Last updated October 1, 2026

Privacy Policy

The short version

We collect your name, your personal email, your chosen address, and all mail sent to your address.
Incoming mail is copied to our archive. Deleting a message hides it from you, but we may keep a copy.
Our administrators can read stored mail to run the Service, stop spam and abuse, and comply with the law.
Addresses are disposable: we may delete your account and mail at any time without notice.
We don't sell your data and don't use advertising or tracking cookies.

1. Who we are

This policy covers Ibis.email at https://ibis.email and addresses on ibis.email, run by Ibis.email (“we”, “us”). Contact: abuse@ibis.email.

2. What we collect

Account details: your full name, the ibis.email address you choose, your personal email address (to verify you and to reset your password), and your password, which we store only as a one-way hash.
Mail: every message sent to your address, including headers, sender and recipient details, subject, content and attachments. Messages may contain personal information about you or about the people who write to you.
Support requests: the messages you send us in support tickets and our replies.
Technical and security data: IP addresses and times of sign-ins, sign-up and code requests, failed attempts, and an activity log of account actions.
Cookies: a session cookie that keeps you signed in, and, if you tick “keep me signed in”, a remember-me cookie that lasts up to 30 days. We don't use analytics or advertising cookies. We ask for your consent before any non-essential cookies are used, and remember your choice in a cookie for up to 6 months. You can change it any time with “Cookie settings” at the bottom of the page.

3. How we use it

To provide the Service: create your mailbox, receive and show your mail, and let you sign in.
To verify your identity and personal email, and to send you verification and password-reset codes.
To keep the Service secure: rate limits, detecting spam, bots and abuse, and investigating reports.
To make backups, and to comply with legal obligations and lawful requests.

We don't sell your information or send you marketing. We don't use it for advertising.

4. How long we keep it

Messages are copied to our archive as soon as they reach your mailbox. When you delete a message in your inbox, it is hidden from you, but we may keep the archived copy for operational, backup, security and legal purposes, including after your account is closed.
Disposable service: we may delete your account, your messages and our archived copies at any time and without notice. Don't treat the Service as a place to keep anything you need.
Accounts used for spam or abuse are deleted, but we may keep related records as evidence.
Deleted addresses are not given to anyone else for at least 180 days, so a new owner can't receive your mail.
Security logs (failed sign-ins, codes) are kept for a short time, usually up to a few weeks. The activity log may be kept longer.

5. Who can see it

Our administrators, when needed to run the Service, answer support requests, investigate spam or abuse, restore or back up data, or comply with the law.
Our hosting provider, which stores the data on our behalf.
Authorities or affected parties, when the law requires it, or where needed to stop fraud, spam or abuse.

6. Security

We use HTTPS, store passwords as hashes, keep the real mailbox credentials encrypted on the server, limit sign-in and sign-up attempts, and show email content in a sandbox that blocks scripts. No system is perfectly secure, so please don't use the Service for confidential or sensitive mail.

7. When you open an email

Some emails load images from the sender's servers. When that happens, the sender may learn that you opened the email, and see your IP address and approximate location.

Fonts

Our pages use a font from Google Fonts, so your browser downloads it from Google's servers. Google receives your IP address and browser information when this happens. See Google's Privacy Policy.

8. Your choices and rights

You can change your name, password and recovery email in Settings.
You can ask us to delete your account, or ask what personal data we hold about you, by emailing abuse@ibis.email. We may need to verify your identity, and we may keep some records where the law allows (for example evidence of abuse).
Depending on where you live, you may have further rights under data protection law, including the right to complain to your local data protection authority.

9. Children

The Service is not for anyone under 16 (or the age of digital consent where they live). If we learn that a child has created an account, we will delete it.

10. Changes

We may update this policy. We will change the date at the top and ask you to accept the new version the next time you sign in.