Privacy Policy

1. Who we are

Mailly (mailly.xyz) is a free disposable email service operated by Mailly, based in British Columbia, Canada. You can reach us through the contact form. This policy explains what we collect, how we use it, and your rights.

2. What we collect

We keep the absolute minimum we need to run the service:

• Received email contents. Subject, body (text and HTML), and sender details for every message delivered to a Mailly address. Stored briefly and deleted automatically.
• Your current disposable address. Saved in your browser's localStorage so the page remembers it between reloads. Never sent to us beyond what's needed to fetch your messages.
• IP address. Logged momentarily for rate limiting (preventing abuse of the "new address" endpoint and the contact form). Not stored long-term.
• Cookie consent choice. Saved in your browser's localStorage so we don't ask again.
• Contact form submissions. If you write to us via the contact form, we receive your message and any name or reply-to email you provide. We keep these only as long as needed to respond.

We do not require an account, ask for your real email, or track you across other sites.

3. Third-party services we use

• Cloudflare — handles DNS, DDoS protection, and our Turnstile bot challenge. Cloudflare sees your IP when you visit. See Cloudflare's privacy policy.
• DigitalOcean — hosts the server that receives mail and serves this site. See DigitalOcean's privacy policy.
• Google AdSense (only if you accept advertising cookies) — shows ads and may use cookies for personalization. See Google's privacy policy and how Google uses information from sites that use their services.
• Google (SMTP relay) — when you submit the contact form, we send the message through Google's SMTP servers so we can read it. Google handles the message in transit per its privacy policy.
• Let's Encrypt — issues the TLS certificate for HTTPS. No personal data shared.

4. How long we keep things

• Received emails: automatically deleted 1 hour after receipt.
• Per-inbox cap: max 50 messages per disposable address, oldest evicted first.
• IP addresses: kept in memory for ~1 minute for rate-limiting, then discarded.
• Contact form messages: retained only as long as needed to reply, then deleted.
• LocalStorage items in your browser: stay until you clear your browser data, switch devices, or visit again past expiry.

5. Cookies and similar technologies

We use the following:

• Strictly necessary — Cloudflare Turnstile sets short-lived cookies/tokens to verify you're a real visitor. Without these, the site won't work.
• Analytics (only if you accept) — anonymous usage stats to help us improve.
• Advertising (only if you accept) — Google AdSense cookies for ad personalization and frequency capping.

You can change your choices any time via "Cookie Settings" in the footer.

6. Legal basis (EU/UK/EEA visitors)

Under GDPR, our legal bases are:

• Legitimate interest — for delivering the service, preventing abuse, and keeping it secure.
• Consent — for analytics and advertising cookies (you can withdraw any time).

7. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct or delete it
• Object to or restrict processing
• Withdraw consent
• Lodge a complaint with your data protection authority

Because Mailly deletes inbox contents within an hour and never asks for identifying information, most of these rights are exercised automatically. For anything else, use the contact form.

8. Canada (PIPEDA & BC PIPA) and California (CCPA)

Mailly is operated from British Columbia, Canada and complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and BC's Personal Information Protection Act (PIPA). We don't sell personal information. We don't share it with third parties for advertising purposes except through the consent-gated ad partners disclosed above. California and Canadian residents have rights to know, delete, and (in California) opt out of the sale or sharing of their personal information.

9. Children

Mailly is not intended for users under 13 (or under 16 in some EU countries). We don't knowingly collect data from children.

10. Changes to this policy

If we change this policy, we'll post the updated version here. Material changes will be announced on the homepage for a reasonable period.

11. Contact

Questions about this policy? Use the contact form.