🔐 Security & Privacy
Email validation without compromising user privacy.
TempMailChecker is built for businesses that take data protection seriously.
🧾 What data we process
TempMailChecker only needs the domain part of an email to determine if it's disposable.
When you call our API:
We internally convert this request to:
We never store, log, or inspect the full email address.
🗂 What we do NOT collect
We do not store:
- Full email addresses
- Usernames / first name / last name
- IP addresses
- User agent strings
- Referrer headers
- Request contents beyond the domain
- Email content of any kind
We also do not share data with any third parties.
🧠 What we DO store
To enforce quotas fairly, power your dashboard, and detect abuse, we store:
| Data | Reason |
|---|---|
| API key hash | Identify your account securely |
| Email (from signup form only) | Send onboarding + limit alerts |
| Request counts | Enforce daily/monthly quotas |
| Detection log (domain + result + timestamp) | Power your dashboard stats; deleted after 90 days |
Detection logs contain only the domain portion — never the full email address — and are automatically deleted after 90 days.
🔒 API key security
- API keys are hashed (bcrypt) before storage
- Keys are never logged
- Keys are never shown again after creation
- You can regenerate your key instantly at any time
🔎 Logging
Application logs contain no personal information. A typical request log looks like:
Separately, detection results (domain + boolean + timestamp, never the full address) are kept for 90 days to power your dashboard analytics, then automatically deleted.
🔐 Transport security
- HTTPS enforced (TLS 1.2+)
- HTTP requests are permanently redirected to HTTPS
- HSTS enabled
🌍 GDPR / CCPA Friendly
We are based and hosted in the EU, and our minimal-data design makes compliance straightforward:
- Only the domain portion of checked emails is ever processed and logged
- Detection logs are automatically deleted after 90 days
- Data stays in EU data centers; we never sell data
- Right to deletion — remove your account and all data at any time
Need a DPA? Data Processing Agreements are available for enterprise customers — contact us.
🧯 Data retention
We retain only:
| Data | Retention |
|---|---|
| API usage counters | Reset daily / monthly with your quota |
| Detection logs (domain + result) | 90 days, then automatically deleted |
| Account email & billing records | Until deletion request (billing records as required by law) |
You can delete your account fully at any time.
🛡 Responsible Disclosure
Found a vulnerability?
Email us at security@tempmailchecker.com — we respond within 24 hours.
We credit reporters in our changelog with their permission.
🧘 Summary
For non-technical decision-makers:
| Concern | Status |
|---|---|
| Do you store full emails? | ❌ No |
| Can you see my users? | ❌ No |
| Do you sell or share data? | ❌ Never |
| Is everything encrypted? | ✅ Yes |
| Is TempMailChecker GDPR-compliant? | ✅ Yes |
| Can we get a DPA? | ✅ Available for enterprise |
Block disposable emails without storing user data.
Get your free API key — 25 requests/day, no credit card.
🚀 Get Free API Key