How it works

VanishMail gives you a one-shot @vshm.app address that you can use to receive email without giving away your real address. The inbox and everything in it disappear after 60 minutes.

1. You click "Generate address"

We mint a random address like calm-fjord-h7k3@vshm.app using cryptographically secure randomness, plus a 32-byte access token that lives in a cookie. We do not ask for any personal information.

2. Anyone sends email to it

A catch-all on the vshm.app domain routes all inbound mail into a single mailbox. Every 5 to 10 seconds, an ingestion worker connects to that mailbox over IMAPS, pulls new messages, and figures out the original recipient from the message headers (we use the X-Original-To header that Postfix adds, and fall back to Envelope-To and Delivered-To if needed).

3. Your browser polls for new mail

Your browser fetches the inbox over HTTPS every few seconds. Only your browser can read these messages because the URL includes a 256-bit access token that we never expose.

4. After 60 minutes, it vanishes

The address stops receiving mail. A cleanup job hard-deletes the message bodies and any stored attachments within 10 minutes of expiry. The address itself is never reused.

What is and isn't private

• Your IP address is briefly rate-limited; the limit is enforced against the IP hash, but the raw IP is in our access logs for 7 days.
• Your browser's user agent hash is stored alongside abuse reports if you submit one.
• We do not run third-party analytics, advertising, or marketing trackers on the public site.
• The IMAP server's standard operating logs (delivery success/failure, sender, recipient) are kept by the mail server for 14 days, separate from this application.

What we don't do

• We do not let you send mail. There is no SMTP relay.
• We do not require registration, a phone number, or a recovery email.
• We do not retain message bodies after an inbox is destroyed or expires.
• We do not expose a public list of generated addresses.