Privacy Policy

Introduction

MinuteMail ("we," "our," or "us") is a developer testing platform for email and authentication flows. It provides ephemeral mailboxes, a mock OAuth identity provider, a REST API with Python SDK, and an MCP Server. This policy explains how we handle your information when you use minutemail.co and our API.

Our service is designed for testing: all mailbox data is automatically and permanently deleted on expiration, we do not store IP addresses in our databases, and we do not build behavioral profiles or sell data to third parties.

What We Do NOT Collect

• IP Addresses: Not stored in our databases
• Personal Information (anonymous users): No name, permanent email, phone number, or address required
• Device Fingerprints or Location Data
• Client-Side Tracking: No analytics scripts, tracking pixels, or fingerprinting in our web pages
• Advertising Profiles: No behavioral advertising, no cross-site tracking, no data sold to third parties

What We Collect

Anonymous Users

• A temporary, randomly-generated session ID (client-side only, expires after 5 minutes of inactivity)
• Temporary mailbox data (alias, domain, expiration time) — deleted on expiration
• Received emails and attachments — deleted when the mailbox expires

Registered Users

• GitHub account data received via OAuth (username, display name, email, avatar URL) — we do not store passwords; authentication is handled through GitHub
• API keys (stored as hashed values), custom domains, and team membership data
• Subscription plan and billing status (payment details are stored by Stripe, not us)
• Usage metrics (mailbox counts, API call quotas)

How We Use Your Information

We use your information only to provide and operate the Service: delivering emails, managing accounts and subscriptions, validating API keys, verifying custom domains, and preventing abuse. We do not use your data for advertising, marketing, or selling to third parties.

Usage and Service Metrics

We collect aggregate, anonymous metrics to monitor and improve the Service. These include:

• Number of sessions and mailboxes created
• Feature usage counts (API calls, mock identities, custom domains, archived mailboxes)
• Site traffic, response times, and error rates

These metrics are aggregate counts used for capacity planning and product improvement. They are not linked to your personal identity, IP address, or browser. We do not use any tracking scripts, cookies, or analytics pixels on our web pages.

Data Retention

• Temporary mailboxes and messages: Permanently deleted on expiration (1–60 minutes)
• Archived mailboxes: Only the email address is kept — no messages. Can be reactivated to create a fresh empty mailbox
• Account data: Retained until you delete your account
• Billing records: Retained for 7 years for tax compliance (Canadian law)

Third-Party Services

• Stripe: Handles payment processing. We share your email and plan info; Stripe stores your card details. See stripe.com/privacy
• GitHub OAuth: Provides user authentication. When you sign in, GitHub shares your username, email, and avatar with us. GitHub's privacy policy applies to their OAuth process. See GitHub Privacy Statement
• CDN: Delivers static assets; no personal data or tracking involved
• Affiliate links (e.g. NordVPN): Clicking may share referral info with the partner. Clearly disclosed and unrelated to MinuteMail's data practices

Your Privacy Rights

Anonymous users have no stored personal data to request. Registered users have the right to access, correct, delete, or export their data, and to object to or restrict processing. To exercise any of these rights, contact us at support@minutemail.co. We will respond within 30 days.

You may also file a complaint with your local data protection authority (e.g. the CAI in Quebec, OPC in Canada, your EU supervisory authority, or the ICO in the UK).

Data Security

We use HTTPS/TLS encryption in transit, database encryption at rest, hashed API keys, and row-level security for tenant isolation. We monitor service health, performance, and uptime using internal infrastructure tools that collect operational data only — no personal information. No system is completely secure — use MinuteMail for temporary, non-sensitive communications.

Cookies and Local Storage

We do not use any analytics or tracking cookies. Authentication tokens are stored in localStorage for logged-in users. We use local storage for theme preferences and mailbox state. No advertising or third-party tracking cookies are used. You can clear these at any time through your browser settings.

Children's Privacy

MinuteMail is not intended for children under 13 (or 16 in the EU). If you believe a child has provided us with personal information, contact us at support@minutemail.co and we will delete it promptly.

Changes to This Policy

We may update this policy periodically. Material changes will be posted on our website for at least 30 days and emailed to registered users. Continued use of the Service after changes take effect constitutes acceptance.

Contact

Questions or requests? Contact us at support@minutemail.co.