Privacy Policy

Generating an address and reading it works signed out. An account only exists to hold things that are yours across devices — an API key, saved addresses, favourite domains, and any custom domain you have claimed.

Your identity from the provider you chose

Signing in with Google, GitHub or Discord passes back an email address, a display name and an avatar URL. Passwords are never involved and never seen.

An API key

A random token, generated on request. It identifies your account to the API and can be rotated whenever you like from Settings.

Saved addresses and favourite domains

Only what you explicitly chose to keep. Removing one removes the record.

Custom domains you have claimed

The domain name, the ownership token you published in DNS, and when it was verified. Removing the domain deletes the record.

Zenix reads disposable inboxes from upstream providers and passes the result straight to you. Message bodies are not written to the Zenix database — when the provider drops the address, the mail is gone from here too.

The browser extension can keep received mail on your own device so an inbox survives a popup being closed. That copy is local to your browser, is never uploaded, and there is a button in the extension's settings that deletes it.

The upstream providers do receive the mail, and their handling of it is their own. A disposable inbox is a convenience, not a confidentiality guarantee.

Public endpoints are rate limited, which requires knowing that two requests came from the same place. Rather than logging IP addresses, an address is passed through a keyed hash and only the first 32 characters of the result are stored, alongside the route and an hourly counter. The original address is not written down and the hash cannot be reversed to recover it.

The browser extension can report three things: that an install exists, that it was used on a given day, and which version it is. That is the entire purpose, and there is no code in it that reads addresses, domains, page URLs, inbox contents, API keys or anything typed into a form.

The install id is random and local

A UUID generated in your browser, with no relationship to you, your account or your machine.

It is never stored as sent

The server hashes it together with the current date before writing anything, so two pings from the same install on different days cannot be joined into a history. A daily active count is possible; a per-person timeline is not.

One ping a day, at most

Along with the extension version, the browser family, and a coarse OS name — 'mac', 'win', 'linux' — never a version or build.

Off in one click

The switch is in the extension's settings under Privacy. Turning it off stops every send and deletes the local id.

There are no analytics scripts, no social embeds and no cross-site trackers on this site. The only cookie is the one that keeps you signed in, and it is only set once you sign in.

Documentation pages carry one sponsored line, served by EthicalAds. It is what pays for the domain, and it was chosen because it does not work the way ad networks usually do.

No cookies and no profile

Nothing is stored in your browser by the ad, and no profile of you is built or bought. There is no cross-site tracking.

Chosen from the page, not from you

What appears is picked from the topic of the page you are reading and a coarse country, not from your history or identity.

Never in an inbox

Slots exist only on documentation pages. No ad is placed on an inbox, a message, or anywhere in the mail flow.

Blocked is fine

If it does not load, nothing about the site changes. No wall, no nag, no detection.

Saved addresses, favourite domains, custom domains and your API key can each be removed from Settings at any time. To delete an account and everything attached to it, ask via Contact and it will be removed.

If this policy changes in a way that affects what is collected, the date at the top changes with it. The history is public in the repository.