Privacy Policy

1. Who we are

Postli.io is a temporary email and testing tool operated in the United Kingdom. We act as the data controller for personal data collected through this service.

Privacy contact: [email protected]

2. Data we collect

We collect only what we need to run and protect the service.

Account data

• Username
• Hashed password (we never store plain-text passwords)

Service data

• Temporary mailboxes and aliases you create
• Email content routed through temporary mailboxes (stored only short-term until expiry)
• Usage metrics, such as number of emails sent/received per day and basic tool usage

Security & abuse protection

• IP addresses and basic network information (e.g. ISP)
• Approximate location such as country/city
• Logs of login attempts, rate limits, and suspicious activity
• Banned IPs and reasons for the ban (where applicable)

3. Data we do not intentionally collect

• No real names are required (unless you choose to use one as your username).
• No phone numbers.
• No long-term storage of message content (temporary emails are deleted after expiry).
• No marketing profiles or advertising trackers.
• No payment card details (the service is currently free).

4. How we use your data

We use your data to:

• Provide the core features (temporary mailboxes, aliases, inbox and tools).
• Authenticate you and manage your sessions.
• Enforce quotas and rate limits to keep the service stable.
• Detect, investigate, and prevent abuse, spam, or attacks.
• Comply with legal obligations, where applicable.

We do not sell your data to third parties. We may share limited data with infrastructure providers (e.g. email hosting, logging, or analytics tools) solely to operate the service; these providers act as processors on our behalf.

5. Temporary email handling & retention

• Temporary mailboxes, aliases, and their email contents are automatically deleted after expiry or when removed.
• System and security logs (including IP activity and rough location) may be retained longer to protect the service and comply with legal requirements.
• Backups may temporarily retain deleted data as part of normal backup rotation but are not used for profiling or marketing.

6. Legal basis under UK GDPR

We process your data under the following legal bases:

• Contract – to create and maintain your account and provide the service you signed up for.
• Legitimate interests – to protect the service against abuse, improve stability, and enforce reasonable usage limits.
• Legal obligation – where we are required to retain or share data by law or a valid legal request.

7. Your rights

Subject to legal limits, you may have the right to:

• Request access to the personal data we hold about you.
• Ask us to correct inaccurate or incomplete data.
• Request deletion of your account and associated data, where possible.
• Object to or request restriction of certain types of processing.
• Lodge a complaint with the UK Information Commissioner’s Office (ICO).

To exercise your rights, contact [email protected].

8. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we’ll update the “Last updated” date at the top. If changes are significant, we may also notify you within the service.