Privacy policy
There is not much about you to protect, because we do not know who you are. This page lists exactly what exists on our side and how long it lives. Last updated 27 September 2026.
Privacy
What we store
- A fingerprint of your key. A one-way hash of a token derived from your key. It lets the server know which addresses and agents belong together. It cannot be turned back into your key, and we never receive the key itself.
- Your addresses, with a keyed hash of the site name (not the name), the creation time, and counts of received email. If you label an address, the label is stored encrypted with a key only you hold.
- Email sent to your addresses: sender, subject, text, HTML, attachments, the extracted code or link, the authentication result, and the raw message. When you first open the app, your browser makes a reading key and registers its public half with us; the private half is wrapped with your own key, and we cannot unwrap it. From then on, everything a sender writes is encrypted to your reading key as it arrives. The body and the raw message exist only in that form: we cannot read them, even while the service is running. We keep our own encrypted copy of the sender, subject and the extracted code or link for one hour, so that your agents can fetch the code; then it is wiped and only the copy you can read remains. Mail to keys that have never opened the app (API-only use) is encrypted at rest with a key held outside the database and opened only while answering you or an agent you authorised. Free: deleted 7 days after arrival. Plus: 30 days. You can delete any message, or retire an address and delete all its mail, at any time.
- Agent records: a hash of each agent key, the name you gave it, its rules, and a record of what it asked for and received, kept while the agent exists and for 30 days after.
- Operational data: rate-limit counters by fingerprint, kept for an hour and a day; abuse reports with, if given, the reporter's email, for the life of the case. IP addresses are not written to our storage: where one is needed for rate limiting it is replaced by a one-way hash that changes daily. Our application logs record errors, not requests, and keep no addresses, keys or IP addresses; Cloudflare's own edge logs are covered by its terms.
- Payment records, if you buy Plus or a developer tier: our merchant of record (currently Polar, polar.sh) tells us which plan a key fingerprint has paid for and until when, and the email address used at checkout, which we keep only as a keyed hash: it lets you move a paid plan to a new key by proving that email, and nothing else. The one-time "move your plan" link is the only email we send; it never contains a key. We never see card numbers, and the merchant of record's own privacy policy covers what it holds as the seller of record.
What we do not store
Your key. Your name. Your real email address. A password. Which sites your addresses are for, in readable form. Cookies for tracking. We do not sell, rent or share what we hold, and we do not build profiles from it.
Who else touches it
Cloudflare, Inc. carries the mail, runs the code and holds the data on our behalf, under its own privacy terms. Cloudflare Turnstile runs a silent check when you first use the service. Nobody else: the pages load no fonts, scripts, images or analytics from other companies, so a visit here is not reported to anyone. If we add analytics, it will be cookie-less and aggregate only. When paid plans open, a merchant of record (named on the pricing page and at checkout) processes payments and receives only what is needed to process a payment.
Sponsors
Free screens may show one clearly marked sponsor slot. It is a link we chose, not an advertising network: no trackers, no auction, no pop-ups, nothing inside the code card. Plus removes it.
Your rights
Because we do not know who you are, most requests are things you can do yourself: read what we hold about your key in the app, delete messages, retire addresses, or use Delete everything in Settings, which removes all mail now and the address list. If you want us to erase everything tied to a fingerprint, write to hello@singleusemail.com from a message you send to one of your own addresses, so we can verify you hold the key. Residents of the EU, UK and similar jurisdictions have the additional rights their law grants; we honour them on request.
Children
The service is not for people under 16. We do not knowingly keep data about them, and remove anything we learn of.
Changes
When this page changes in a way that matters, we say so on the home page for 30 days and update the date above.