TempoLife › Features › Log by email › privacy

What an email address of your own would store

Exactly what a meal-logging address records: an ingest log line with the sending domain and an outcome, never the message body, with a fixed retention window and a one-click revoke.

No mail is being received, so nothing described here is being recorded today. This is the rule the handler would be built to.

The two rows that exist

The whole feature is two database tables and nothing else.

The address row. Your account id, the generated local part, a status of active or revoked, when it was created and when it was last used. That is the complete list. There is no mailbox, no forwarding target and no copy of your own email address in it.

The ingest log row. One per message a handler would deal with: which reserved address it was for, the domain the message came from, an outcome word, and a short detail such as a refusal reason. Four fields and a timestamp.

What is deliberately not stored

• The message body. Never written to the log, in any form, including a truncated one.
• The subject line. Subjects leak content — the name of a restaurant, a person, a clinic. The log records that a message arrived, not what it said.
• The full sender address. The domain is kept so you can recognise a stranger writing to you; the local part is not, because a full address is an identifier for a person.
• The raw image. A photo that becomes a diary entry lives in your diary, under the same rules as a photo taken in the app. The copy that arrived by mail is not kept separately.
• Headers. Routing headers describe your devices and your mail provider. They are used for the door checks and then discarded.

Retention

Ingest log lines are for troubleshooting — "why did that photo not appear?" — and troubleshooting has a short useful life. The intended window is 90 days, after which rows are deleted rather than aggregated. Deleting your account removes the address row and, through the foreign key, every log line attached to it, in the same operation.

The address row itself lives as long as the address does. Revoking marks it dead but keeps the name reserved, so it can never be handed to somebody else — a recycled address is how mail ends up in a stranger's diary.

How to revoke

On the main page, the Revoke this name button sets the status to revoked. From that moment a handler would refuse anything addressed to it at the door. Generate a new name does the same job for the case where you have pasted the address somewhere you regret: the old name stops working immediately and permanently, and a fresh unguessable one takes its place.

Neither action needs support, and neither is reversible. That is on purpose. A revoke you have to ask for is not a revoke.

If a stranger learns your address

Assume it will eventually happen, because addresses leak: they end up in forwarded threads, in screenshots, in the address book of anyone you have written to. The design therefore does not rely on secrecy.

The allow-list is the real control. Mail is accepted only from addresses you have confirmed on your own account, so a stranger who knows the name still cannot write to your diary — their message is refused at the door and leaves one log line showing their domain. If that starts happening, rotate the name and the noise stops at once.

The size limit and the per-hour rate limit are the second layer: they cap the damage from an address that has been posted somewhere public, so the worst case is a handful of refusal lines rather than a filled disk.

Frequently asked questions

Source: TempoLife feature status — inbound mail handler not implemented · checked 2026-09-02

Back to log by email · The full design · TempoLife privacy policy