ExpressMail Privacy & Retention: What Happens to Your Emails

When you use a disposable email service, you are trusting it with the contents of your inbox — even if that inbox only lasts a few days. The question "what do you actually do with my data?" deserves a straight answer.

This page explains exactly what ExpressMail collects, what it does not collect, how long data exists, and what happens when it is deleted.

What ExpressMail Collects

ExpressMail is built around a minimal-data philosophy. Here is the complete list of what we store:

• Email content — The subject line, body, and metadata (sender address, timestamps) of emails received by your mailbox. This is stored temporarily so you can read your messages.
• Attachments — Files attached to incoming emails are stored alongside the email content. They follow the same retention and deletion rules.
• Device identifier — A randomly generated device ID used to associate your mailboxes with your device. This is not tied to your name, phone number, or any personal account.
• Push notification tokens — If you enable push notifications on the mobile app, we store the token issued by Apple (APNs) or Google (FCM) so we can notify you when new mail arrives.
• Subscription status — If you purchase a premium subscription, RevenueCat (our subscription management provider) handles payment processing. We receive a subscription status flag — active, expired, or cancelled — but never see your payment details.

That is it. There is no hidden analytics layer, no behavioral tracking, and no advertising profile.

What ExpressMail Does NOT Collect

This list matters just as much:

• Your name — We never ask for it.
• Your real email address — There is no account registration, so there is nowhere to enter one.
• Your phone number — Not requested, not stored.
• Your IP address — We do not log IP addresses tied to mailbox activity.
• Personally identifiable information (PII) — No government IDs, physical addresses, or biographical data.
• Browsing history or usage analytics — We do not track which pages you visit, how long you spend reading an email, or what you click.

How Long Mailboxes Last

Every ExpressMail mailbox has a default lifespan of 30 days. The countdown begins when the mailbox is created.

• Active use extends the window. Opening the mailbox and interacting with it keeps it alive.
• Manual deletion is instant. You can delete a mailbox at any time from the app or web interface.
• After 30 days of inactivity, the mailbox is automatically purged.

There is no archive, no "recently deleted" folder, and no way to recover a mailbox after deletion — manual or automatic.

What Happens When a Mailbox Expires

When a mailbox reaches the end of its lifespan:

1. The mailbox address is deactivated. Any new emails sent to it will bounce back to the sender.
2. All stored emails are permanently deleted from ExpressMail's database.
3. All attachments are permanently deleted from storage.
4. The device association is removed. The mailbox no longer appears in your app or web interface.

"Permanently deleted" means exactly that — the data is removed from our MongoDB database and any associated file storage. There is no backup retention window and no way for our team to retrieve it.

Attachment Handling

Attachments deserve a specific mention because they involve file storage beyond the database:

• Incoming attachments are processed and stored when the email arrives.
• They are accessible only through your mailbox — no public URLs, no shared links.
• When the mailbox is deleted (manually or by expiry), attachments are deleted in the same operation.
• We do not scan attachment contents for advertising or data mining purposes.

Third-Party Services

ExpressMail uses two third-party services. Here is what each one does and what data it receives:

RevenueCat (Subscription Management)

RevenueCat handles in-app purchase validation and subscription status tracking. It receives:

• Your app store transaction ID
• Subscription status (active, expired, cancelled)
• An anonymous app user ID

RevenueCat does not receive your email content, mailbox addresses, or device identifiers. Their privacy policy is available at revenuecat.com/privacy.

Firebase (Push Notifications)

Firebase Cloud Messaging delivers push notifications to your device when new mail arrives. It receives:

• Your push notification token
• The notification payload (a short alert — not the full email content)

Firebase does not receive your mailbox contents or attachments. Google's Firebase privacy information is available at firebase.google.com/support/privacy.

Security Measures

• HTTPS/TLS encryption — All communication between your device and ExpressMail's servers is encrypted in transit using TLS.
• Encrypted SMTP — Where the sending server supports it, incoming emails are received over encrypted SMTP connections (STARTTLS).
• No password-based accounts — Because there is no account system, there are no passwords to leak or credentials to steal.

How ExpressMail Compares to Public Inbox Services

Not all temporary email services work the same way. Some — particularly older, free services — use public inboxes, meaning anyone who knows (or guesses) the email address can read its contents. This is a significant privacy risk.

ExpressMail mailboxes are private by default. Your inbox is associated with your device identifier, and no one else can access it — not other users, not search engines, and not our own team without direct database access (which we do not perform for user mailboxes).

The Bottom Line

ExpressMail is designed to give you a functional temporary inbox with the smallest possible data footprint. We store what is necessary to deliver the service — email content, attachments, a device ID, and a push token — and delete everything automatically when the mailbox expires. We do not collect your name, your real email, your phone number, or your browsing behavior. Your inbox is private, not public.

If you have specific questions about data handling that are not covered here, reach out through the app's support channel.