🇩🇪 🇬🇧 🇫🇷 🇪🇸 🇷🇺 🇸🇦 🇨🇳

Privacy

1. Data controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Steffen Uhlig
Koppoldstraße 1
86551 Aichach
Email: info@mail4free.net

Full details (commercial register / VAT ID, if applicable) can be found in the legal notice.

2. What data we process, and on what legal basis

  • Temporary alias addresses and received emails: randomly generated or freely chosen. An email necessarily also contains data of the sender (sender address, name, subject, content, attachments) and technical headers. Legal basis: Art. 6(1)(b) GDPR (performing the service you requested) or Art. 6(1)(f) GDPR (legitimate interest in operating the service and in receiving messages for the respective address). Incoming emails of temporary addresses are held by our application exclusively transiently in memory (RAM) and are not stored in the database or on data carriers; for technical reasons a message remains in the collection mailbox of the mail server (see section 5) only until our application retrieves it. This data is automatically and irreversibly deleted once the lifetime of the address expires (it is lost immediately if the memory service is restarted) - no account required.
  • Account data (registration only): email address, a hashed password (we never store passwords in plain text), and the time of registration and last login. Legal basis: Art. 6(1)(b) GDPR (contract for using the account).
  • Permanent aliases (Alias Vault): addresses stored for registered users, including label/tag, optional forwarding target address and optional Telegram chat ID or Discord webhook URL - each only if you fill in these fields yourself. Only the emails of permanent aliases of registered users are stored in the database for long-term availability. Legal basis: Art. 6(1)(b) GDPR.
  • Share links (optional): If, as a registered user, you create a read-only link to an inbox, anyone who knows the link can view that inbox until it expires or is revoked. You pass the link on yourself and can revoke it at any time. Legal basis: Art. 6(1)(b) GDPR.
  • Logging when pages are accessed (server logs, rate limiting): On every access to our website the web server automatically logs: IP address, date and time, requested address (URL), HTTP status code, amount of data transferred, the previously visited page (referrer, where transmitted) and browser and operating system identifier (user agent). This data is processed to prevent abuse, troubleshoot errors and ensure operation - on our server at our hosting provider (see section 5). The server log files on our server (web server and mail server) are automatically deleted after 7 days. The application itself creates no visitor logs or user profiles and performs no audience measurement. When emails are received, the mail server also logs technically customary connection data (e.g. IP address of the delivering server, timestamp, sender and recipient address). For rate limiting we store only a non-reversible hash of your IP address in the database, which is automatically deleted after one hour at the latest. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, abuse-free and stable operation).
  • Donations (voluntary): handled exclusively via PayPal; no donation data is stored by us (see section 5).
  • Contacting us: see section 12.
  • Cookies: see section 4.

You are not obliged to provide personal data; without registering you can use the service without telling us anything about yourself. Only the connection data that arises when you load a page is technically necessary.

3. What we use data for

Solely to provide the service: delivering emails to the right mailbox, showing them in your inbox, optional forwarding or notification to the destinations you specify, and protection against abuse. There is no tracking for advertising purposes and no sale of data to third parties. The displayed spam score is calculated locally on our server using simple patterns and serves only as a hint for you; no content is sent to external spam-checking services. We do not read your emails and do not analyse their content. In normal operation there is no database access to emails of temporary addresses held transiently in memory; they are not stored there. Administrators technically have access to the data stored in the database (accounts and emails of permanent aliases); access happens only on a case-by-case basis, e.g. on suspicion of abuse, to fix faults, or due to a legal obligation.

4. Cookies / local storage

We set one technically necessary session cookie to recognise you during a visit (e.g. which temporary address you are currently using, the selected language, CSRF protection for forms). It ends automatically when you close the browser or after a short period of inactivity. Under Section 25(2) no. 2 of the German TDDDG (formerly TTDSG) no consent is required for this cookie because it is technically necessary for the service you requested; further processing is based on Art. 6(1)(f) GDPR. No tracking, marketing or analytics cookies are set and no local storage is used for tracking.

5. Hosting, donations and external content

Hosting: The service and the associated mail server run on a server in a data centre in Germany. Our hosting provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner; Hetzner processes data only on our instructions. Incoming emails are briefly stored in a collection mailbox on the mail server, retrieved by our application and then deleted from the collection mailbox. The application then holds emails of temporary addresses exclusively in memory (RAM); only emails of permanent aliases of registered users are stored in the database.

Fonts and scripts (local): All fonts (Inter, Sora), the PDF library (jsPDF) and the QR code library are delivered from our own server. No Google Fonts, no external content delivery network and no third-party tracking or analytics scripts are embedded - so your IP address is not transmitted to Google or other font providers when you load our pages. Creating PDF files and QR codes happens exclusively in your browser.

External content only on your action or for advertising: Images in received emails are blocked by default (protection against tracking pixels). If you click "Load images", they are loaded directly from the sender's server, which technically receives your IP address (legal basis: Art. 6(1)(a) GDPR - your action). If an advertisement is displayed on the home page, its image may be loaded from the advertising partner's server (your IP address is transmitted to it; legal basis: Art. 6(1)(f) GDPR - financing the free service). The ad is labelled as such; we do not embed tracking scripts for it. A click opens the advertising partner's site in a new tab, from then on its privacy policy applies.

Donations via PayPal: Our website contains a donate button (e.g. in the header or as a hint in the inbox). Clicking it opens the PayPal donation page (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg) in a new window. Only from that moment is data (in particular your IP address and technical connection data) transmitted to PayPal; the legal basis is your voluntary action (Art. 6(1)(b) or (a) GDPR). PayPal's privacy policy applies; PayPal is an independent controller. Without a click, no data is transmitted. All payment processing takes place at PayPal. No donation data (e.g. name, amount, payment details) is stored on our server or in our database, and donors are not linked to accounts or aliases.

6. Disclosure to third parties / transfers outside the EU

Data is disclosed only if you trigger it actively - for example by entering a forwarding address, a Telegram chat or a Discord webhook:

  • Forwarding: If forwarding is enabled, we send the content (text) of incoming emails to the target address you specified. The provider of that mailbox is responsible for the processing there.
  • Telegram/Discord: Here we transmit only a short notification with the alias address, sender and subject - never the content of the mail. We send a test message only when you click.

Telegram (Telegram FZ-LLC, United Arab Emirates) and Discord (Discord Inc., USA) process data outside the EU/EEA, possibly in countries without a level of data protection equivalent to EU law; authorities there may under certain circumstances access data, and data subject rights may be harder to enforce. By entering a chat ID or webhook URL yourself, you expressly consent to and knowingly initiate this transfer (legal basis: Art. 6(1)(a) and (b) GDPR in conjunction with Art. 49(1)(a) and (b) GDPR). You can withdraw your consent at any time with effect for the future by clearing the field and saving. We have no influence on the data processing by Telegram/Discord itself; their own privacy policies apply (Telegram, Discord).

Beyond that, we disclose data only where we are legally obliged to do so (e.g. due to an order from an authority or court) or where necessary to prevent abuse and to pursue legal claims (Art. 6(1)(c) or (f) GDPR).

7. Retention period

  • Temporary aliases including emails: held in memory only and automatically deleted once the lifetime of the address expires (see FAQ; the operator configures the lifetime).
  • Permanent aliases and account: kept until you delete them or delete your account. Deleting the account irreversibly removes the account, aliases and all emails stored in them.
  • Rate-limiting hashes: one hour at most.
  • Server log files (web server, mail server): automatically deleted after 7 days.
  • Backups: If the hosting provider creates backup copies, database data (accounts, permanent aliases and their emails) may remain there for the duration of the backup cycle and is then overwritten in rotation. Emails of temporary addresses held in memory are not affected.

8. Your rights

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out until then remains unaffected.

Right to object under Art. 21 GDPR: Where data is processed on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Since most functions can be used without an account and without personal master data, you can delete temporary aliases yourself at any time; registered users can remove their account in the dashboard and export their inbox as a ZIP (data portability). For any other requests, please use the contact details in item 1. Note: temporary addresses are not tied to a person; we can therefore only provide information about such an address if you name it and make it credible that it belongs to you (Art. 11, 12(2) GDPR).

9. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR - in particular with the authority in the member state of your habitual residence, place of work or place of the alleged infringement. A list of the EU supervisory authorities is available here; German authorities are listed here.

10. Data security

We take technical and organisational measures under Art. 32 GDPR, including: encrypted transmission via TLS (HTTPS), password hashing, CSRF protection, rate limiting against abuse, blocking of internal directories, sanitising of HTML content in emails and blocking of external images. Please note: emails are not end-to-end encrypted, and temporary addresses are not password-protected - anyone who knows or guesses the address can open the inbox. Therefore do not use such addresses for sensitive content.

11. No automated decision-making

There is no decision-making based solely on automated processing, including profiling within the meaning of Art. 22 GDPR, that produces legal effects concerning you or similarly significantly affects you. The spam score is a display hint only.

12. Contacting us

If you contact us by email, we process your details (email address, content of the message) to handle your enquiry (Art. 6(1)(b) or (f) GDPR) and delete them once the enquiry is resolved and no statutory retention obligations apply.

13. Currency and changes to this policy

Last updated: October 2026. We adapt this privacy policy when the service or the legal situation changes. The version published here applies.

The German version of this privacy policy is legally binding; translations are for information only.