Security & Privacy: Zero Logs, GDPR, 256-bit SSL
zephbox encrypts traffic in transit via TLS, auto-deletes addresses and messages when they expire, and doesn't require identifying information for free-tier use. It protects against spam and address harvesting — it does not make you anonymous to whoever you're emailing.
Every temp mail homepage says "secure" and "private." Here's what that actually covers on zephbox, in specific terms rather than badges.
Encryption in transit
All traffic between your browser and our servers runs over TLS (what most sites still label "256-bit SSL"). That protects your connection from being intercepted on the network, on public Wi-Fi for instance, but it's a baseline expectation at this point, not a differentiator. It says nothing about what happens to data once it reaches our servers, which is the part that actually matters for privacy.
What we retain, and for how long
Messages and addresses are deleted automatically once a mailbox expires. That's not a policy choice we could reverse; it's how the system is built. We don't build long-term profiles of what you've received, and free-tier usage doesn't require any identifying information to begin with. Premium accounts retain more message history by design (so you can recover something you deleted by mistake), which is a trade-off you opt into, not a default.
GDPR, in plain terms
GDPR requires not retaining personal data longer than necessary, being clear about what's collected, and giving people a way to have their data deleted. A service where mailboxes auto-delete on a timer is, by construction, aligned with the data-minimization half of that, since messages simply don't outlive their usefulness. For anything requiring an account (premium, API access), standard account-deletion rights apply the same way they would on any service handling personal data.
What this doesn't protect against
Be realistic about the threat model: a temp address stops your real email from being harvested and spammed because of a signup you didn't need to make with your real identity. It does not anonymize you from whoever you're emailing, and it can't stop that recipient from screenshotting, forwarding, or storing whatever you send. It's spam and address-hygiene protection, not a general anonymity tool, and any provider implying otherwise is overselling it.
If something feels off
Trust claims like these only mean something if there's a specific, dated policy behind them, not just a badge on a homepage. If you ever want more detail than what's here, reach out and ask. A real answer to a specific question is worth more than another trust badge.
Gmail & Outlook Temp Mail That Services Can't Block
95%+ acceptance rate for Facebook, Instagram, Netflix & OTP signups.
Try zephbox Premium →Related: our deeper blog post on this same topic, exactly what data we keep under GDPR, and the privacy risk of public temp mail inboxes.