Privacy and terms

Privacy

We process account data (email, display name, signup country from Cloudflare's CF-IPCountry header), organisation membership, API key hashes, inbox addresses, and received message content so the product can work.

Received messages, HTML, text, headers, and attachments are kept for 30 days, then deleted from the live service. Deleting an inbox or message removes stored objects immediately. Cloudflare D1 Time Travel may retain earlier database states for up to 30 additional days for disaster recovery only. Message bodies in R2 are not backed up.

Authentication is provided by Firebase Authentication. Infrastructure runs on Cloudflare (Workers, D1, R2, Email Routing). We do not sell inbound message content. Operational logs retain seven days and must not include message bodies, headers, attachment names, or secrets.

Attachments are not malware-scanned. Download them only if you trust the sender.

Terms

InboxRhino is a receive-only testing service. You may not use it as a public disposable-mail website, to send mail, or to abuse third-party services. Test inboxes cannot send, reply, or forward.

The free tier allows 11 active inboxes, 33 inbound emails per UTC calendar month, and one organisation user. When the monthly email quota is exhausted, further inbound mail is rejected. We may suspend accounts that exhaust resources or violate these terms.

The service is provided as-is during the free launch. Paid plans, SLA, and GST invoices are not part of this launch. We may change limits with notice on this site.