Privacy

guesel is a receive-only throwaway email service. You get generated addresses, mail sent to them shows up here for a few days, and nothing is ever sent out. This page says what data the service handles, how long it is kept, who else touches it, and how to get rid of it. It describes what the software actually does; the numbers on this page are read from the running server's settings.

There is no self-signup: an administrator creates your account. "You" below means the account holder. Mail that arrives in your mailboxes can of course contain other people's data; it is deleted on the same schedule as everything else. Nothing is sold, shared for advertising, or used for anything other than running the service.

Your account is a display name, a username and a password. The password is stored only as a scrypt hash; the server cannot read it back. Which subscription model you are on, and when that assignment expires, is stored with the account. Administrators can see the account and how many mailboxes, messages and API keys it has, but not your password.

Logging in on this site sets one cookie, gsl_session, holding a random session id. It is marked HttpOnly and SameSite, is sent only to this site, and expires after 14 days. Logging out deletes the session; expired sessions are removed automatically. There are no other cookies and no third-party cookies.

API keys let programs, and the Firefox extension, act on your account. The server stores a SHA-256 hash of the key, its first characters (so you can recognise it), the label you gave it, and when it was created, last used and revoked. The full key is shown once when created and never again.

The extension logs in by sending your username and password once to this server's token endpoint, which answers with a new API key labelled "Firefox extension". From then on the extension uses only that key. It keeps in Firefox's local extension storage: the server URL you entered, that key, a short summary of your account (id, display name, username, whether it is an admin account) and, if one was found, a note that a newer extension version is available. It never stores the password and never sends it again.

Once a minute the extension asks this server for your mailbox list to show the unread count on its toolbar badge, and a few times a day it asks the same server whether a newer extension version exists. It contacts no other server. The extension runs on every website you visit, because it has to find email fields to offer its button. To do that it looks at each input field's type, name, id, placeholder and labels. It sends nothing about the page, the site, or what you type to anyone, this server included. Filling a field happens entirely inside your browser.

You can cut the extension off at any time: log out in its settings, which revokes the key, or revoke the "Firefox extension" key on the API keys page here. A revoked key stops working at once and the extension forgets it on its next request. Firefox itself may contact Mozilla for add-on updates and reviews; that is Firefox behaviour, covered by Mozilla's privacy notice, not by this service.

Addresses are generated by the server (two random words and a number); you cannot choose one. For each address the server stores the address, which account it belongs to, when it was created, when it stops accepting mail (after 30 days) and whether you disabled it early.

Address records are kept forever and never reused: not after the 30 daysrun out, not when you disable a mailbox, and not when the account is deleted. Senders keep writing to old addresses (newsletters, receipts, password resets); handing an address to someone else later would deliver your mail to them. When an account is deleted, its addresses are detached from any account but stay blocked. Mail to an expired, disabled or detached address is rejected during delivery and is not stored.

When mail arrives for an active address, the server stores the original message exactly as received, plus a parsed copy: sender address and name, recipients, subject, text and HTML body, attachments, and a fixed set of headers (routing, authentication results, list and threading headers, mailer). It also records the envelope sender and recipient, the size, when it arrived and whether you have opened it.

Message content is deleted 3 days after it was received, no matter whether you have read it and no matter what state the mailbox is in. A background job checks every 15 minutes. Messages are deleted sooner when you delete them one by one, when you disable their mailbox (which wipes its messages immediately), or when the account is deleted. guesel itself keeps no backups of message content; see the hosting platform below for what it does with the database.

HTML mail is shown inside a sandboxed frame that blocks scripts and, unless you click "Load remote images", all remote loads, so senders cannot tell whether or when you opened a message.

The server writes ordinary request logs: method, path, response status and how long the request took. It does not log IP addresses itself. When a message is stored, one log line records the message id, the recipient address, the sender's envelope address and the size; when one is refused because the recipient's mailbox or storage is full or mail is arriving too fast, a line records the recipient, the sender's envelope address and the reason. These logs are kept by the hosting platform for as long as its log retention allows, and are used only to run and debug the service.

To slow down password guessing, the login page and the API token endpoint count failed logins per IP address and username in server memory and block that pair for 15 minutes after ten failures. To keep one client from overloading the service, the server also counts login attempts per IP address and, once you are logged in or using an API key, requests per account, each over a one-minute window. All of these counters live only in server memory, are never written to disk, and disappear when they expire or when the server restarts.

Each subscription model also caps how much mail an account can receive: messages per mailbox, total stored mail, and messages per minute. Mail beyond the first two is refused during delivery with a permanent error; beyond the third, the sending server is asked to retry later. Refused mail is not stored.

Two providers are involved in running this instance. There are no others.

• Railway (Railway Corporation) hosts the application and its PostgreSQL database. Everything listed on this page that is stored at all is stored there, including the application logs. Railway may record connection metadata such as IP addresses in its own infrastructure logs, and handles database backups according to its own terms.
• Cloudflare (Cloudflare, Inc.) provides DNS for the domain and receives all incoming mail for it: its Email Routing service accepts each message from the sending server and passes it, whole, to a small program of ours running on Cloudflare that forwards it to this server over an encrypted connection. Cloudflare therefore handles every incoming message in transit and keeps its own delivery logs (sender, recipient, outcome) under its terms. Cloudflare has no access to your account or to stored messages.

The extension is installed through Mozilla's add-on store; see the extension section above.

This site and the extension contain no analytics, no tracking pixels, no advertising and no third-party scripts, fonts or embeds. The only scripts that run are the extension's own files inside your browser. The server does not measure who visits, and there is nothing to opt out of.

• A message: open it and click Delete. Gone immediately.
• A mailbox's messages: disable the mailbox. Its messages are deleted immediately and it stops accepting mail; the address stays blocked.
• An API key or the extension's token: revoke it on the API keys page, or log out in the extension.
• Your account: there is no self-service button yet. Write to the administrator who created your account and ask for the account to be deleted; an administrator does it from the admin page. Deletion immediately removes the account, its sessions, its API keys (the extension's token stops working at once) and all its messages. The address records stay, detached from any account, so they are never reissued to anyone.

Anything not listed on this page is not stored, so there is nothing else to delete. If you want a copy of your data first, every message can be downloaded as a .eml file, and the API returns everything in JSON.

guesel.ch is a Swiss domain. The Swiss Federal Act on Data Protection (FADP) is the law most likely to apply to this instance; depending on where you are, other laws such as the EU GDPR may apply as well. This page is a factual description of what the service does with data. It is not a statement of compliance with any particular law, and it has not yet been reviewed by a lawyer.

We update this page whenever something relevant to it changes: what is stored, for how long, which providers are involved, or what the extension stores or sends. The date at the top changes with it. The retention and lifetime figures shown here are read live from the server's settings, so they are always the ones in force.

Questions about this page or your data: the administrator who created your account.