Privacy policy · How we handle data
Beyond keeping promotional email separate,
how is your data handled?
Keeping promotional emails out of your primary inbox doesn’t mean they aren’t processed. This policy explains what data Mailtock uses and what you can control across disposable inboxes, account forwarding and deletion.
Addresses expire
Receive email without signing in. An access token lets you read the inbox; when it expires, the address and its emails are deleted.
See disposable inbox data 02 / Account forwardingYour real email receives forwarded messages
Passwordless sign-in requires a real email address, and messages sent to your alias are forwarded there. Keeping addresses separate does not make the service anonymous.
See sign-in and forwarding data 03 / Data deletionEach deletion has limits
Changing an address, deleting an alias and deleting an archive are different actions. None can recall email already delivered to an external inbox.
See retention and deletion01 / Policy overview
What this policy covers
This policy applies to mailtock.com and its disposable inboxes, real-email verification sign-in, forwarding alias management and email archiving. When you submit an address to a store, membership sign-up page or another website, that site’s policies govern how it collects and uses your information. Mailtock does not replace its privacy notice.
You can go straight to disposable inboxes,account forwarding or data deletion. Last updated November 6, 2026. If you have questions about how data is handled, contact support@mailtock.com and tell us which feature you’re asking about. You don’t need to include email contents or verification codes.
02 / Disposable inbox data
What data is needed to receive an email?
You don’t need to provide a real email address to create a disposable inbox. The system generates a receiving address, access token and expiration time, and links them to the same inbox. Sender and recipient details, subject, time, message body and attachments are processed to receive, list and display incoming email.
This address is an inbox, not proof of identity. Don’t use it for banking, medical, government or other accounts you may need to recover long-term, and don’t treat a disposable inbox as file storage. Before using one, check the shopping use case guide.
- Generated address
- Receives email sent to the address and identifies the current recipient in the inbox. It looks like a regular email address, but that doesn’t mean every website will accept it.
- Access token
- Verifies that requests to read, delete or extend the inbox are authorized. Treat it like an access key; don’t share it with a store, support agent or anyone else.
- Expiration time
- Used to calculate the time remaining, determine whether the inbox can still receive email and trigger expiration cleanup. The countdown on the page reflects the inbox’s actual expiration time.
- Email content
- Displays received verification codes, notifications and attachments. You don’t need to provide your name, payment information or store account password just to read disposable email.
Three different time limits
3 hours
Default duration
The initial duration for a new inbox; it is not a promise of permanent storage.
+3 hours
Added with each extension
Extending adds time to the current expiration, subject to the per-inbox limit.
24 hours
Maximum per inbox
Extensions do not reset the clock indefinitely or turn a disposable inbox into a long-term email account.
If you’re waiting for a later notification, return to the inbox homepage before it expires to check the actual time remaining and extend it. For support that may take more than a day or long-term membership accounts, a forwarding alias is a better fit. Use expiration planning to work out how long you need to keep access.
03 / Sign-in and forwarding data
Aliases hide your address from the sender—not the whole process
To set up long-term forwarding, you provide a real email address. It’s used to receive sign-in verification codes, identify your account and receive messages forwarded from your aliases. After verification, sign-in credentials authorize alias and archive actions. If you enable two-step verification, we also process the authenticator settings and information needed to validate one-time codes.
Alias addresses, their enabled status and their link to your real email address determine where messages go, whether forwarding is stopped and how usage is displayed. To deliver and filter email and troubleshoot issues, the service processes necessary information such as sender, recipient, subject, message body, attachments and forwarding status. Recent messages are available in the control panel’s 30-day archive window.
Separate addresses ≠ anonymity or zero records
Stores see the alias you give them, but Mailtock still needs to know which destination email address it forwards to. Message contents, order numbers and other information you submit during registration may also identify you. Separating addresses does not remove these connections or mean email is end-to-end encrypted.
To stop receiving email from a particular store, you can disable its alias in Forwarding settings without changing the address you use with other stores. See disposable email vs. forwarding aliases for help choosing. Neither option lets you send or reply to email through Mailtock.
04 / Retention and deletion
Deleting one access point doesn’t delete every copy
Disposable inboxes, forwarding aliases and email archives are separate data items. The table below explains what each action affects. Save any verification codes, receipts or notifications you still need before deleting or letting an inbox expire; don’t count on being able to recover its contents by reopening the old address.
The 30-day period applies to the forwarding email archive. It is not the disposable inbox lifetime or a single deletion deadline for account data. For account-level data requests or actions you can’t complete on the page, contact support using our data request process.
| Item / action | What happens | What to know |
|---|---|---|
| Disposable inbox expires | The address and its emails are deleted together. You can no longer use the inbox to receive messages or read its history. | Save anything you need before the countdown ends. Don’t rely on it for long-term account recovery. |
| Change address | Changing your address from the homepage creates a new inbox with the default 3-hour duration and deletes the old one. Emails aren’t transferred. | Make sure you aren’t waiting for a verification code before changing addresses. Don’t keep submitting the old address to sign-up sites. |
| Delete an email / destroy a disposable inbox | Deleting an email affects only the selected message. Destroying an inbox affects that inbox and all its emails. Neither action signs you out of an account. | Changing your address on the homepage deletes the old inbox. Simply closing the page or clearing browser data does not send a request to destroy it. |
| Disable or delete an alias | Once disabled, the alias no longer forwards new messages. Deleting it removes the alias configuration. Existing archived messages must be managed separately. | This does not delete message history from your real inbox, close your store account or remove data already held by the store. |
| 30-day forwarding archive | Forwarding records are available to view during the 30-day archive window. You can also delete records you no longer need from the control panel. | Deleting an archive in Mailtock cannot recall email that has already been forwarded. Delete copies in the destination inbox separately. |
| Sign-in email and account settings | These support ongoing account access and alias forwarding, and are not automatically deleted when a disposable inbox expires. | Signing out ends the current browser session only. Contact support to request account data processing. |
Before you act, decide what you want to stop
- To stop future promotional emails: Disable the relevant alias and, if needed, unsubscribe through the store. Emails already delivered won’t disappear.
- To clear records in Mailtock: Delete the relevant messages from the inbox or forwarding archive details. Deleting an alias does not clear its archive.
- To clear your real inbox: Delete messages from the destination inbox and check its trash, archive and backup settings. These are outside Mailtock’s control.
- To request action on your account data: Tell support what you’re requesting. First check whether any stores still use an alias on the account to send important notifications.
This page describes records accessible through the product and the limits of actions available there. It does not promise that clicking a button immediately and physically erases every copy from all systems. For security incidents, legal obligations or a more specific deletion request, contact support to confirm what can be deleted. Don’t assume an inbox’s expiration period is the retention period for all technical records.
05 / Browser and email security
Keep your access keys safe
Local browser credentials help restore disposable inbox access, keep you signed in and remember your reading status, reducing the need to recreate inboxes or verify again. The disposable inbox access token and account sign-in token serve different purposes, but both are sensitive. Anyone with a valid credential may gain the permissions it grants, so don’t share them like an ordinary email address.
On a shared or public device, sign out of your forwarding account when you’re done and clear this site’s local browser data if needed. Signing out does not delete your account, aliases or forwarded emails. Clearing local credentials may remove your way back into a disposable inbox, but it does not delete data on our servers.
What does isolated HTML display do?
HTML emails are shown in an isolated reading area to separate external email content from the site and reduce the risk that active content interferes with the interface or reads page information. This is a display safeguard, not a guarantee about the sender’s identity or the safety of email content or attachments. It also does not mean the email is end-to-end encrypted.
External images, tracking resources, redirect links and downloads can still pose risks. Loading resources may reveal network information to external services; links take you to other websites, and attachments may contain malicious content. Don’t trust an email just because it appears in your inbox. For unfamiliar senders, read the text first, avoid loading unnecessary resources and never enter sign-in credentials through email links.
Before leaving a shared device
- Save any receipts or notifications you need, then delete disposable emails you no longer need.
- Sign out of your account in Forwarding settings; don’t just close the tab.
- Clear this site’s local data if needed. Don’t take screenshots or forward addresses or request details that contain tokens.
When contacting support, never send sign-in codes, authenticator codes, recovery keys or access tokens. The time, feature and error details are usually a better starting point for troubleshooting.
06 / Third parties and data requests
Once an email is forwarded, control changes hands
Forwarding sends email to the real address you specify. That inbox provider receives, filters, stores and backs up the content according to its own policies. The original sender’s website may also retain the alias you submitted and related order details. You’ll need to manage message history, account information and marketing preferences with each service. Mailtock can’t delete those copies for you.
This policy does not suggest that keeping addresses separate means “no third-party processing.” Beyond delivering email, running and maintaining the website also involves necessary technical processing. If you’d like details about technical records or processing not specified here, you can ask us. We won’t substitute a disposable inbox’s expiration time for an answer to that request.
How to ask questions, access your data or request deletion
Email us at support@mailtock.com and tell us what you want to ask about, review, correct or delete—for example, an account email address, a specific alias or a forwarding archive. For account-related requests, we recommend writing from the real email address you use to sign in. Include only the minimum information needed to locate the records. If we need to verify anything further, we’ll let you know what to provide.
Some requests may require us to confirm account ownership, the scope of the request and applicable legal or security restrictions. We won’t act on someone else’s inbox without verification, and we’ll never ask you to send a password, verification code or token by email. If a disposable inbox has expired and its data has been deleted, a privacy request cannot restore it.
Privacy questions and data requests
support@mailtock.comTell us which feature and records are involved and what you’d like us to do. Don’t attach full credentials or unrelated sensitive email content.
For permitted uses, restrictions and limits of responsibility, also read our Terms of Service. If you just need an address to sign up for a coupon, return to the disposable inbox. For ongoing email, use a separate long-term forwarding address.