OTPINB Privacy Policy

Last updated 2026-11-03

This policy describes information handled by OTPINB, maintained by the OTPINB Team. For privacy questions or requests, use Contact. OTPINB is not an anonymous or confidential email service.

Public inbox access

New mailboxes under our public configuration are readable by anyone who knows the full address. This includes Premium-created public mailboxes. Mail content can include the sender, recipient, subject, body and attachments. A web login or Premium purchase does not make a public mailbox private. Legacy mailbox access rules may differ. Do not use public inboxes for sensitive information.

Information used to provide the service

• Mail and mailbox records: addresses, message headers, bodies, attachments, timestamps, mailbox access credentials and settings let us receive, display, send and manage mail.
• Accounts: registration email, authentication verification records, account identifiers, role, membership and mailbox associations support sign-in and access control. Google sign-in provides a verified email and provider identifier, and may return profile information; it does not give us your Google password. Passkey flows use credential identifiers and public verification material.
• Security and quotas: IP or network identifiers, request metadata, browser/device indicators, a derived browser identifier and creation/send activity help enforce limits, prevent abuse and investigate failures.
• Payments: invoice and payment references, amounts, currencies, status, purchase grants, send reservations and ledger entries support verified deposits, Credits, Premium and reconciliation.
• Telegram: when linked, Telegram identifiers, account linkage and notification preferences support bot access and requested notifications. Message details sent to Telegram are also processed there.
• Support: information you choose to send is used to answer the request and investigate the issue. Send only what is necessary, without credentials or private mail.

Browser storage and identification

The application uses browser storage for sign-in and mailbox access state, language and preferences, a cached browser identifier and pending operations such as sending or top-up. Clearing storage may remove local access information; it does not delete server records.

FingerprintJS derives a browser identifier from browser/device characteristics for abuse controls. The bundled SDK can also make occasional installation-monitoring requests to its vendor CDN, exposing ordinary connection metadata to that provider. Cloudflare human-verification and security features may process browser and network information. This is not a no-cookie or no-tracking service.

Analytics and advertising

Google Analytics is configured for the homepage, Pricing and published blog pages, not account, wallet, admin, private message or payment-return routes. Our page-event implementation uses approved paths and fixed titles rather than forwarding query strings, fragments, mailbox contents or account/payment identifiers. Google still receives technical connection and device information and can use analytics cookies. Google signals and advertising personalization signals are disabled in this integration.

You can use browser cookie/storage controls or Google's Analytics opt-out add-on where supported. Read how Google uses data from partner sites. Blocking storage may affect sign-in and other service functions.

AdSense placement support is prepared, but advertising is not currently activated with an ad-client/ad-unit configuration. If Google advertising is enabled, Google and advertising vendors may use cookies or similar technologies and information about visits to this and other sites to provide or measure ads, subject to the applicable configuration and consent requirements. Google's advertising controls provide personalization choices. Advertising disclosures and any required consent controls must accompany activation; this page is not a consent mechanism. The current site does not offer an on-site cookie-preferences panel.

Providers and disclosures

Cloudflare hosts and supports infrastructure, email processing, database storage and security; see Cloudflare Privacy. Google provides optional OAuth sign-in and public-page analytics; see Google Privacy. Optional Telegram workflows use Telegram. Hosted crypto checkout and verification use NOWPayments. Crypto transactions may also be publicly visible on their blockchain.

Providers process information according to their own roles and policies and may process it in other countries. Sending email also exposes the relevant message and routing information to recipient providers. Public-inbox readers can copy information independently. Information may be disclosed when necessary to operate the requested service, investigate abuse, protect security or meet applicable legal requirements. We do not claim that a provider's privacy policy governs all of OTPINB's own processing.

Retention and deletion

Free Inbox and Sent messages use 1-day retention; active Premium uses 30 days from message arrival or creation. Natural Premium expiry includes 7 days of cleanup protection, not an extension of all Premium benefits. Public lookup expiry and mailbox existence are separate from message retention. Operator-protected mailboxes may retain data longer. Cleanup runs periodically; these are not exact-second erasure guarantees.

Creation-quota logs are eligible for cleanup after about 30 days. The 24-hour quota window does not mean those records are kept for only 24 hours. Account, security, support and payment records do not all have a uniform automatic deletion period. Financial ledger records are retained to preserve transaction integrity and reconciliation; deleting a mailbox or browser storage does not erase them.

We cannot retract copies held by senders, recipients, public readers, Telegram or payment providers. Provider logs and recovery copies can have separate lifetimes. Do not assume that removing a visible message immediately erases every copy.

Your choices and requests

You can stop using a mailbox, adjust available mailbox/account settings, disable Telegram notifications or unlink Telegram through the supported controls. Contact us to request access, correction or deletion of personal information or raise an objection where applicable. We may need proportionate ownership verification and must consider security, operational and legal obligations before acting. We do not promise a universal deletion deadline or deletion of records that must be preserved. Do not send a password, OTP or private key to verify a request.

Updates

The date above identifies this policy's latest revision. Changes in service features, providers or data handling will be reflected here. Read Terms and Acceptable Use for the related service rules.