Privacy Policy
Last updated: September 7, 2026
Our Privacy-First Approach
OTPBox is designed as a privacy-focused disposable email service for receiving verification codes and magic links. We collect minimal data and automatically delete everything after a short period.
No Tracking
We do not use analytics, tracking pixels, advertising cookies, or third-party tracking services. Your use of OTPBox is not monitored or profiled.
What Data We Store
Inbox Data: When you create an inbox, we temporarily store an opaque inbox ID, randomly generated access token, the generated email address, and creation/expiration timestamps.
Email Messages: Incoming verification emails are stored temporarily with sender, subject, body, extracted OTP codes, and magic links. We do not log email headers beyond what's necessary for display.
Rate Limiting: IP addresses are hashed and used only for rate limiting (10 inbox creates/hour per IP; polling unrestricted). These counters reset hourly and are not linked to any inbox.
Automatic Expiration
All inboxes and their messages automatically expire and are permanently deleted 1 hour after creation. There is no retention beyond this period. Once expired, data cannot be recovered.
No Accounts or Authentication
OTPBox requires no user accounts, passwords, or personal information. Access to inboxes is granted via opaque, randomly generated tokens that are not tied to any identifying information.
Data Security
All data is stored in encrypted databases. Access tokens are random and cryptographically secure. We do not share, sell, or monetize any data.
Server Logs
Standard server access logs are retained for up to 7 days for debugging and security purposes only. These logs are not used for analytics or tracking.
Third-Party Services
OTPBox uses Cloudflare Email Routing for receiving emails and Vercel for hosting. These services have their own privacy policies. We do not use advertising networks, analytics services, or social media trackers.
Your Privacy Rights
Because we collect minimal data and automatically delete it within 1 hour, there is typically no persistent data to access, modify, or delete. If you have concerns, simply wait for your inbox to expire or stop using the service.
Children's Privacy
OTPBox is not intended for use by anyone under 13 years of age. We do not knowingly collect information from children.
Changes to This Policy
We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last updated" date.
Contact
For privacy-related questions or concerns, please open an issue on our GitHub repository or contact us through the channels listed on our website.