Privacy Policy

This policy explains what MailsByte collects, why we collect it, how long we keep it, who we share it with (including Google AdSense and VirusTotal), and the choices you have. Disposable mail is short-lived. It is not a “zero log” or anonymous-absolute product. If you only generate a guest inbox and never sign in, we still process the mailbox, the messages sent to it, technical request data, and — on free surfaces — advertising data.

1. Who we are

MailsByte is a disposable-email cockpit operated by Ajistudio. The public website and API live at https://mailsbyte.me. Incoming mail is accepted only for addresses on mailsbyte.online and temp.mailsbyte.me. Receive-only.

For privacy questions, write to privacy@mailsbyte.me. For abuse of a mailbox or outbound complaint about mail we received, write to abuse@mailsbyte.me.

2. Scope

This policy covers:

• the public website, inbox cockpit, account center, and API docs;
• SMTP intake for @temp.mailsbyte.me;
• the REST API authenticated with mb_live_ keys;
• Google sign-in, session cookies, and Google AdSense on free surfaces;
• optional VirusTotal scans you start from the cockpit.

It does not cover third-party sites you use a MailsByte address to sign up for. Those sites get whatever you type there, plus any mail they send to your disposable address.

3. Data we collect

3.1 Guest (not signed in)

• The disposable address we issued and its expiry time.
• Messages delivered to that address: envelope, headers, subject, body, attachments, received time.
• A short-lived mailbox access token stored as a cookie / local token so the browser can read that box.
• Client IP used for guest inbox caps, rate limits, and abuse jails. These counters roll off in minutes to hours, not as a permanent identity file.
• Advertising signals described in section 6 if you are on a free page.

3.2 Signed-in free or Premium

• Username, password hash (PBKDF2) if you set a password, and optional recovery email.
• Google account identifiers if you use Google sign-in (subject, email, display name as Google returns them).
• Plan (free / premium), credits, API keys (hashed / masked after create), VirusTotal preference and, if you paste one, your personal VT key.
• Mailboxes claimed to the account and, while they live, their messages.
• Session cookie tm_auth (30 days, SameSite=Lax, Secure in production).

3.3 We do not need, and do not ask for

• government ID, phone number, payment card (Premium billing is not processed in-app yet);
• your real personal inbox, unless you choose Google sign-in or type an email on the account form;
• precise GPS location;
• the contents of mailboxes you never created on this service.

4. How disposable mail is processed

When someone sends mail to local@temp.mailsbyte.me, our mail path accepts the message, stores it with that mailbox, and the cockpit (or API) can read it until the box expires or you delete it. Anyone who knows the live address can send mail to it. Anyone who holds the mailbox access token, a valid restore key (Premium), or an authenticated owner session can read it.

Treat a disposable inbox like a shared postcard, not a locked vault. Do not use it for medical, financial, or long-term secrets. We scan links or files only when you click scan, and then VirusTotal sees that URL or file hash (section 8).

5. Accounts and Google sign-in

Creating an account is optional. Guests can generate one inbox without registering. If you sign in with Google, Google authenticates you and sends us an OAuth profile (typically a stable Google user id and email). We use that to create or attach a MailsByte session. We do not get your Gmail inbox and we cannot send as you.

You can disconnect Google from the account center and, if a password is set, keep using username + password. Deleting the account (or asking us to) removes the user record, sessions, API keys, and claimed mailbox ownership. Mail already expired is already gone.

6. Advertising system (Google AdSense)

Free and guest surfaces of MailsByte are ad-supported. That is how the free cockpit stays free. Premium is ad-free in the product plan matrix. Ads are served by Google AdSense under publisher ID ca-pub-1287464967555012.

6.1 Where ads may appear

• the public home page and marketing sections;
• the free / guest inbox cockpit;
• API docs and other logged-out pages that include the AdSense account meta tag;
• not inside a Premium session once ad-free is applied to that account.

We do not place ads inside the HTML of a received email. The sandboxed message body is your mail, not an ad slot. We also do not sell the content of your disposable messages to advertisers.

6.2 What Google may collect when an ad loads

When an AdSense tag runs, Google (and its certified ad partners) may process:

• page URL, referrer, and the fact that you visited a MailsByte page;
• IP address, user-agent, language, screen size, and approximate location derived from IP;
• cookie / mobile advertising identifiers (for example IDE, NID, ANID, and similar);
• whether you clicked or viewed an ad, and coarse conversion signals;
• topics or interest categories inferred from browsing, if personalized ads are allowed.

Google is an independent controller for that advertising data. Their rules are in the Google Privacy Policy and How Google uses information from sites that use its services.

6.3 Personalized vs non-personalized ads

Personalized ads use a profile or identifier to pick creatives. Non-personalized ads still use contextual signals (this page is about temporary email) and technical data such as IP for spam / fraud and geo. Even non-personalized ads are not “no data.”

You can control ad personalization here:

• Google Ad Settings
• Your Online Choices (EU/UK)
• DAA WebChoices (US)
• browser controls: block third-party cookies, use tracking protection, or a content blocker

If you opt out of personalization, you will still see ads on free MailsByte pages; they should be less tailored. Premium removes our AdSense slots instead of asking Google to forget you globally.

6.4 What we send to the ad system ourselves

• We publish the AdSense account meta tag so Google can verify the site.
• We do not upload mailbox addresses, message subjects, OTP codes, or attachments into AdSense as remarketing lists.
• We do not run a custom “user = this disposable inbox” audience.
• Page context (URL path such as /home or /inbox) is visible to the tag the same way it is on any website.

6.5 Children and restricted categories

MailsByte is not directed at children under 16. We do not knowingly run ads to child profiles. We do not use AdSense to promote illegal content. If a received email itself contains an ad or tracker from the sender, that is the sender’s page, rendered in a sandbox.

6.6 Ad fraud, invalid traffic, and logs

Google and we may drop or flag traffic that looks like bot clicks, rapid reloads, or spoofed inventory. That can use IP and user-agent for a short window. It is abuse prevention, not a marketing dossier of your disposable mail.

7. Cookies, local storage, and similar tech

You can delete cookies and site storage in the browser. Signing out clears the auth cookie we set. Clearing storage also drops the local inbox list — claim / restore is how you get Premium boxes back.

8. VirusTotal scans

Scanning is opt-in per item. If you click scan, we send the URL or file metadata / hash (and sometimes the file, depending on size and the VirusTotal API) to Chronicle / Google VirusTotal. VirusTotal may retain samples according to its own policy.

Default mode uses the MailsByte platform key. “Ultimate Security” stores your own v3 key on your user record so scans consume your quota, not ours. We never put that key in the public HTML. Do not paste a production key you cannot rotate.

9. Developer API

API keys look like mb_live_…. We store a verifier, not a display copy of the secret, after the one-time reveal. The key can create inboxes, list mail, and delete boxes within your plan limits and credit balance. Treat it like a password. Revoke it in Account → Developer if it leaks. Starter credits are granted with the account (signup, email verify, first key). Paid packs are described in the UI but are not billed until we say they are live.

10. Legal bases (EEA / UK / similar)

• Contract / requested service — creating a mailbox, delivering and showing mail, API calls you make.
• Legitimate interests — rate limits, abuse jails, security logs, keeping the free tier sustainable with ads.
• Consent — optional Google sign-in, optional VirusTotal scan, optional personal ad cookies where a consent banner is required.
• Legal obligation — responding to a valid lawful request or preserving a specific abuse report.

11. Who we share data with

• Google AdSense — advertising on free pages (section 6).
• Google OAuth — only if you click Google sign-in.
• VirusTotal — only if you start a scan.
• Hosting / VPS — the machine that runs the app, SMTP, TLS certificates, and backups of store.json.
• You / your integrations — anyone you give the address, token, or API key to.

We do not sell mailbox contents. We do not rent our user list. We may disclose a specific mailbox or account if required by law or to stop ongoing abuse against the service.

12. Retention

13. Your rights

Depending on where you live you may have rights to access, correct, delete, export, restrict, or object to certain processing, and to withdraw consent. For MailsByte:

• delete a mailbox from the cockpit to purge that box now;
• sign out and clear site data to drop local tokens and cookies we set;
• revoke API keys and remove a personal VirusTotal key in Account;
• email privacy@mailsbyte.me to request account erasure or a copy of the account record we hold;
• use the Google links in section 6.3 for ad-profile choices.

We may refuse a request that would let someone read another person’s live mailbox, or that asks us to rewrite public SMTP history we no longer have.

14. Children

The service is for people 16 or older (or the digital-consent age in your country, if higher). We do not knowingly create accounts for children. If you believe a child registered, contact us and we will delete the account and any live boxes we can still identify.

15. Security

Transport is HTTPS. Passwords are PBKDF2 hashes. Mailbox tokens are bearer secrets. The store is an application database on the server, not a public directory. No setup is perfect: if you publish a disposable address, the world can send mail to it; if you leak a session or API key, the holder can read that box. Rotate keys and let boxes expire.

16. International transfers

Servers and subprocessors (including Google) may process data in the United States and other countries. Advertising and VirusTotal transfers follow those vendors’ terms. Disposable messages may therefore leave your country for the short time they exist.

17. Changes

If we change this policy in a material way — for example a new ad partner, a longer mail retention, or a new login provider — we will update the date at the top of this page. Keep using the service after that date on the new terms, or delete your boxes and account.

18. Contact

Privacy: privacy@mailsbyte.me
Abuse: abuse@mailsbyte.me
Site: https://mailsbyte.me

← Back to inbox