LEGAL
Privacy Policy
Last updated: October 13, 2026
The short version
Temporary inboxes need no account, and emails are deleted after 30 minutes. If you sign in with GitHub for a free API key, we keep your GitHub username and email address until you delete your account, and your GitHub user ID for 30 days after that. We don't sell data, we don't use advertising trackers, and we don't try to identify individual people. We do keep some metadata — which domains send mail, inbox names, and basic request details — to run the service, understand how it's used, and stop abuse. This page lists exactly what, and for how long.
What we collect
Free tier: No account and no cookies, unless you sign in for an API key. The dashboard generates a random inbox name in your browser and remembers it in localStorage. We don't know who you are unless you tell us. Free API keys: If you sign in with GitHub to get a key, we receive and store your GitHub user ID, username and primary verified email address, along with the inbox prefix we assign you, a one-way hash (SHA-256) of your key, and the key's last four characters so you can tell which key is active. We never store the key itself or your GitHub access token: the token is used during sign-in to read those details, and we ask GitHub to revoke it straight away. Signing in uses two cookies: one that protects the sign-in itself and expires after 10 minutes, and one that keeps you signed in for up to 30 days. Neither is used for tracking. When you use an inbox, we record: the inbox name; the client source tag your library sends (for example go-sdk or mcp); your client's user agent; and, for mail you receive, the sender, subject line, and timestamps. These records power our internal usage analytics and abuse detection. Waitlist: If you join the Workspaces waitlist, we store your email address to notify you when Workspaces launch. Workspaces subscribers: Name, email address, and billing information collected at checkout. Payment card data is handled exclusively by Dodo Payments — we never see or store your card details. Our infrastructure providers also keep standard request logs (IP address, user agent, request path) — see Data retention.
Payment processing
Payments for Workspaces are processed by Dodo Payments, who acts as the Merchant of Record for all subscriptions. Your payment card information is handled by Dodo Payments and is subject to their privacy policy. We do not store or have access to your payment card details.
What we don't collect
We do not use advertising trackers, third-party analytics scripts (Google Analytics, Mixpanel, etc.), fingerprinting, or cookies other than the sign-in cookies described above. ZeroDrop's SDKs, MCP server, and GitHub Action send no telemetry — the only network requests they make are the API calls you invoke.
Email content and metadata
Emails sent to @zerodrop-sandbox.online are stored for up to 30 minutes, then deleted automatically by a TTL. We do not read email content, and content is never retained past the TTL. Extracted one-time codes and verification links are stored with the email and deleted with it; they are never written to logs. Our systems process each message automatically to operate the service: recipient validation, rejecting mail from blocked senders, counting each sender's daily allowance, and extraction of one-time codes and verification links. No AI model processes your email. Inboxes under an API key's prefix can be read only with that key. Other inboxes can be read by anyone who knows their name. We use message metadata (sender domain, subject line, timestamps) to understand usage — including which organisations send test mail to ZeroDrop — and to detect abuse.
How we use this information
To operate the service, including your account and API key; to detect, investigate, and prevent abuse; to understand usage and improve ZeroDrop; and, occasionally, to contact an organisation whose domain appears in mail sent to ZeroDrop — through its public contact channels — for example to point out a delivery or authentication problem we noticed, or to ask about its use of the service. If you'd rather we didn't contact you, email [email protected] and we won't. We use the email address on an API key account only to write to you about that account or the service — for example, a problem with your key or a change to free-tier limits.
When we share information
We don't sell or rent data. We share it only: — With the infrastructure providers that run ZeroDrop (Cloudflare, Upstash, Vercel, and Dodo Payments for billing), to operate the service — With a platform whose service is being abused through ZeroDrop, limited to the evidence it needs to act — such as timestamps, sender and recipient metadata, and request metadata (IP address, user agent). We never share email bodies or one-time codes — Where required by law
Waitlist data
If you previously joined the Workspaces waitlist, your email address is stored in our database. You can request deletion at any time by emailing [email protected].
New Workspaces customers go through Dodo Payments checkout directly. Your name and email provided at checkout are used solely for account setup and billing communication.
Data retention
Temporary inbox emails, including extracted codes and links: deleted automatically after 30 minutes. Daily allowance counters (inbox names and the sending domain, or the sending address for consumer mailbox providers): deleted automatically after 2 days. API key accounts (GitHub user ID, username, email address, inbox prefix, key hash and last four characters): kept until you delete the account on the API keys page, which removes them at once. The prefix is retired, never given to another account. We keep only the GitHub user ID for 30 more days, so the same GitHub account can't create and delete accounts in a loop. If we suspend an account for abuse, we keep its records while they're needed to prevent further abuse. Sign-in cookie: up to 30 days, or until you sign out. Server and worker logs (which can include sender, recipient, subject line, and request metadata): retained for up to 7 days, then deleted by our providers. Usage and abuse records (inbox names, source tags, user agents, sender domains): kept while useful for abuse detection and service analytics; deleted on request. Waitlist emails: retained until Workspaces launch or until you request deletion. Workspaces subscriber data: retained for the duration of the subscription and up to 90 days after cancellation for billing records.
Your rights
You have the right to request access to, correction of, or deletion of any personal data we hold about you. You can delete an API key account yourself on the API keys page. For anything else, email [email protected]. We will respond within 30 days.
Security
All data is transmitted over HTTPS. Stored data is encrypted at rest by our infrastructure providers (Vercel, Upstash, Cloudflare), each with its own security certifications. API keys are stored only as one-way hashes, plus their last four characters. Payment processing is handled by Dodo Payments with PCI DSS compliance.
Changes to this policy
If we make material changes to this policy, we will update the date at the top of this page. We will not retroactively reduce your privacy rights without explicit notice.
Contact
Questions about this policy? Email [email protected].