Privacy policy
Buzón temporal is built so you don't have to give your details to anyone: there are no accounts, passwords or forms asking for your name. This policy explains the little data that is processed to make the service work, for how long and with whom.
Controller
The controller is Buzón temporal (buzontemporal.com). For any privacy matter, including exercising your rights, write to privacidad@buzontemporal.com.
What data we process
The mailbox and its messages
- Your mailbox's address, generated by the service or chosen by you.
- The messages it receives: sender, recipients, subject, a preview and the message body. Attachments are removed on arrival and never stored.
This data exists only while the mailbox lives (60 minutes, renewable) and is deleted with it. Keep in mind that messages are written by third parties: they contain whatever data the sender puts in them.
Technical data
- Your IP address, used transiently, in memory, to enforce usage limits and prevent abuse (requests per minute and mailboxes created per hour), and sent to Cloudflare Turnstile to check you're a person when you create a mailbox.
- The servers' technical logs, which contain internal identifiers (of mailboxes and messages) and error details, but not mailbox addresses or message content.
We don't process your name, phone number or real email address, and we don't build profiles.
Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Giving you the mailbox and showing you the mail it receives | Mailbox address, messages, session cookie | Providing the service you ask for (Art. 6(1)(b) GDPR) |
| Security, usage limits and abuse prevention | IP address, Turnstile check, technical logs | Legitimate interest in keeping the service secure and available (Art. 6(1)(f) GDPR) |
| Aggregate usage statistics | Generic page paths and events with no personal data | Legitimate interest in knowing how the service is used (Art. 6(1)(f) GDPR) |
| Remembering your preferences | Language and theme | Providing the service (Art. 6(1)(b) GDPR) |
How long we keep it
| Data | Period |
|---|---|
| Mailbox address and messages | While the mailbox lives (60 minutes from creation or the last renewal); usually deleted within a minute of expiring, when you ask for a new mailbox, or when you delete a message |
| Attachments | Not stored: removed on arrival |
| IP address for usage limits | In memory, up to an hour |
| Session cookie | As long as the mailbox |
| Language cookie | One year |
| Technical logs | Rotated and overwritten automatically (a few tens of MB per service) |
As a technical safeguard, if a failure prevents a message from being processed normally, its copies are deleted automatically within 7 days at most (inbound queue) or 31 days (the message storage's deletion rule). A deleted message's internal identifier, without address, sender or subject, is remembered for 7 days so it can't reappear. Some internal usage counters that include the part of the address before the @ expire on their own about 5 minutes after their last use.
The tables holding temporary mailboxes and messages are excluded from the database backups, and the message storage has no backups.
Where it's stored
Mail is received and stored by Mailingest, the mail platform Buzón temporal runs on, which is operated by the same owner:
- Message bodies (without attachments) are stored in Cloudflare R2, in a private bucket located in Western Europe.
- The mailbox address and the messages' metadata (sender, subject, preview) are stored in a PostgreSQL database on Hetzner servers in Germany.
Who we share data with
We don't sell or give your data to anyone. Only these providers are involved, as processors:
- Cloudflare: the website's content delivery network and proxy (all traffic goes through it), Turnstile verification and R2 storage.
- Hetzner: servers in Germany running the website, the API, the mail platform and its database.
- onedollarstats: cookieless usage statistics. It only receives generic paths (for example,
/enor/en/[message]), never mailbox addresses or message identifiers, and events with no personal data (for example, that a mailbox was created). Like any web server, it receives the browser's request, with its IP address and user agent.
International transfers
Cloudflare is a company based in the United States. Where its services involve transferring data outside the European Economic Area, they rely on the standard contractual clauses approved by the European Commission and on the EU-US Data Privacy Framework.
Cookies and local storage
Buzón temporal uses no advertising or tracking cookies.
| Name | Type | Purpose | Duration |
|---|---|---|---|
bt_mailbox | Technical cookie, strictly necessary | Identifies your mailbox: it's signed, only the server reads it (HttpOnly) and it's never shared | As long as the mailbox |
locale | Preference cookie | Remembers the language you view the site in | One year |
theme | Local storage | Remembers the light or dark theme | Until you clear it |
bt:marks:… | Local storage | Remembers which messages you've read or pinned | Until you clear it |
Local storage stays in your browser and is never sent to the server. Cloudflare Turnstile may collect browser signals for its check, under its own privacy policy.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to privacidad@buzontemporal.com. As there are no accounts, to find a mailbox's data we'll need its address while it's still active; once it expires, its data no longer exists.
You can also delete your data yourself at any time: delete the messages, ask for a new mailbox or let it expire, and clear your browser's cookies and local storage.
If you think we haven't handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es) or the supervisory authority where you live.
Children
The service is not directed at children under 14, the minimum age in Spain to consent to the processing of their data.
Changes to this policy
We may update this policy when the service or the law changes. The date of the last update is shown above.