Privacy Policy

Last updated: 3 August 2026.

This page describes what CrazyMailing stores, what it deliberately does not store, and which other companies are involved. It was written by checking the running system, so it is specific where a template would be vague.

What we do not collect

No web server access log exists. The server in front of the application has no logging directive configured, so no file records which page was requested, from which address, at what second. That is unusual enough to say out loud: most sites keep those records for months by default.

Your IP address is not in our database. There is no column for it anywhere in the schema: not on mailboxes, not on messages, not on accounts. It exists in memory for the length of a request and then it is gone.

Rate limiting leaves no trace. The counter that stops one visitor demanding a thousand addresses a minute lives in process memory and is never written to disk. Restarting the application erases it.

None of that makes you anonymous. Read the Cloudflare section below, then what a throwaway address really hides.

What we store while you use the service

The mailbox address, because mail sent to it needs somewhere to land.

A random identifier kept in your browser, which is how the site shows you the same guest mailbox when you come back. It is not derived from anything about you and is meaningless to any other website.

Messages delivered to that mailbox: sender, subject, headers, body and attachments, held so they can be displayed to you. Message content is not scanned to target advertising and is not sold.

For an account, an email address and a password hash. The password itself is never stored and cannot be reconstructed from the hash. Your address signs you in and receives password resets, and is used for nothing else.

Who else is involved

Cloudflare sits in front of this site. It terminates the connection, filters attacks and serves cached files, so it does see the IP address of every visitor and holds aggregate traffic statistics that we can view as counts and graphs. That processing happens under Cloudflare's own privacy terms, not ours.

Cloudflare Turnstile protects the registration and password forms by looking for signs of automation in the browser. It does not make you identify traffic lights and does not feed the result into an advertising profile.

Amazon SES delivers password reset messages from a separate sending domain.

Google provides the advertising through AdSense and the visitor counts through Google Analytics 4.

Cookies and advertising

AdSense and Analytics both set cookies in your browser. Google and its partners may use them to show ads based on your earlier visits to this site and others. You can switch personalised advertising off at Google Ads Settings, or block the cookies in your browser. The mailbox works either way; nothing here asks you to accept a cookie before reading a page or receiving a message.

Analytics tells us how many people opened a page and roughly where they came from, not who they are.

Everything expires, and that is the point

A guest mailbox and its contents are deleted twenty four hours after last use, and immediately when you ask for a new address. With a free account, a mailbox survives seven days from your last sign in and a message is kept up to thirty days. An attachment lives exactly as long as its message.

Deletion is genuine. Nothing is archived, nothing is backed up, no copy is set aside for analysis. Once the cleanup has run, the message cannot be produced for you, for a marketer or for anyone arriving with a demand.

That serves both sides. You get a service that cannot leak what it does not hold, and we get to run a mail system without accumulating a warehouse of other people's correspondence, which is the largest single liability anyone in this position can carry.

A guest mailbox has no lock

Anyone who types a guest address into this site sees what is in it. There is no password on a guest mailbox and cannot be one without turning it into an account, so treat guest mail as readable by strangers. Mailboxes under an account belong to that account alone.

If you are in the EU or the UK

You may ask what personal data we hold about you, ask for it to be corrected or erased, and complain to your national data protection authority. For guest use the answer is close to nothing: an address, its messages and a random browser identifier, all of which expire on their own.

If you hold an account, deleting it from your settings removes the email address, the password hash and every mailbox and message attached to it at once. That is the fastest erasure route and needs no letter to anyone.

Children

The service is not built for children and is not aimed at them. We do not knowingly hold information about anyone under 13. If you believe a child has registered here, write to us and the account will be removed.

Changes

When this page changes, the date at the top changes with it. A change to what we collect will be described here in words rather than absorbed quietly.

Questions: hello@crazymailing.com or the contact page.