Legal

FreeGmail Privacy Policy

Effective date: October 15, 2026 · Last updated: October 15, 2026

In plain English: we collect only what we need to give you temporary inboxes, your account, plans, support and the Developer API. If you sign in with Google we receive only your name, email address, Google account ID and profile picture — never your Gmail, Drive, Contacts or Calendar. We don't sell your data, and Google sign-in data is never used for ads or AI training. Questions? Email support@freegmail.com.

1. Who We Are and Contact Details

• Service name: FreeGmail
• Website: https://freegmail.com
• Operator (data controller): FreeGmail, operated through freegmail.com
• Privacy contact: support@freegmail.com
• Effective date and last updated: October 15, 2026

This Privacy Policy explains what personal information FreeGmail ("we", "us") collects, why we collect it, how Google Sign-In works, what Google user data we access, how information is used, stored, shared, protected and deleted, and what choices you have.

2. Scope of This Policy

This policy applies to everyone who uses https://freegmail.com:

• Public visitors who read our pages.
• Anonymous users who create free temporary inboxes without an account.
• Registered users who sign in with email/password or with Google.
• Premium subscribers who buy a plan.
• Developer API users who create API keys and use the FreeGmail API.

It does not cover websites or services run by others, even when we link to them (see section 19).

3. What FreeGmail Does

• Temporary inboxes: generate a short-lived email address and read messages sent to it, such as verification codes (OTP), sign-up links and newsletters.
• OTP receiving: the app highlights codes and links found in received messages so you can copy them.
• Saved inboxes: signed-in users can keep addresses in their account and come back to them.
• Accounts: email/password or Google sign-in, needed for saved inboxes, premium plans, support and the Developer API.
• Subscriptions and payments: premium plans are paid with cryptocurrency (USDT, USDC or Litecoin) and activated after the payment is verified.
• Support: tickets on the Contact page, where an automated assistant may reply first.
• Developer API: programmatic inbox creation and reading, paid from a prepaid credit wallet.

The Service must only be used for inboxes you create for yourself and accounts you own.

4. Information You Give Us

• Registration: your email address and password. Passwords are handled by our authentication provider (Supabase Auth) and stored only as one-way hashes; we never see your plain password.
• Google Sign-In: your name, email address, Google account ID and profile picture URL (section 5).
• Support: the messages you write and any images you attach to the support chat.
• Payments: the plan or deposit you choose, the blockchain transaction hash or reference you submit and, where a method asks for it, a payment screenshot you upload.
• Developer API: the labels you give your API keys.

5. Google Sign-In and Google User Data

This section answers exactly what we do with data received from Google.

5.1 Which Google scopes we request

When you click "Continue with Google", our app asks Google only for the standard sign-in scopes: openid, email and profile. We do not request any other Google API scope and we do not request offline access to your Google account.

5.2 Which Google data we receive and why

• Email address: to create your FreeGmail account, identify it, sign you in and contact you about your account.
• Name: to show your name in your dashboard and support chat.
• Google account ID (the "sub" identifier): to link your Google account to the same FreeGmail account each time you sign in.
• Profile picture URL: to show your avatar inside the app.
• Email-verified flag: to confirm the address belongs to you.

5.3 What we do not access

We do not access your Gmail messages, Google Drive files, Google Contacts, Google Calendar, YouTube or any other Google data. Our scopes do not allow it. The temporary inboxes FreeGmail provides are separate addresses and are not connected to your Google mailbox.

5.4 How Google data is processed and stored

• Google sends the data above to Supabase Auth, our authentication provider, after you approve the consent screen.
• Supabase Auth stores it in our user authentication records. Your email address and display name are also copied to your FreeGmail profile record in our database.
• A sign-in session token is then stored in your browser's local storage so you stay signed in.
• We keep this data for as long as your account exists. When the account is deleted, the authentication record and the linked profile are deleted.

5.5 Who Google data is disclosed to

Google user data is shared only with Supabase, which processes it on our behalf to sign you in and store your account. We do not give it to advertisers, data brokers, the AI support provider or any other third party, except where required by law or as part of a merger or acquisition with notice to you.

5.6 What Google data is never used for

• Google user data is not sold.
• It is not used for advertising, including personalised or interest-based ads, and is not shared with Google AdSense.
• It is not used to develop, improve or train generalised or non-personalised AI or machine-learning models.
• It is not used to decide credit-worthiness or for lending.
• People do not read it, except with your explicit consent (for example when you ask support to look at your account), when needed for security such as investigating abuse, or to comply with law.

5.7 Revoking Google access and deleting your data

• Revoke access at any time at https://myaccount.google.com/permissions. This stops Google from sharing data with us in future but does not by itself delete your FreeGmail account.
• To delete your account and the Google data linked to it, follow section 18.

5.8 Google API Services User Data Policy — Limited Use disclosure

FreeGmail's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

6. Information Created When You Use the Service

• Inbox data: generated addresses, creation and expiry time, and the messages delivered to them (sender, subject, message body, received time and extracted codes or links).
• Saved inboxes: addresses you choose to keep in your account.
• Account data: profile record, account status, role and the date you joined.
• Subscription and wallet data: plan, start and end date, status, wallet balance, credit ledger entries and API usage records.
• Developer API keys: stored only as hashed values plus a short visible prefix.
• Payment records: method, amount, transaction hash or reference, status and review notes.
• Support history: your messages, attachments and replies from our team or the AI assistant.
• Push notifications: if you allow browser notifications, your browser's push subscription (endpoint and keys).
• Technical data: a random device identifier stored in your browser, your IP address when the Service sends sign-up, verification or password-reset emails, online/presence status while you use the site, and IP address and browser details in hosting and error logs.
• Anonymous usage counts: when buttons such as "get inbox" or "buy plan" are clicked we record the event name, page path and time. These events contain no account, IP address or device identifier.

We do not knowingly collect special categories of personal data. Please do not send such data to a temporary inbox.

7. Why We Use Information

• Authentication and account management: create your account, verify your email and sign you in.
• Inbox delivery: generate inboxes, fetch and display their messages and extract codes.
• Saved inboxes: keep the addresses you choose.
• Subscriptions and payments: verify payments, activate plans and credit wallets.
• Developer API: authenticate API keys, charge credits and show usage.
• Support: answer your questions, including AI-assisted replies.
• Notifications: send browser notifications you turned on.
• Security and fraud prevention: limit abuse (for example daily email-sending limits per device and IP), suspend misuse and keep the Service working.
• Legal compliance: keep records we are required to keep and respond to lawful requests.

We do not sell personal information and we do not use inbox contents for advertising, profiling or AI training.

8. Email Contents and Inbox Privacy

• Temporary inboxes are not password-protected mailboxes. Anyone who knows or guesses a temporary address may be able to read mail sent to it while it is active. Do not use them for sensitive or important accounts.
• Messages are received and stored by the inbox provider used for that address (section 11), and in our database for addresses we assign from our own pool.
• FreeGmail administrators can see received codes and inbox records in the admin panel. They access them only to run, troubleshoot and secure the Service, to handle support requests or abuse reports, or when required by law.
• Message contents are not used for analytics, advertising or AI training, and are not sent to the AI support provider.

9. Where Information Is Stored and Processed

• Supabase: PostgreSQL database, authentication and file storage (support images and payment screenshots in private storage).
• Cloudflare: hosts and serves the website and runs our server code.
• Your browser: session token, device identifier and preferences in local storage.

Our providers may process data in countries other than your own, including the United States and the European Union. We rely on these providers' contractual safeguards for such transfers.

10. How Long We Keep Information

• Temporary inboxes: free and generated inboxes expire after about 10 minutes; after expiry, messages for an unsaved address are no longer shown to you. Copies held by third-party inbox providers follow their own retention.
• Saved inboxes: kept until you delete them or your account.
• Account, profile and Google sign-in data: kept while your account exists and deleted when the account is deleted.
• Support messages and attachments: kept while your account exists so the conversation history is available, unless deleted earlier by our team.
• Developer API keys, usage logs and wallet ledger: kept while your account exists; revoked keys stop working immediately.
• Payment and transaction records: kept as long as needed for accounting, dispute handling and fraud prevention, even after account deletion where the law requires.
• Email-sending limit records (device ID and IP): used for the rolling 24-hour limit.
• Hosting logs and backups: kept by our providers under their standard retention, after which they are overwritten.

11. Service Providers and Sharing

We do not sell or rent personal information. We share it only with these providers, who process it to run the Service:

• Supabase — database, authentication (including Google Sign-In) and file storage.
• Cloudflare — website hosting and network delivery.
• Temporary-mail providers (temp.tf and SonJJ) — create inbox addresses and deliver the messages sent to them.
• Groq — generates AI replies in the support chat; receives the text of your support messages and our support knowledge, not your inbox contents or Google data.
• Our email delivery provider (SMTP) — sends account emails such as verification and password-reset links to your email address.
• Payment and blockchain services — the cryptocurrency network you pay on; we check public blockchain records to verify payments.
• Your browser's push service (for example Google, Mozilla or Apple) — delivers notifications you turned on.
• Google Search Console — receives only public page addresses we submit for indexing; no user data.

Independent third party:

• Google AdSense shows ads on public pages and acts under Google's own privacy policy (section 13).

We may also disclose information when required by law, to protect users or the Service from abuse, or as part of a merger or acquisition with notice to users.

12. Cookies, Local Storage and Sessions

• Necessary: the sign-in session token, a random device identifier used for abuse limits, and small preference values (for example your selected platform), all kept in browser local storage.
• Session storage: a short-lived flag that reloads the page once if an app update is detected.
• Advertising: Google AdSense may set cookies on public pages (section 13).
• We do not use third-party analytics cookies.

You can clear local storage and cookies in your browser settings at any time; doing so signs you out.

13. Advertising

Public pages show ads from Google AdSense. Google and its partners may use cookies to show and measure ads, including personalised ads based on your visits to this and other sites. You can manage ad personalisation at https://adssettings.google.com and read how Google uses data at https://policies.google.com/technologies/ads. Advertising is separate from Google Sign-In: your Google sign-in data is never shared with AdSense.

14. Developer API

• API access is available after a verified wallet deposit. Each user can have up to 3 active keys.
• A full API key is shown once when created. We store only a SHA-256 hash and a short prefix, so we cannot show the key again.
• Each API request records the key used, action, endpoint, status code, success and credits charged. Failed calls are not charged.
• Wallet balance, deposits, bonuses and every credit change are kept in an append-only ledger you can view in your dashboard.
• When you call the API, we process the inbox addresses and messages you request in the same way as in the app (sections 6 and 8).

15. Payment and Subscription Data

• We receive: the payment method, amount, blockchain transaction hash or reference, status and any screenshot you upload.
• We verify payments by checking the public blockchain or the payment provider's confirmation, then activate your plan or credit your wallet.
• We do not receive card numbers, bank passwords or crypto wallet private keys.
• Public blockchain transactions are permanently visible on the blockchain and cannot be deleted by us.
• Subscription records (plan, start, end, status) are used to decide access and are kept as described in section 10.

16. Security

• All connections to the website use HTTPS.
• Database row-level security limits users to their own data; administrator tools require an admin role and two-factor verification.
• Passwords and API keys are stored as hashes, not in readable form.
• Support images and payment screenshots are stored privately and shown only through short-lived signed links.
• Rate limits protect sign-up, verification and API endpoints from abuse.

No online service can guarantee complete security, but we work to protect your information and fix problems quickly.

17. Your Rights and Choices

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict some processing, and to complain to a data protection authority. To use these rights, email support@freegmail.com from the email address on your account. We verify the request comes from the account owner and reply within 30 days. Some records may be kept where the law requires (section 10).

You can also, at any time:

• Delete saved inboxes from your dashboard.
• Revoke Developer API keys from your developer dashboard.
• Turn off browser notifications in your browser settings.
• Revoke Google access at https://myaccount.google.com/permissions.

18. How to Delete Your Account

1. Email support@freegmail.com from the email address on your account with the subject "Delete my account".

2. We confirm that the request comes from the account owner.

3. We delete your authentication record (including Google sign-in data), profile, saved inboxes, API keys, push subscriptions and support history.

4. Payment, transaction and ledger records that we must keep for accounting, disputes or fraud prevention are kept only as long as needed and are no longer linked to an active account.

Deleting your account ends any active plan and API access. Unused wallet credit is not automatically refunded; see our Refund Policy.

19. Third-Party Services and Links

Our pages link to other websites and use providers listed in section 11. Those services are governed by their own terms and privacy policies, which we do not control. Please review them, including Google's privacy policy at https://policies.google.com/privacy.

20. International Users and Legal Basis

Where data protection laws such as the GDPR apply, we process data to perform our contract with you (account, inboxes, plans, API), for our legitimate interests (security, abuse prevention, keeping the Service working), with your consent (Google Sign-In approval, browser notifications, personalised ads where required) and to meet legal obligations.

21. Children

The Service is not intended for children under 13 (or the minimum age required in your country), and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

22. Changes to This Policy

We may update this policy when the Service changes. The "Last updated" date at the top of the page shows the latest version. For significant changes, we will show a notice on the website or in your dashboard before they take effect.

23. Contact and Privacy Requests

For privacy questions or requests, email support@freegmail.com. FreeGmail is not affiliated with or endorsed by Google.

← Back to FreeGmail homepage