Privacy Policy

Effective 17 October 2026. Applies to the Poof: Temp Mail & Fake Email app for iPhone, its widgets and Live Activities, and this website.

1. Who we are

Poof is made by Quang Trung Nguyen, an individual developer based in Australia (“we”, “us”). We are the controller of the personal data described here. You can reach us at [email protected].

2. At a glance

This is the same table you see in the app under Settings › About, with the exact periods our servers use.

3. No account

You never sign up for Poof. When you first open the app, your iPhone proves to our server that it is running the genuine Poof app (using Apple’s App Attest), and our server gives the app a random device identifier. That identifier is not your Apple Account, not your phone number, and not Apple’s advertising identifier. It exists only so our server can apply limits (such as how many addresses you can create per day) and know which inboxes belong to your app.

Because there is no account, we have no way to find out who you are, and we cannot connect your temporary addresses to your real identity.

4. What we collect and why

4.1 Mail sent to your temporary addresses

When someone sends a message to one of your Poof addresses, our servers receive it and store it so the app can show it to you. That includes the sender’s address and name, the subject, the text and HTML body (cleaned of scripts and other active content before we store it), the time it arrived, its size, the result of the sender authentication checks (SPF, DKIM), and whether you have read it. Our server also looks for a verification code or sign-in link in the message, and guesses which service sent it, so it can show the code to you.

• Attachments are stored only for Premium inboxes, up to 5 MB each, and never executable files. For Free inboxes we keep only the attachment’s name and type, marked as removed.
• Original message: for Premium inboxes we also keep the original message file, so the app can show it exactly as sent.
• Mail to an address that does not exist or has expired is accepted and thrown away immediately; we do not store it.
• Mail for Premium (“clean”) domains first reaches a mail relay server we run, which passes it straight to our main servers. The relay holds a message only if our main servers are briefly unreachable, and for at most 1 day.

The person who sent the mail controls what is in it. Please do not ask anyone to send sensitive information, such as identity documents or bank details, to a temporary address.

4.2 Device record

For each installation of the app we keep:

• the random device identifier our server created;
• the public key and key identifier of the App Attest key that your iPhone created in its Secure Enclave, a signature counter, and whether it is a production or development build;
• a one-way hash of the secret access token the app uses to talk to our server (we never store the token itself);
• the app version and iOS version;
• today’s usage counters (addresses created, rewarded ads watched, clean-domain passes) so we can apply daily limits;
• whether you own Remove Ads or Premium, and until when;
• when the app last contacted our server.

We use this to provide the service, apply limits fairly, and stop automated abuse. If a device is used for abuse (for example many reports from other people, or hundreds of new addresses a day), we may block it.

4.3 Inbox tokens

Each inbox has a random 128-bit token. Anyone who has it can read that inbox, which is how you move an inbox to another iPhone. The token is stored in your iPhone’s Keychain. If you turn on Settings › Sync › Sync addresses with iCloud Keychain, Apple syncs it end-to-end encrypted to your other devices signed in to the same Apple Account; we cannot see it. Our server stores only a one-way hash of each token, so a copy of our database would not let anyone open your inboxes.

4.4 Notifications and Live Activities

If you allow notifications, we store the push token Apple gives your iPhone and use it, through the Apple Push Notification service, to tell you that mail has arrived. The notification we send through Apple contains only internal message and inbox identifiers, not your code or the mail. Your iPhone then fetches the code and subject directly from our server and builds the notification on the device, applying your Show code in notification and Hide code when locked settings.

When a “Waiting for code” Live Activity is running, we store its update token with the inbox for at most 24 hours.

4.5 Purchases

Payments are handled entirely by Apple. We never see your payment card, name or Apple Account. When you buy Remove Ads or Premium, or restore a purchase, the app sends us Apple’s signed transaction record, and Apple sends us updates about it (renewals, expiry, refunds). From these we keep the original transaction identifier, the product, the purchase and expiry dates, whether it was refunded or revoked, and the device it belongs to. We use them only to unlock what you paid for.

4.6 Reports and feedback

• Reports: when you report a message (spam, phishing, illegal content) or tell us a code didn’t arrive, we store the reason, the message, inbox or domain concerned, the service you name, and any note you add. Reports help us keep domains working and stop abuse. A report of illegal content closes that inbox immediately and deletes its mail.
• Feedback: if you use Send Feedback, we store your message and, only if you choose to give one, a reply address.
• Email to us: if you write to support@ or abuse@, we receive your email address and what you write, and use them only to answer you.

4.7 Network data

Like any internet service, our servers see the IP address of each request. We use it only for short-lived rate limits that protect the service from automated abuse (counters that reset within a minute). We do not store IP addresses with your device record or your mail. Our hosting provider, Cloudflare, also keeps sampled operational logs for up to 7 days to keep the service running; we never write mail content into them.

4.8 Crash and performance reports

If the app crashes or freezes, a report goes to Sentry: the error, the app and iOS version, the device model, and a sample of performance timings. We turn off anything that could reveal you or your mail: no IP address or user details, no screenshots, no view hierarchy, and we never put mail content or tokens in reports. Reports are kept for 90 days.

4.9 Product analytics

We count how the app is used (for example “address created”, “code copied”, “paywall opened”) with PostHog, so we can tell what works. Events carry a random installation identifier, the app version, build, iOS version, language, the week you installed, and your ad consent and tracking choices. They never include your addresses, mail, codes or tokens. We do not create a profile of you, do not record your screen, and do not combine these events with any other data. Our server also sends PostHog daily totals (such as how many devices were active) that contain no personal data. The app also downloads settings from PostHog that let us switch features off remotely if something breaks.

4.10 Advertising

The free version shows ads from Google AdMob. Buying Remove Ads or Premium turns ads off, and the app then requests no ads.

• Age first. The app asks iOS for your age range using Apple’s Declared Age Range feature. We receive only a range, not your birth date, and it stays on your iPhone. If you are under 13, the app shows no ads and never starts Google’s ad software. If you are 13 to 17, ads are non-personalised only and the app never asks to track you.
• Consent where required. In the EEA, the UK, Switzerland and US states that require it, Google’s consent message (UMP) asks for your choice before any ad is requested. You can change it any time in Settings › Ads › Privacy Options.
• Tracking only if you allow it. Adults may see Apple’s App Tracking Transparency prompt, never on first launch, only after your first mail arrives or on your second visit. Nothing in the app depends on your answer. If you allow it, Google may use your device’s advertising identifier (IDFA) to personalise ads and measure them. If you don’t, Google does not receive the IDFA and ads are limited to non-personalised ones.
• Whatever you choose, Google’s ad software collects some data to show and measure ads and prevent fraud: the identifier for vendor (IDFV), ad interactions, an approximate location derived from your IP address, and diagnostic data. Google is responsible for that data under the Google Privacy Policy; see also how Google uses data from apps that use its services.
• All ads are limited to Google’s most family-friendly rating (G). Ads never appear in the message view, Settings or purchase screens, and the ad software never sees your mail.

4.11 Data that stays on your iPhone

Some data never leaves your iPhone (or only goes to your own iCloud Keychain): your settings, the copy of your inboxes the app keeps for offline use, the data the widget and Live Activity display, your App Lock setting (Face ID is handled by iOS, and we never receive biometric data), and your age range. The camera is used only when you choose to scan a QR code to import an inbox, and the image is processed on the device. The app writes a code to the clipboard only when you tap Copy, and never reads your clipboard.

5. What we don’t do

• We don’t sell your personal data, and we don’t use your mail for advertising or analytics.
• We don’t send mail from your addresses. Poof only receives.
• We don’t ask for your contacts, precise location, photos, health data or real email address.
• We don’t track you across other companies’ apps and websites ourselves. The only tracking is by Google AdMob, and only if you allow it.
• We don’t log mail content in our server logs or crash reports.

When you open a message, remote images are blocked until you tap Load images (or turn on Always load remote images). Images are then fetched through our image proxy, never directly by your iPhone: the sender’s server sees a request from our infrastructure, not your IP address, and we send it no cookies, Referer or device identifier. The sender can still tell that the message was opened, because the picture was requested. The proxy keeps no copy of the images and does not log their addresses, and the links it gives the app stop working after one hour. Links open only after you confirm the destination, in Safari View Controller; the website you visit has its own privacy policy.

6. How long we keep it

Our servers delete expired data automatically every 10 minutes and run a daily clean-up. The periods are:

7. Who processes it for us

We use these service providers. Each processes data only to provide its service to us, except where noted.

We may also disclose data if the law requires it, to respond to a valid legal request, or to protect people from harm or abuse of the service. If Poof is sold or transferred, the data would go to the new owner under this policy.

8. International transfers

Our providers process data in the United States, the European Union and other countries where they operate; Cloudflare serves requests from the data centre nearest to you. When personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK addendum) in our providers’ data processing terms, or on the provider’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions where available.

9. Legal bases (EEA, UK, Switzerland)

• Providing the service you asked for (contract): receiving and showing your mail, notifications, purchases, inbox transfer.
• Legitimate interests: keeping the service secure and free of abuse (App Attest, limits, reports, rate limits), fixing crashes, and understanding usage through analytics that are not linked to you. You can object; see your rights.
• Consent: personalised advertising and the storage and access of information on your device for ads, through Google’s consent message and Apple’s tracking prompt. You can withdraw consent at any time.
• Legal obligation: answering lawful requests and keeping records the law requires.

10. Your choices and how to delete

• Delete everything: Settings › Data › Delete All Addresses and Messages. This deletes your device record, every inbox and message only you hold, their attachments, your purchase records, reports and feedback from our servers, and clears the app. It cannot be undone. Inboxes you also opened on another device stay available there until you delete them on that device.
• Delete one address or message from the Addresses list or the message view.
• Inbox tokens in iCloud Keychain: turn off Settings › Sync › Sync addresses with iCloud Keychain, or remove them on your other devices.
• Notifications: iOS Settings › Notifications › Poof, or the notification options in Poof’s Settings.
• Tracking: iOS Settings › Privacy & Security › Tracking.
• Ad consent: Settings › Ads › Privacy Options in the app.
• No ads at all: Remove Ads or Premium.
• Uninstalling the app stops all collection; your inboxes then expire on their own timers, and your device record is deleted after 90 days of inactivity (see retention).

There is no account to delete.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent. Most of these you can do yourself in the app, instantly. You can also write to [email protected]; we answer within one month (45 days for requests under US state laws).

Because Poof has no accounts, we can only act on data we can tie to you. To act on a specific inbox we need its inbox token, or for you to make the request from the app; we will not delete or disclose an inbox for someone who only tells us its address. If you sent mail to a Poof address and want it removed, write to us from that sending address.

If you are in the EEA, the UK or Switzerland, you can also complain to your local data protection authority.

12. Children

Poof is rated 4+ on the App Store but is not directed at children. We do not knowingly collect personal information from children under 13, and there is no profile or account in which a child could share any. Using Apple’s Declared Age Range, the app shows no ads to anyone it learns is under 13, and only non-personalised ads, without a tracking prompt, to teenagers 13 to 17. All ads are rated G. If you believe a child has sent us personal information, write to [email protected] and we will delete it.

13. Security

• All traffic between the app and our servers is encrypted (HTTPS).
• Only the genuine app on a real Apple device can use our servers (App Attest); every change is signed by a key that never leaves your iPhone’s Secure Enclave.
• We store only hashes of access tokens and inbox tokens.
• Mail is cleaned on our servers before you see it: scripts never run, remote content is blocked by default, and dangerous attachments are refused.
• Access to our systems is limited to the people who run Poof and protected with two-factor authentication.

No system is perfectly secure. Treat a temporary inbox as you would a postcard: fine for sign-up codes, not for secrets.

14. US state privacy notice

This section is for residents of California and other US states with consumer privacy laws. In the last 12 months we collected: identifiers (a random device identifier, push token, App Attest key, and, through AdMob, the IDFV and, if you allowed tracking, the IDFA); commercial information (purchase records); internet or electronic activity (app usage events, ad interactions, crash data); approximate location derived from IP address (by AdMob); and the content of mail sent to your temporary addresses. Sources: your device, the senders of mail to your addresses, and Apple. Purposes and retention are described above.

We do not sell personal information for money. Allowing Google AdMob to show personalised ads may count as “sharing” for cross-context behavioural advertising or a “sale” under some state laws. You can opt out by declining tracking when iOS asks (or in iOS Settings › Privacy & Security › Tracking) and by updating your choice in Settings › Ads › Privacy Options. We do not use sensitive personal information to infer anything about you. We will not treat you differently for exercising your rights. You may use an authorised agent; we may ask the agent to show your permission.

15. Changes to this policy

If we change this policy, we will update the effective date above. If a change matters (for example a new kind of data or a new purpose), we will also tell you in the app before it takes effect.

16. Contact

• Privacy questions and requests: [email protected]
• Abuse, spam or illegal content: [email protected]