Privacy

NRTHMAIL (nrthmail.com) is a disposable inbox service. For anything about this policy, write to abuse@nrthmail.com.

• Inbox. The address, a SHA-256 hash of its token (never the token itself), and when it was created, last used and will expire. Kept while the inbox is in use and for 24 hours after.
• Mail. Each message as received (the raw .eml file), the fields shown in the reader, and its attachments. Deleted when the inbox expires or is burned, when the message is 7 days old, or when it is pushed out as the inbox passes 100 messages, whichever comes first. Mail is not archived or backed up.
• Closed addresses. After an inbox expires or is burned, the address, the token hash and the dates stay for 30 days, so nobody else can claim the address and receive mail meant for you. Then the record is deleted.
• Duplicate check. A one-way fingerprint of recipient and message, kept 48 hours so the same mail is not stored twice.
• Delivery queue. If our server is briefly unreachable, incoming mail waits in Cloudflare storage until it can be delivered, at most 3 days, and is removed once delivered.
• Counters. The number of messages and inboxes in the last 24 hours. No per-person data.
• Server logs. Time, method, path and status of requests, used only to find and fix faults. They contain no message content and no tokens, and are kept for at most 14 days.

There are no accounts, so no names, passwords or phone numbers. No analytics, no advertising, no tracking pixels, no fingerprinting, no third-party scripts, no third-party fonts. Nothing is sold or shared for marketing. Nobody at NRTHMAIL reads inbox contents; the only exception is a specific abuse report, where we may look at the reported message to act on it.

The page stores, in your browser’s local storage: the keys and addresses of up to 8 inboxes (nrth.inboxes), which one is open (nrth.active), your Day/Night choice (nrth.theme) and the example language you picked on the API page (nrth.docs.lang). One cookie, lang, remembers your language for a year, and only if you switch language. Nothing here is sent anywhere except the inbox key, to our API, to open your inbox. “Forget” removes one inbox key; clearing site data removes all of it.

Senders often hide tracking images in mail. NRTHMAIL blocks remote images by default, so opening a message does not tell the sender anything. If you choose “Load images”, your browser fetches them from the sender’s servers, and those servers see your IP address.

Cloudflare provides DNS, TLS, protection against attacks, and receives mail for nrthmail.com before handing it to our server. Traffic and mail pass through Cloudflare’s network in transit, under Cloudflare’s own privacy policy. The site itself loads nothing from any other company.

All traffic is encrypted. Tokens are stored only as hashes. Message HTML is sanitized and shown in a sandbox, and download links are signed and expire after an hour.

“Burn inbox” deletes an inbox and all its mail immediately. “Forget” removes an inbox key from this browser. Because there are no accounts, we cannot link any data to you as a person; if you have a question about a specific address, write to us and include it.

We answer valid legal requests, but because mail is deleted within days, there is usually nothing left to hand over. NRTHMAIL is not meant for children under 16.

When this policy changes, the new version appears on this page with a new date.