Privacy Policy
Last updated: October 3, 2026
This Privacy Policy describes what data the UrusMail service collects and processes, for what purposes, and how it is protected. We follow the principle of data minimization: if data is not necessary for the Service to function, we don't collect it.
1. Data Controller
The data controller is UrusMail (urusmail.pro). For privacy inquiries: admin@urusmail.pro
2. Data We Collect
We do not collect personal user data in the traditional sense. During Service operation, the following is temporarily stored: • The created mailbox name (local part) and selected domain — for the inbox's active period (5 minutes; up to 20 minutes total if manually extended) • The access token — a cryptographically random key (48 characters) technically necessary to link messages to the inbox • Incoming emails — exclusively during the inbox's active period • Technical web server logs (nginx): IP address, time, the requested page address, browser, and response code. Requests to an inbox include its access token in the URL. Kept for no more than 48 hours, then deleted automatically; used for troubleshooting and protection against attacks • For anonymous visit counts — a one-way hash of your IP address, browser, and the current date (the hashing key changes every day). Used only to avoid counting the same visitor twice in one day; the raw IP address is never stored and cannot be recovered from the hash The Service itself (website, mail reception, Telegram bot) deliberately does not write inbox addresses, subjects, message contents, or visitors' IP addresses to its own logs; application logs contain only technical error messages. If a connection fails, the IP address of the connecting mail server may appear in them. The hosting provider that runs the server may keep its own network logs, which we cannot control. Paid accounts (access key, API, account page): we store a hash of the key (we cannot see or recover the key itself), a note about the customer, plan parameters, the time of the last request and the total number of requests. Inboxes of a paid account and their messages are kept until the inbox lifetime you chose expires (up to 90 days), but no more than the last 200 messages per inbox; when an inbox is deleted, expires, or the account is deleted, they are removed permanently. For a custom domain we store its name and verification code; DNS is queried only during verification. For each order we store its number, plan, period, amount, status, the payment identifier from the payment service, the time of payment and a record of your acceptance of the terms; we do not ask for your name, address or email when you pay on the site. The issued key is kept in the order in encrypted form for no more than 7 days so that you can see it on the order page. Order records are kept for as long as income accounting requires. If you email us, we use the address you wrote from. Separately: if you email our support address, admin@urusmail.pro, that correspondence (including attachments) is not subject to the "5 minutes" rule — it is kept until your issue is resolved and is included in daily backups for up to 14 days. See Section 5 for details. We do not collect: user IP addresses in the Service's database (only temporarily in web server logs, as noted above), tracking cookies, geolocation data, behavioral analytics, personalized advertising.
3. Security Tools — Data Processing
UrusMail provides several additional security tools. Here is how each one handles data: • Password Generator — passwords are generated entirely in the user's browser. No data is transmitted to our servers or stored. • Data Breach Checker — to perform a check, the entered email address is sent to a public third-party API (proxynova.com). We do not store entered addresses. Use this tool mindfully. • Photo EXIF Cleaner — uploaded images are processed exclusively in the user's browser. Files are not transmitted to our servers and are not stored. • Secret Notes — the note text is encrypted and stored in our database until first read or until expiration (maximum 24 hours). After reading, the note is permanently destroyed. We cannot read the content of an encrypted note. • URL Scanner — the entered URL is sent to an external API (Google Safe Browsing) to check for phishing and malicious content. We do not store checked URLs. • Email protection — analysis of a received email (finding trackers, external images, links and the confirmation link) is performed in your browser. If you press "Show images", they are loaded through our server so that the sender does not see your IP address or device (they will see a request from our server). We do not store the images, and an image address may appear in the ordinary web server log for up to 48 hours (Section 2). Tracking pixels are never loaded. If you press "Check" on a link from an email, only the site address without parameters, tokens and long path segments is sent to Google Safe Browsing through our server; we do not store these addresses. • Your IP and browser fingerprint (the /my-ip page) — your IP address is returned to you in the reply and is not stored by the application (the ordinary web server logs described in Section 2 still apply). The browser fingerprint is computed entirely in your browser and is not sent to the server. We do not work out your city or provider from the IP and do not use third-party services for that. • Opening an inbox on your phone (QR code) — the code is generated in your browser. The access token is placed in the fragment of the address (after the # character), which the browser does not send to the server and which does not appear in our logs. Anyone who scans the code gets access to the inbox.
4. How We Use Data
All data is used exclusively for the technical operation of the Service: • Routing incoming messages to the created inbox • Displaying messages to the authorized user (token holder) • Automatic data destruction upon expiration We do not use data for marketing purposes or share it with third parties for profiling.
5. Data Retention
All mailbox data (address, token, messages) is stored in a secure database with automatic TTL (Time To Live). After 5 minutes (or up to 20 minutes if manually extended), data is irreversibly deleted. Secret notes are deleted immediately after the first read or after 24 hours — whichever comes first. Technical web server logs are retained for no more than 48 hours (see Section 2 for details). Exception: correspondence with our support address, admin@urusmail.pro, is not treated as a temporary inbox — it is retained until your issue is resolved (you may ask us to delete it sooner). This correspondence is included in daily automated backups retained for up to 14 days, so deleting a message from the primary database does not guarantee its immediate removal from a backup within that window.
6. Third-Party Data Sharing
We do not sell or share user data with third parties. Exceptions: • Upon request from authorized government agencies in accordance with applicable law • Infrastructure providers (hosting, CDN) as data processors enabling the Service — with appropriate data processing agreements • The breach checker tool uses the public proxynova.com API — only the checked email is transmitted • The URL scanner tool uses an external API to analyze URLs for malicious content • Replies sent from our support address, admin@urusmail.pro, are delivered through a third-party email provider (Brevo) — the recipient's address and the reply text are shared with it as necessary to deliver the message Advertising blocks on the site are served by advertising networks (e.g., Google AdSense). These networks may use cookies for contextual advertising per their own privacy policies. We do not share mailbox data with them. • The Plisio payment service — when you pay for a paid plan. We pass it the order number, plan name and amount; you enter the wallet address and payment details on its page, and its own policy applies to them. We do not receive or store bank card data. • Affiliate links labelled "Ad" — once you follow them, the partner site's policy applies.
7. Cookies and Trackers
UrusMail does not set analytical cookies and does not use user behavior trackers. The access token and language preferences are stored in the browser's localStorage — this is not a cookie and is not automatically sent to the server with each request. Advertising networks embedded in the Service may set their own cookies per their privacy policies. Users can manage them through browser settings or ad-blocking extensions. A partner card labelled "Ad" may be shown in the inbox: it is an affiliate link, and we may earn a commission when you sign up through it. We count only the total number of clicks per day, without IP address, cookies or any other visitor data; after you follow the link, the partner site's own policy applies.
8. User Rights
Under GDPR and applicable privacy laws, you have the right to: • Access information about data related to you • Request deletion of your data (in our case, data is deleted automatically) • Withdraw consent for data processing • File a complaint with a supervisory authority Since we don't identify users, most rights are exercised automatically: your data is destroyed in 5 minutes without any action on your part.
9. Data Security
All connections to the Service are encrypted with TLS 1.3. The database is located in isolated infrastructure with restricted access. Access tokens are generated using a cryptographically secure random number generator. Secret notes are encrypted before storage.
10. Children
The Service is not intended for individuals under 18 years of age. We do not knowingly collect data from minors. If you become aware that a minor is using the Service, please inform us at admin@urusmail.pro.
11. Policy Changes
We may update this Policy. The current version is always available at urusmail.pro/privacy. For material changes, we will post a notice on the main page.
12. Contact
For privacy inquiries: admin@urusmail.pro