Privacy policy

E-mail: not provided

You do not need an account. We use no advertising trackers and do not share data for advertising. Our visitor statistics work without cookies and build no profiles. Inboxes and messages are deleted automatically once the address expires.

For each inbox we store the address, the expiry time and an access key. We store the key only as a hash, so nobody but you can open the inbox.

Depending on your choice, an inbox expires after 10 minutes, 1 hour, 1 day and can be extended to at most 24 hours from the time you extend it. After it expires we delete the inbox with all messages and attachments at the latest in the next clean-up run, which takes place every five minutes. You can also delete inboxes and single messages yourself at any time.

We store incoming messages in full: sender, subject, content, attachments and the original message. We keep at most 50 messages per inbox; older ones are deleted. To save you work, we detect confirmation codes and links in the message automatically.

Messages are not end-to-end encrypted. Do not use temporary addresses for sensitive data such as banking or health information.

E-mails to our domains are received by Cloudflare Email Routing and forwarded to us (Cloudflare, Inc., USA). Cloudflare acts as our processor and is certified under the EU-US Data Privacy Framework.

We block external images in messages by default, so the sender does not learn whether and when you open a message. If you load the images yourself, your browser fetches them directly from the sender's server, which sees your IP address.

We only use strictly necessary cookies, which need no consent (section 25 (2) no. 2 TDDDG):

• tosspost_mailboxes holds the encrypted access keys of your inboxes and is deleted after 7 days.
• tosspost-session keeps your session for 120 minutes.
• XSRF-TOKEN protects forms against cross-site request forgery.
• appearance remembers whether you chose the light or dark theme.

An account is optional. If you create one, we store your name, your e-mail address, your password as a hash and, if you set them up, the data for two-factor sign-in and passkeys. We use your e-mail address only for signing in, confirming the account and resetting the password.

Addresses you create while signed in, or bring along from this browser when you sign in, belong to your account (at most 25). You can keep them permanently. We delete messages in permanent inboxes after 30 days.

Under "My inboxes" you can download all data of your account as a ZIP file at any time (Art. 20 GDPR). If you delete your account in the settings, we remove it right away together with all inboxes, messages and attachments.

When you open an inbox on another device with a QR code, we create a one-time link. It is valid for 10 minutes and expires as soon as it has been used.

If you allow notifications, your browser registers with the push service of its vendor (such as Google, Mozilla, Apple or Microsoft). We store the address of that service and the keys of your browser together with the inbox and delete them with it.

When a message arrives, we send an encrypted notification with the sender and subject, or the code, through that service. The push service cannot read the content but sees that a notification is delivered. You can turn notifications off in your browser settings at any time.

E-mails we send go through Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA): the confirmation of your account, password resets, the confirmation of a forwarding address and copies of the messages you have forwarded. For this, Resend receives the recipient address and the content of the e-mail, so for forwarded messages also the message and its attachments.

The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR). Resend processes the data on our behalf, also in the USA; the EU standard contractual clauses apply, and Resend is certified under the EU-US Data Privacy Framework.

The website and all data named in this policy are stored on a server we rent through Laravel Forge ("Laravel VPS") from Laravel Holdings Inc., 60 Broad Street, 24th Floor, #1559, New York, NY 10004, USA. Laravel provides the server in a DigitalOcean, LLC data centre in Frankfurt am Main, Germany.

Laravel processes the data on our behalf under Laravel's data processing agreement. Because Laravel and DigitalOcean are based in the USA, data may also be transferred there.

All TossPost pages are delivered through the Cloudflare network (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Cloudflare establishes the encrypted connection, fends off attacks and passes your requests on to our server. In doing so, Cloudflare processes your IP address, the address you request, details about your browser and operating system and technical connection data.

Cloudflare acts as our processor and is certified under the EU-US Data Privacy Framework.

To understand which pages are used and how fast they load, we use Cloudflare Web Analytics. Cloudflare adds a small script to the pages for this. When a page loads, it reports the address of the page, the page you came from, your browser, operating system, device type and loading times to Cloudflare. Cloudflare derives the country from your IP address.

According to Cloudflare, the script sets no cookies, uses no local storage in your browser and builds no profiles of individual visitors. We only see aggregated numbers, such as page views per day. If you do not want this, block scripts from static.cloudflareinsights.com, for example with an ad blocker.

If you write to us, we process your address and your message to reply to you. E-mails to our addresses at tosspost.com are forwarded by Cloudflare Email Routing to a mailbox at Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland); Google may also process the data in the USA. We delete your message once your request has been dealt with and there is no obligation to keep it.

When you open a page, the server necessarily processes your IP address. We use it briefly to limit the number of new inboxes per connection and only store counters for this, which expire after one day at the latest.

We notify your browser of new messages over a WebSocket connection. Only a notice is transmitted, never the content of a message. We show browser notifications only if you explicitly allow them.

We serve fonts and all other files ourselves. From third parties, the pages only load the statistics script from Cloudflare.

We process data for the inbox and the messages to provide the service you asked for (Art. 6 (1) (b) GDPR). Abuse protection and security are based on our legitimate interest in secure operation (Art. 6 (1) (f) GDPR), and so is delivery through Cloudflare. The visitor statistics are based on our legitimate interest in understanding and improving our service (Art. 6 (1) (f) GDPR). Replies to your e-mails are based on Art. 6 (1) (b) or (f) GDPR.

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). Without an account we often cannot identify you (Art. 11 GDPR). The fastest way to delete your data is directly in the inbox or in your account. You can also lodge a complaint with a data protection supervisory authority.