
When someone sends a message to a temporary address, we receive and store the sender address, subject, date, plain-text body, a sanitized version of the HTML body, and any attachments. Messages are held in storage isolated to that single address (identified by the part before the @, across all domains). Attachment files are kept in object storage with the same expiry as their message, are never opened or analysed beyond a technical type check, and are deleted automatically with the message. Executable and script files are refused. Attachment downloads use short-lived signed links that expire within minutes.
Account data (optional)
If you choose “Sign in with Google”, we receive your Google email address, display name and profile picture, and we store the list of inbox addresses you explicitly “keep” on that account. Sign-in is optional; the core service works fully without an account. You can release an inbox from your account or sign out at any time; contact us to delete the account record entirely.
AI-agent connections (MCP tokens)
If you create an MCP connection so an AI agent can read one inbox, we store only a hash of the connection token, the token itself is shown exactly once and never stored in readable form. Connections are scoped to a single inbox, carry an expiry you choose, and can be revoked in one click. Reading is the default; the optional send permission only stores composed mail back into that same inbox for testing (it is never delivered to any recipient).
Technical data
Our infrastructure provider (Cloudflare) processes standard request information such as IP address, user agent and timestamps in order to route traffic, provide TLS, and block attacks. For rate limiting and abuse detection we store a salted, non-reversible hash of your IP address together with short-lived counters and, on the public inbox path, short-lived salted hashes of the inbox names a source requests, used solely to detect bulk name-scanning; raw IP addresses, message contents and senders are never stored for this purpose. Cloudflare Web Analytics, when enabled, reports aggregate usage without cross-site tracking.
Local storage in your browser
Your current address, a signed access token (for private inboxes) and your interface language preference are stored in your browser's local storage so your inbox and settings survive a page reload. This data stays on your device. Clearing site data removes it.
Browser extension
The Tempx browser extension stores your temporary inbox address, its access token (when a private inbox is connected), and message counts locally in your browser. It requests no access to other websites, browsing history, or tabs, and contains no analytics or advertising code. Message contents are read only on tempx.uk, never inside the extension. Disconnecting removes the saved access; uninstalling removes all data the extension stored on your device.
Product analytics (optional)
If analytics are enabled, we record counts of a small set of product events: an address was generated, an address was copied, the inbox was refreshed, a message was opened, a named inbox was opened. We never send the email address, subject, sender, body or attachment details to analytics. Analytics requests are not sent when your browser indicates Do Not Track or Global Privacy Control.
Public inboxes
A named inbox is public. Anyone who knows, or guesses, the name can open it, read its messages and delete them. The same name is the same inbox on every Tempx domain.
- Choose non-obvious names; anyone can type
your-name@tempx.ukand see the same mail asyour-name@a8bt.winoryour-name@t.rdsql.com, every domain shows the same inbox. - Common role names (admin, postmaster, security, …) are reserved and never become inboxes.
- For anything sensitive, use the “private random inbox” option instead: its address is unguessable and messages expire within an hour.
- Never receive passwords, identity documents or account-recovery codes in a public inbox.
How long we keep things
| Data | Retention |
|---|---|
| Messages, named public inbox | Deleted automatically 7 days after arrival, or at once when deleted by anyone who opens the inbox. |
| Messages, private random inbox | Deleted automatically 1 hour after arrival, or at once when you delete them. |
| Attachment files | Stored in object storage with the same expiry as their message; deleted together with it (at once on manual delete, or by an automated sweep within minutes of expiry). |
| Account data (if signed in) | Until you release the inbox or ask us to delete the account record. |
| MCP token hashes | Until the connection is revoked or expires. |
| Rate-limit counters | Expire automatically within roughly an hour. |
| Infrastructure logs (Cloudflare) | Kept for a short period by the provider for security and reliability, then rotated out. |
| Browser local storage | Until the token expires (a few days) or you clear it. |
Who we share data with
We use Cloudflare, Inc. as our hosting, email-routing and security provider; processing email and requests necessarily happens on their platform. We do not sell personal data. Advertising vendors, where advertising is enabled, act only on technical data (cookies and similar) as described below, they never receive your inbox names, messages, senders or subjects. We may disclose information if legally required to do so.
Advertising and cookies
Tempx is free, and advertising keeps it that way. Where ads are shown they are clearly labelled and separated from inbox content. Advertising is served by third-party vendors, which may include Google.
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
- If you opt out of advertising cookies, you may still see ads, but they will not be personalised.
- You can opt out of personalised advertising in Google Ads Settings, and opt out of many third-party vendors' cookies via aboutads.info/choices or youronlinechoices.eu.
- Advertising vendors are technically able to set cookies when ads load; message content, inbox names and senders are never shared with them.
- Where the law requires consent for non-essential cookies (including the EEA and the UK), the consent notice shown on your first visit asks for it. You can revisit that choice by clearing this site's data in your browser.
- Essential storage, your current address, access token and language preference, is described under “Local storage in your browser” above and does not require consent, because the service cannot function without it.
Legal bases (UK GDPR / GDPR)
We process technical and rate-limiting data on the basis of our legitimate interest in keeping the service available and free from abuse. We process email content in order to provide the service you are requesting. Account data is processed on the basis of your consent, given when you sign in, and withdrawn when you sign out or delete the account record. Where analytics are used, they are limited to anonymous aggregates.
Your choices and rights
You can delete messages yourself at any time, open a different inbox, release an inbox from your account, revoke AI-agent tokens, or clear your browser storage. For questions about data protection, email privacy@tempx.uk.
Children
Tempx is not directed at children and should not be used by anyone under the age required to consent to online services in their country.
Limits of this service
Please do not treat any temporary address as private.
- Email is delivered over standard internet mail and is stored briefly in readable form so it can be displayed.
- Named inboxes are additionally readable by anyone who knows the name (see “Public inboxes”).
- The people who operate Tempx can technically access stored messages before they expire.
- We make no claim that use of Tempx is anonymous, untraceable or perfectly secure.
- Do not send passwords, identity documents, financial details or other sensitive content to a Tempx address.
Changes
If this policy changes materially we will update the date above and the sitemap. Continued use after a change means you accept the updated policy.
Contact
Privacy questions: privacy@tempx.uk. General contact details are on the Contact page.