The short version.

We don't store the email addresses you check. When you call our API, we extract the domain part (e.g. mailinator.com), log that with the verdict, and drop the local-part. The full email never hits disk.

What we store: your account (email, hashed password), API key hashes (so we can validate but never recover the key), and a row per check with: timestamp, IP address, domain, verdict, response duration. That's it.

Where data lives: a single Postgres database on a Hetzner Cloud server in Falkenstein, Germany. No third-party analytics, no Google Analytics, no Mixpanel, no cookies for tracking. The only cookie we set is the session cookie for the dashboard.

Email: we send transactional email (verification, password reset, plan-request confirmations) through our own self-hosted SMTP relay. Nothing goes through Mailchimp, SendGrid, Postmark, or anyone else.

Deletion: email hello@checkdisposable.email and we'll wipe your account and all usage rows within 24 hours.

Last updated: 2026-05-14