recvmail policy

recvmail sells short-lived, receive-only email inboxes to AI agents, paid for one call at a time. This page is the whole of our policy: for the services our addresses are given to, for our customers, and for anyone asking what we keep.

For services that receive our addresses

What recvmail is

We mint every address: 20 random characters at recvmail.net. Nobody can choose one, so no support@, billing@ or lookalike address of ours exists.
Inboxes are short-lived. An inbox lives 75 minutes unless its buyer pays to extend it, and most are gone within hours. Mail is deleted soon after it is read, and all of it when the inbox ends.
An address is never reissued. Once an inbox ends, mail to its address is refused for good, so nobody can later receive another holder's password resets.
recvmail sends no mail. recvmail.net publishes a DMARC reject policy, so a message claiming to be from it is forged.

Blocking us is fine

Our addresses are on recvmail.net and its subdomains, and always will be: we never add or rotate domains to get around a blocklist. If your service doesn't want throwaway addresses, block the domain and its subdomains, or opt out (next), which also tells our customers before they pay.

Opting your domain out

A domain's owner can have all mail from that domain refused for every recvmail address. We don't ask why. We only check that the request comes from whoever controls the domain's DNS:

Publish a TXT record at _recvmail.<your domain> with the value opt-out.
Then write to abuse@admin.recvmail.net naming the domain. Publish first: a resolver that looked the name up before the record existed can keep its "no such name" answer for as long as your zone's negative-caching TTL (the SOA minimum).

We look the record up ourselves and reply once the opt-out is in place. From then on:

mail whose From: domain is yours, or a subdomain of it, is refused when it is sent, authenticated or not, with sender domain opted out;
an agent that tells us it expects mail from your domain is refused before it pays.

The record covers the domain it sits under and that domain's subdomains, never a parent: _recvmail.mail.example.com opts out mail.example.com only. You can delegate the name with a CNAME, as with _dmarc. To withdraw, delete the record and write again; we remove the opt-out once the record is gone. We don't publish the list of domains that have opted out.

Reporting abuse

Write to abuse@admin.recvmail.net. Mail to abuse@ or postmaster@ at recvmail.net itself bounces with a pointer there. Name the addresses of ours involved and when, and send the evidence: the offending message as an attachment with its full headers, a lure with our address in its Reply-To:, or an RFC 5965 report. Reports are by mail only, and we answer from a person's own address, since recvmail.net sends none.

A report that names an address, with evidence, cancels that inbox. Everything it holds is deleted at once, and its buyer is told it was cancelled for abuse. Until the end of the time that was paid for, mail to it bounces with address disabled for abuse; reports: abuse@admin.recvmail.net, so someone replying to a lure learns why.
Most inboxes have ended by the time a report arrives. A report is still worth sending: it shows us the pattern, such as one buyer holding many inboxes that hear from you, and we look into the buyer's other inboxes too.
If your service is being farmed, you see the farm better than we do. Name every address you know, or opt out.

We act on the evidence you send, never by reading our customers' mail.

What we tell you, and what we don't

We tell you whether an address was ours and what we did about it. We never tell you who paid for it or what else they hold; we act on that ourselves.

Acceptable use

recvmail is for an agent that needs to receive mail as part of its task. These uses are not acceptable, whoever pays and however few inboxes they take:

Getting around a limit a service sets per person: accounts, trials, sign-up credits, votes, purchases, tickets. One timed-entry ticket to a national park for the person you act for is fine; every ticket for a day is not. What counts is what the service means to give each person once, not what its sign-up form allows.
Collecting mail by deception: an inbox as the Reply-To: of a phishing message, or a drop for stolen credentials or data.
Anything unlawful, reading inboxes you didn't buy, and ignoring 429: a caller that keeps going may be blocked before it reaches the API.

An inbox used this way is cancelled, without refund and without appeal, and its calls answer 410 inbox_cancelled. We may refuse future service to whoever paid for it.

We never cancel an inbox for how much mail it receives or how long it is kept. Heavy use we didn't expect is not abuse.

What we see and keep

Your mail

We don't read it. The operator of the service has the access any host has, and never uses it to look at mail. A message is deleted 5 minutes after you download it, 1 hour after a poll first lists it if you never do, and in any case about 20 minutes after the inbox ends. We keep no copy and no backup: deleted is deleted.

What we look at

Routinely, aggregates: counts, sizes and timings, by sender domain and by paying wallet, to see that the service works and how it is used. No addresses.
On a case, opened by a report or by a pattern in those aggregates, one inbox's metadata: its lifetime and counts, its sender allowlist and rejections, and for each message the envelope sender, the From: address, size, time and authentication result. Every such look is recorded before anything is shown.
Never subjects or content, on a case or otherwise. For the mail this service exists for, the subject is often the secret ("482913 is your code").

What we keep, and for how long

Each period is the most we keep it. We may shorten one, and we lengthen one only by changing this page first.

What	Kept at most
Message content	5 minutes after download, 1 hour after a poll first lists it, or until about 20 minutes after the inbox ends
An inbox's record: its id, lifetime, quota, counts, and a keyed hash of the wallet that paid	13 months after the inbox ends
What each wallet paid for each inbox: how many calls, their sum, the first and last	13 months after the inbox ends
Each payment's own record, with its transaction	1 day, then added into the line above; one that never completed, 13 months after the payment
An abuse case: each look and cancel, who took it and why, and the inbox's record	3 years after the inbox ends or the case's last action, whichever is later
A domain's opt-out, and how it was verified	until withdrawn
Reports mailed to us	until handled, 30 days at most
Error logs, which can name a delivery's sender and recipient	7 days
Sampled request traces: ids, a delivery's sender and recipient, an API caller's approximate location, network and user agent	7 days
Usage metrics: inbox ids, counts, sizes, timings, sender domains; no sender addresses	3 months
The delivery log of the provider that receives our mail: sender, recipient, subject, result	31 days, kept by the provider; we can't shorten it, and don't use it to look at mail

Payments settle on a public blockchain, where the transaction and the paying wallet are public and permanent, outside anything we can delete.

This list is everything we keep. If a legal obligation requires us to preserve a particular record, we keep that record until the obligation ends; content, once deleted, cannot be recovered.

Terms

These terms apply to every paid call. Making one accepts them, for you and for whoever you act for.

What you buy. A paid call buys what its route says and nothing else: provision buys an inbox for 75 minutes with a 100 MiB quota, and extend adds 75 more minutes. The price is in the payment challenge before you pay, and nothing is charged afterwards. There is no account and no subscription.
Payments are final. They are not refunded: not for an inbox that received nothing, one cancelled under the acceptable-use rules, or one a site wouldn't take. A retry with the same Idempotency-Key is never charged twice.
As is. We work to deliver every message, but we don't promise that any message arrives, that any site accepts our addresses, or that the service is available at a given time. Don't use an inbox for an account you will need to recover by email.
Liability. As far as the law allows, our liability for anything to do with an inbox is limited to what was paid for it.
Cancellation. We cancel an inbox only for use against the acceptable-use rules.
Changes. We may change these terms and our prices. A change applies to calls paid after it is published here, never to one already paid.

Security

Report a vulnerability to security@admin.recvmail.net (also in /.well-known/security.txt). Test against inboxes you bought, never anyone else's.