Last updated 15 October 2026
OTPBox (otpbox.io) is a free temporary email service. This page explains what we collect, why, how long we keep it, and what choices you have. If something here is unclear, email abuse@otpbox.io.
| Data | Purpose | Retention |
|---|---|---|
| Generated email address | So mail sent to it reaches your browser | Live for 1 hour from creation; a record of it is kept in the 30-day archive below, then deleted |
| Message contents (sender, subject, text, any one-time code or link found) | To show you the mail you received; a copy is kept for abuse and security review | Shown to you for 1 hour; the archived copy is deleted 30 days after the inbox ends |
| Attachment files | To let you download attachments | Deleted after 1 hour and not archived; only the file name, type and size are kept in the 30-day archive |
| Creation details: IP address, approximate location (city and country), browser and operating system | Abuse prevention, security investigation and support | Stored with the inbox's archive record and deleted with it, 30 days after the inbox ends |
| A random access token | Stored in your browser's local storage so you can reopen your inbox; never sent to us except with your own requests | Until it expires with the inbox, or you clear your browser storage |
| Your IP address (rate limiting) | To rate-limit address creation and stop automated abuse | Also kept in a rolling one-hour counter, separate from the archive record above |
| Analytics events (page views, general location, device type) | To understand which parts of the site are useful | Collected for every visit; governed by Google's and Microsoft's own retention policies (see below) |
| Payment email, customer/subscription id, subscription status (Premium or paid API only) | To activate and manage a paid subscription; card details are handled entirely by Paddle and never reach us | Kept for as long as the subscription is active, plus what we're legally required to retain for billing records |
| A premium or API key (hashed, not stored in plain text) | To check whether a given key is entitled to paid perks or API quota | Until the subscription ends and the key is revoked |
Incoming HTML is automatically sanitized (scripts, forms and remote images are stripped) before it is shown to you, and simple pattern matching looks for a one-time code or a confirmation link so it can be surfaced at the top of the message. Messages are not routinely read by a person. However, authorised OTPBox staff can view the 30-day archive (inbox details and message contents) in an internal admin panel, for abuse investigation, security, and support. Access is limited to staff accounts. We do not use archived content for advertising or sell it.
We use a small number of infrastructure providers to run the service. Each only sees what it needs to do its job:
We do not sell personal data, and we do not share message contents with advertisers.
The site sets two first-party cookies. If you sign in to the dashboard, a session cookie keeps you signed in. On your first visit, a cookie named otpbox_src records which site or campaign sent you (for example a search engine, or a utm_source link) and the first page you saw; it holds no identifier, lasts 90 days, and is copied onto a free API key or account only if you create one, so we can tell which channels bring in people who actually use OTPBox. The site also uses your browser's local storage for your inbox access token and, if you purchase Premium or an API key, that key - both stay on your device and are never transmitted anywhere except back to our own API as part of your own requests. Google and Microsoft may set their own analytics cookies as described in their policies linked above.
The free service holds no account and no name or email address for you, and everything we keep is removed automatically 30 days after an inbox ends. If you would like the archived copy of an inbox deleted sooner, or want to know what we hold about it, email abuse@otpbox.io with the address in question and we will act on it. The delete controls in the app remove the live inbox immediately, but the 30-day archive copy remains until it expires or you ask us to delete it. If you are in the EU or UK and believe we have not met our obligations under GDPR, you may also lodge a complaint with your local data protection authority.
We may disclose message contents in response to a valid legal request (such as a court order) where we are legally required to do so, limited to what the request specifically covers. We can only disclose what we still hold, which is at most the 30-day archive described above.
OTPBox is not directed at children under 13, and we do not knowingly collect data from them.
OTPBox is operated by Vibidsoft Private Limited, 805, Stratum, Nehrunagar, Ahmedabad, Gujarat, India - 380015. Contact: Harshil Shah, harshil@vibidsoft.com.
If this policy changes materially, we will update the date at the top of this page.
← Back to OTPBox