Privacy Policy & Data Protection Practices

1. Data Minimization & Separate Retention Periods

UES.edu.pl is built on data minimization principles. We do not require account registration, personal names, phone numbers, or passwords to generate a temporary mailbox. We strictly separate Email Content Retention (automatically purged after 24 hours) from Edge Security & Anti-Abuse Logs (short-lived IP rate-limit counters and Cloudflare Turnstile logs used strictly to mitigate spam and DDoS attacks).

2. Information We Process & Local Browser Storage

• Ephemeral Email Content (24-Hour TTL): Incoming messages sent to generated @ues.edu.pl addresses are temporarily stored in our database so they can be displayed in your browser inbox, and are permanently hard-deleted after 24 hours.
• Local Browser Storage (localStorage): We use your browser's local storage for five specific functional keys: temp_mailbox (retains your active temporary mailbox address and creation timestamp across page reloads), cookie_consent (stores your accepted or declined privacy choice), and three short-lived UI cache keys—ues_cached_ads, ues_cached_friend_links, and ues_featured_badges_cache—which cache public sponsor banners, partnership links, and footer badges locally to reduce redundant network requests. None of these local storage keys contain personal identity data or perform cross-site tracking.
• Short-Lived Security & Rate-Limit Logs: To protect our mail servers against automated abuse and DDoS attacks, Cloudflare edge infrastructure and our API gateway temporarily process IP-based rate-limit counters (e.g., hourly mailbox creation limits) and Cloudflare Turnstile bot-verification tokens. These operational security records are never linked to your identity and are automatically rotated and purged.

3. 24-Hour Ephemeral Email Purge & Sensitive Account Warning

All generated mailboxes and incoming emails are strictly ephemeral. When a mailbox or message exceeds its 24-hour Time-To-Live (TTL) window (created_at / received_at older than 24 hours), automated cleanup routines permanently execute a hard DELETE from our database. We do not maintain archival backups of expired user emails.

Critical Security Notice: Because temporary addresses are unauthenticated and automatically purged after 24 hours, never use a @ues.edu.pl address for banking, financial accounts, medical records, password managers, or permanent account recovery. Any password reset link or verification code sent after expiration is permanently unrecoverable.

4. Cookies, Google Analytics & Consent Control

We respect your tracking preferences under EU GDPR and ePrivacy rules. By default, Google Consent Mode v2 is initialized with ad_storage, analytics_storage, ad_user_data, and ad_personalization set to denied. The Google Analytics script (gtag.js) is strictly gated and is only loaded if you explicitly click "Accept All" on our cookie banner.

If you click "Decline" (or do not consent), Google Analytics remains disabled (window['ga-disable-G-1RHM4X6PDH'] = true) and any existing _ga cookies are actively purged from your browser. You can review or revoke your choice at any time by clearing site storage or visiting Google Ads Settings.

5. Data Security & Infrastructure

All communication between your web browser and UES.edu.pl is encrypted via TLS 1.3 / HTTPS through Cloudflare's global edge network. Incoming HTML emails are sanitized inside a restricted sandbox before rendering to prevent cross-site scripting (XSS) and unauthorized tracking pixels.

6. Your GDPR & CCPA Privacy Rights

You have the right to delete your active temporary mailbox and clear local browser storage at any time using the "Delete / Reset" controls in the mailbox interface. For privacy inquiries or data protection questions, contact us at privacy@ues.edu.pl.