Zapmail is designed with privacy in mind. This page explains how your data is handled, stored, and automatically deleted.Documentation Index
Fetch the complete documentation index at: https://mintlify.com/Parth-420/Zapmail/llms.txt
Use this file to discover all available pages before exploring further.
Data retention policy
Zapmail automatically deletes all emails after 7 days. This policy ensures:- Privacy protection - Temporary data doesn’t persist indefinitely
- Storage efficiency - The database remains performant
- Security - Reduced risk of data breaches for old emails
Automatic cleanup process
How it works
The Go backend runs an automatic cleanup job that:Deletes expired emails
All matching emails are permanently removed from the database in a single operation.
The cleanup job runs continuously in the background as a goroutine, independent of email reception and user activity.
Retention calculation
The 7-day period is calculated from thereceived_at timestamp:
- Day 0 - Email arrives and is stored with current timestamp
- Days 1-6 - Email remains accessible in your inbox
- Day 7+ - Email is eligible for deletion at the next hourly cleanup
What data is stored
Zapmail stores minimal information for each email:Database fields
Database fields
| Field | Description | Example |
|---|---|---|
id | Auto-incrementing unique identifier | 12345 |
username | Extracted from recipient address | john |
recipient | Full recipient address | <john@zapmail.parth.lol> |
raw_data | Complete raw email content | (MIME-encoded email) |
received_at | Server timestamp when email arrived | 2026-03-03 14:32:01 |
The
raw_data field contains the entire email as received by the SMTP server, including headers, body, and any attachments. This is parsed on-demand when you view emails.What is NOT stored
Zapmail does not collect or store:- User accounts or passwords
- IP addresses of inbox viewers
- Session cookies or tracking data
- Analytics about email viewing behavior
- Backup copies of deleted emails
There is no user authentication system. The username in the URL is the only identifier used to retrieve emails.
Privacy considerations
No authentication
Zapmail addresses are not password-protected:- Anyone who knows a username can view emails sent to
username@zapmail.parth.lol - There’s no way to “claim” or “lock” a username
- Previously used usernames may be reused by others after emails expire
Address reuse
Because there’s no registration:- You create a temporary address by simply entering a username
- After 7 days, all emails to that address are deleted
- Someone else could use the same username and receive new emails
- They won’t see your old emails (which are permanently deleted)
For better privacy, use random or unique usernames rather than common names or predictable patterns.
Database security
Emails are stored in a PostgreSQL database (Supabase):- Encrypted connections - Communication with the database uses SSL/TLS
- Managed infrastructure - Supabase handles database security patches and updates
- No backups - Deleted emails are not recoverable from backups
Connection security
The Go backend connects to the database using:- Environment variable for connection string (not hardcoded)
- PostgreSQL’s native connection pooling
- Standard SQL parameterized queries (prevents SQL injection)
SMTP security
The custom SMTP server:Security features
Security features
- Validates SMTP command syntax
- Logs all connection attempts
- Handles connection errors gracefully
- Prevents buffer overflow with line-by-line reading
- Limits data collection to standard SMTP terminator (single period)
Security limitations
Security limitations
- No TLS/SSL encryption for incoming SMTP connections
- No sender authentication (accepts mail from anyone)
- No SPF/DKIM verification
- No spam filtering or malware scanning
Receiving-only service
Zapmail is designed exclusively for receiving emails:- You cannot send emails from a Zapmail address
- The SMTP server only accepts incoming mail (port 25/2525)
- There’s no outbound SMTP functionality
- Spam abuse from Zapmail addresses
- Email spoofing or phishing attacks originating from the service
- Relay attacks using Zapmail as an intermediary
Best practices
To use Zapmail safely:Use for non-sensitive purposes
Only use Zapmail for:
- Testing email functionality
- Disposable signups for services you don’t trust
- Avoiding newsletter spam on your primary email
Choose unique usernames
Use random or hard-to-guess usernames rather than common names to reduce the chance of someone else accessing your emails.
Act within 7 days
Retrieve any needed verification codes or information before the automatic deletion occurs.
Permanent deletion
When emails are deleted:- They are removed from the database using
DELETE FROM emails - The database transaction commits immediately
- There are no soft deletes or archive tables
- Recovery is impossible
If you need to keep information from a Zapmail email, copy it elsewhere before the 7-day retention period expires.