Privacy Policy

Last updated: 16 October 2026

This policy explains what Flashebox does with data. It is written to be read, not to be skimmed past, and it describes how this particular service actually works rather than how a website in general might work.

Who we are

Flashebox (flashebox.com) is a free disposable email service operated by Shariq Ventures, Lahore, Pakistan. Shariq Ventures is the data controller for the purposes of this policy. You can reach us at support@flashebox.com, by phone on +92 336 4266316, or through our contact form.

The short version

What we collect

1. Temporary inbox data

When you open Flashebox, the service generates a random five-character address on one of our domains. We do not ask who you are, and we do not log your IP address against the temporary address it created, so we cannot connect an inbox back to a person.

What we necessarily hold is the mail itself: the messages other people send to that address, including sender addresses, subject lines, message bodies and any attachments. We hold this because an inbox that does not store the message cannot show it to you. It is deleted automatically on the schedule set out below.

2. Optional account data

You do not need an account to use a temporary inbox. If you choose to create one — which adds saved favourites and custom domains — we store the email address and password you register with. Passwords are stored hashed, not in readable form. We do not ask for your name, date of birth, address or phone number, and we do not take payment, so we hold no card or billing data at all.

3. Technical data

Like any website, our servers record standard request information: IP address, browser and device type, operating system, the pages requested, referring page and timestamps. This is used to keep the service running, diagnose faults, and detect abuse such as automated scraping or attempts to flood the mail server. Web server and application logs are kept for 30 days and then deleted.

4. Contact form and support email

If you write to us through the contact form or by email, we receive your name, email address and whatever you put in the message. We keep support correspondence for up to 12 months so we can follow up on an unresolved problem, then delete it.

How long we keep things

These are the real settings the service runs on, not general intentions:

Deletion is automatic and happens whether or not anyone asks for it. Backups and caches may hold a copy for a short period after deletion before they rotate out; we do not restore deleted mail from backups on request.

Why we process this data, and on what legal basis

If you are in the UK, the European Economic Area or Switzerland, the UK GDPR and the EU GDPR give us a defined set of lawful bases. Ours are:

• Performance of a contract (Art. 6(1)(b)) — receiving and displaying mail sent to your temporary address, and operating your optional account. Without processing this, there is no service.
• Legitimate interests (Art. 6(1)(f)) — keeping the service secure and available, preventing abuse of the mail server, and dealing with your support enquiries. We have considered this against your interests and limited what we collect accordingly.
• Consent (Art. 6(1)(a)) — non-essential cookies, including advertising cookies. You give this through the cookie banner and you can withdraw it at any time.
• Legal obligation (Art. 6(1)(c)) — responding to a valid, lawful order from a competent authority.

Advertising and Google AdSense

Flashebox is free to use. To cover the cost of running it we display advertising supplied by Google, including through Google AdSense. At the time of this update, advertising is not yet live on the site; the terms in this section apply as soon as it is.

The disclosures Google requires us to make, and which we make willingly:

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to Flashebox and other sites on the internet.
• You can opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of a third-party vendor's use of cookies for personalised advertising at aboutads.info/choices.
• Where we have not opted out of third-party ad serving, vendors other than Google may also serve ads on this site and set their own cookies. Those vendors' own privacy policies govern that use, and you can opt out of their personalised-ad cookies on their own sites.
• Google's own handling of data from sites that use its services is described in How Google uses information from sites or apps that use our services.

What advertising does not involve: we do not pass the contents of your inbox, your messages, your temporary address or your account email address to advertisers or ad networks. Ad targeting on this site is based on cookies and the ordinary request data your browser sends to the ad server, not on your mail.

If you are in the EEA, the UK or Switzerland, Google requires publishers to obtain consent through a Google-certified consent management platform integrated with the IAB Transparency and Consent Framework before serving personalised ads. Our cookie banner is how you give or refuse that consent. If you refuse, you may still see advertising, but it will be non-personalised or limited rather than based on your browsing history.

Cookies

We use a small number of cookies to make the site work, to remember that you have dismissed the cookie notice, and — with your consent — for advertising. Our Cookie Policy lists each one and explains how to control them.

Who we share data with

We do not sell personal data, and we do not share inbox contents with anyone. The only parties who process data on our behalf or receive it are:

• Hosting and mail infrastructure providers, who necessarily handle the servers the service runs on. They process data on our instructions and are not permitted to use it for their own purposes.
• Google, for advertising, as described above.
• A competent authority, where we receive a valid and lawful order. We will only disclose what the order actually requires, and given the retention windows above, in most cases there is simply nothing left to disclose.
• A successor, if the service were ever sold or transferred. We would publish notice here before that happened, and any successor would be bound by this policy until it was changed with notice.

International transfers

We operate from Pakistan and our infrastructure providers may process data in other countries. Where we transfer personal data out of the UK, EEA or Switzerland, we rely on the appropriate safeguards available to us, including the European Commission's Standard Contractual Clauses with our providers where required.

Your rights

Depending on where you live, you may have the right to ask us for a copy of the personal data we hold about you, to have it corrected or deleted, to restrict or object to our processing of it, to withdraw consent you have given, and to receive it in a portable form. If you are in the UK, EEA or Switzerland these are rights under Articles 15 to 22 of the GDPR.

Write to support@flashebox.com and we will respond within 30 days.

One practical limit, stated honestly. Because anonymous use of a temporary inbox involves no account and we do not link IP addresses to generated addresses, we usually cannot identify which data belongs to which person. If you ask us to produce "your data" for anonymous use of the service, we may have no way to find it and no way to verify it is yours — and under Article 11(2) GDPR we are not obliged to act where we genuinely cannot identify you. This is a consequence of collecting as little as possible, not an excuse. For an optional account, there is no such problem: tell us the registered address and we can act.

If you are unhappy with how we have handled a request, you may complain to your local data protection authority. In the UK that is the Information Commissioner's Office; in the EEA it is the supervisory authority for your country.

Children

Flashebox is not intended for children and is not directed at them. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, write to support@flashebox.com and we will delete it.

Security, and what security cannot do here

We serve the site over HTTPS, hash account passwords, keep our software patched, and restrict administrative access to the founder.

But the most important security fact about this service is a design limitation, not a safeguard: a temporary inbox has no password. Addresses are short and randomly generated, and anyone who knows or successfully guesses an address can open it and read what is inside while it is live. That is the trade you make in exchange for not registering.

So do not use Flashebox for banking, government or tax services, medical records, employment or immigration paperwork, insurance, password resets for accounts you care about, or anything else you would mind a stranger reading. It is a shield against marketing lists and sign-up spam, not a confidential mailbox. If you need real confidentiality you need an account you control, with a password on it, and ideally end-to-end encryption.

Law that applies

Pakistan has not yet enacted a comprehensive data protection statute. The Personal Data Protection Bill remains a draft and has not become law. Our processing is therefore governed by Pakistani law as it currently stands, including the Prevention of Electronic Crimes Act 2016, together with the UK GDPR and EU GDPR to the extent they apply to visitors in those territories. We have chosen to apply GDPR-standard rights and retention discipline to everyone who uses the service, not only to visitors who can demand them.

Changes to this policy

If we change this policy we will update the date at the top and, where the change is significant — a new category of data, a longer retention period, a new recipient — say so plainly on this page rather than hoping you do not notice.

Contact