Last updated 8 October 2026. Written in plain words on purpose.
The mail sent to your inboxes, the addresses you created, any note you write on an inbox, and one session cookie that tells us which browser you are. With the session we store your browser's name and when it was last seen. If you signed in with an email, we keep that email address.
A note is encrypted before it is stored, with a key that lives only on our server and never in the database or its backups. We decrypt it only to show it to you. It is not end to end encryption: our server can read it, the same way it shows you your mail. A note moves with its inbox when you sign in and is deleted with the inbox. Anyone holding your browser session or your account can read it.
Paying adds your plan and the subscription record Lemon Squeezy sends us. It never includes a card number: Lemon Squeezy takes the payment, not us. An API key is kept only as a scrambled copy. A webhook is kept with its address and the secret we sign each delivery with.
Each page you open adds one row: which page, the country your connection comes from, whether you were signed in, and when. The first row of a visit also notes where you came from, by name only, like reddit, google or direct. The country is looked up on our own server from your IP address, which is then forgotten. We do not store IP addresses, and we keep no access logs.
There is no password for freemail itself, so there is no freemail password in our database. Anything you type into a note is stored encrypted, as above. Login codes are scrambled before storing, work for ten minutes, and work once. Sessions are kept the same way: we hold a scrambled copy, never the cookie itself.
Messages are kept 7 days on Free, 30 days on Pro and 90 days on Max. When the clock runs out, the message, its attachments and its raw copy are deleted together. Your addresses do not expire. Only messages do. An inbox that never received anything and has no note, on a browser not opened for 30 days, is reclaimed so the name stays available for someone who will use it.
Every night the database is copied, and one more copy is taken just before each update to the site. The copies stay at most 14 days on our server and up to three months in encrypted storage at Amazon. They exist to recover from a disaster, never to bring back something you deleted. Incoming mail also passes through an Amazon intake bucket that empties itself within 14 days.
We read it once, strip scripts and dangerous markup, and neutralise remote images so tracking pixels cannot fire until you ask for them. We also look for a verification code so you can copy it without opening the mail.
Amazon Web Services runs our server and our storage in Frankfurt, and its email service receives your mail. Brevo, in France, delivers the login codes we send you, and Resend takes over when Brevo cannot. Lemon Squeezy takes payments. Resend and Lemon Squeezy are in the United States. The country lookup is a database on our own server, so nothing about your visit is sent to its maker.
Free is paid for by ads on the page. Advertisers never see your mail, your address, or anything we worked out from either.
Anyone holding the browser session or the account that owns it. An inbox is not a secret. Treat it as a public address with a private reader.
The freemail extension for Firefox and Edge gets its own session from our server and keeps it in the browser's storage for extensions, the way the website keeps its cookie. It talks only to api.freemail.site. It does not read the pages you visit. Only when you click Fill, use its right click menu or press its shortcut does it look at that one page, to find the email box and later the code box, and it sends nothing from that page to us. While a code card is open it asks our server every few seconds for new mail in your inbox, and every five minutes it checks for new mail to show the count on its icon. If you sign in, it sends your email to get a login code, like the website does. Removing the extension deletes what it stored in the browser. Your inboxes stay on our server under the rules above.
The dashboard has a Delete everything button. It removes your inboxes, messages, attachments and notes at once, and the backups age out on the schedule above. You can also write to us and ask us to do it for you.
Questions about this page, and abuse reports, go to supportfreemail@gmail.com.