Privacy

Who processes the data.

The data described here is processed by the fake.bg team, a small team based in Sofia, Bulgaria. Address: Sofia 1000, Bulgaria. Email: hello@fake.bg.

Free tier inboxes are public.

Anyone who knows the address can read mail to it. Free inboxes are intended for throwaway use only — never use one to receive sensitive material.

What we store.

• Received messages (sender, subject, body and the original .eml, attachments included) — in our Postgres database. In free inboxes every message is deleted automatically 10 minutes after it arrives, and an inbox keeps at most 10 messages (a new message pushes out the oldest). Inboxes owned by paid accounts are persistent — their messages stay until you delete them.
• Connection metadata (sending server IP, timestamps) — for abuse prevention.
• The IP address you use the site from — briefly, to rate-limit requests per network (abuse protection). It may also remain in the server's technical logs.
• If you create an account: your email, a password hash (never the password itself), display name, and the inboxes linked to the account.
• Generated fake identities — so their linked inbox works and, if you're signed in, so you can save them.
• In your browser (localStorage): the inboxes you opened recently and the current homepage address. This never leaves your device.
• EGN validation and generation on /egn run entirely in your browser — what you type is not sent to the server.

Analytics.

We use Umami — self-hosted, cookieless analytics. It records aggregate page views (page URL, referrer, browser and device type, country) and builds no advertising profiles.

We have no ad networks and no advertising cookies. Apart from the Google Analytics cookies (only if you allow them, see below), a cookie is set only when you sign in to an account — to keep you signed in.

Google Analytics 4 (only with your consent).

On the public pages (the home page, the guides, pricing, this page and so on) we also use Google Analytics 4. The processor is Google Ireland Ltd. (Dublin, Ireland). The purpose is anonymous usage statistics — which pages are useful.

The cookies _ga and _ga_N5L03YH7VT are stored only after you click “Allow” in the banner, and they last up to 2 years. Until you allow it (or if you decline), no cookies are stored and Google receives only cookieless signals with no identifier. Your choice is kept in your browser (localStorage, key consent-v1).

Google Analytics is not loaded on the inbox, sign-in, registration, account and status pages. On the other pages we send the page address without the part after “?” and “#”, and only the domain as the referrer, so your temporary address and the content of your mail never reach Google.

You can withdraw or change your consent at any time through “Cookie settings” at the bottom of every page.

Data may be transferred to the United States. Google LLC is certified under the EU–US Data Privacy Framework.

What we don't do.

• We don't sell or share message content.
• We don't use your mail for advertising. Content is processed automatically only for product features — code and link detection, tracking-pixel flagging.
• No third-party ad networks.

Hosting and Cloudflare.

DNS is hosted on Cloudflare. The web app is served directly from our own server in Frankfurt, Germany (DNS-only, not proxied) so your real-time stream is not buffered.

Data deletion.

The “Clear all” button on an inbox immediately deletes every message in it — the rows are removed from the database, with no trash bin. To delete an account, email hello@fake.bg.