Privacy for end users
Apps use SignupBouncer to check new signups for disposable email addresses and abuse. If you signed up to one of them, this page says what we receive about you, what we keep and for how long, where it is processed and who handles it. Last updated 16 Oct 2026.
Who decides
The app you signed up to decides why your signup is checked and what happens to it, and its privacy notice applies. We process your data for that app, as its processor, under our Terms of Service. We do not sell it or use it for advertising.
What we receive
- Your email address and the IP address you signed up from. If the app sends them, also your browser's user agent and the sign-in provider you used, such as Google. We do not use or store the user agent.
- From an app on Supabase, the new user's record as Supabase sends it. We read only the email address, the IP address, the user id and the sign-in provider. The rest is ignored, and the record is never stored or logged.
What we keep, and for how long
We never store your full email address or IP address. They exist only in our server's memory while the check runs. We keep the items below.
Several of them are keyed hashes. A keyed hash is a fingerprint of a value, made with a secret key unique to the app's account. Without the key, nobody can turn it back into your address. When the app deletes its account, we delete the key, and the hashes can no longer be matched to an address.
| What we keep | How long |
|---|---|
| The check log: the time, the app, the sign-in provider, your email's domain, a keyed hash of the part before the @, the /24 subnet of your IP (/48 for IPv6), the network owner (ASN), the result (allow, challenge or block), the score and the reasons | 30 days, plus a few hours while the cleanup job runs. Entries from our launch test are kept until its result is recorded. |
| Keyed hashes of your inbox and signup attempt, to spot the same inbox signing up again | 7 days, plus at most 30 seconds of cleanup delay. |
| Velocity counters: keyed hashes of recent signup attempts per subnet, per hosting or VPN network, and per address pattern | 1 hour or 24 hours, by counter, plus at most 30 seconds of cleanup delay. |
| A keyed hash of the signup attempt with our answer, for a retried request | 10 minutes. |
| The mail servers of your email's domain | 1 hour, or 10 minutes when the domain cannot receive mail. |
| An override, if the app adds your address or IP to its own allow or block list: a keyed hash, with the first letter and domain of the email or the /24 (/48) of the IP as a label | Until the app removes it or deletes its account. |
| Encrypted nightly backups of our database. They hold the check log, overrides and the records we keep of retried hook requests. The inbox hashes, velocity counters and mail-server lookups are never backed up. | Each backup is deleted after 30 days. The three newest are always kept. |
The app sees its check log on its dashboard. We use the check log to show it to the app, to apply the app's plan, and to count checks, results and response times across all apps. Those counts identify no signup.
Where it is processed
Our server is in Virginia, US. Requests reach it through Cloudflare's worldwide network. If you sign up from outside the US, your data is transferred to and processed in the United States.
Who handles it
These providers handle your signup for us. We share it with no one else, unless the law requires it or we sell or transfer our business. We email the apps that use us at least 30 days before we add or replace a provider on this list.
| Provider | What it does | What it sees | Where |
|---|---|---|---|
| OVHcloud | Hosts our server. | Everything we keep, listed above, and your signup while it is checked. | Virginia, US |
| Cloudflare | Every request to our API passes through Cloudflare, which protects the server. Supabase hook calls pass through a Cloudflare Worker we run. Our server looks up the mail servers of email domains through Cloudflare's DNS resolver. Our nightly database backups are stored in Cloudflare R2. | Each request as it passes, including your signup. Your email's domain, for the mail-server lookup. The database backups listed above, encrypted before they leave our server, and only we hold the key. | Cloudflare's worldwide network. Cloudflare is a US company. |
What the app does with the result
We give the app a score from 0 to 100, a result (allow, challenge or block) and the reasons. The app decides what happens next. It can let you in, ask you to confirm your email, or refuse the signup.
Where a law gives you rights about decisions made by automated means, such as asking a person to review a refused signup, the app provides them. If an app refused your signup, look up your email's domain to see what we know about it.
Your rights
Send requests to see, correct or delete your data to the app you signed up to. It controls your data, and we help it answer. If you write to us at support@signupbouncer.com, we pass your request on to the app.
About this page
This page stays at this address, so apps can link to it from their own privacy policies. We update it when what we receive or keep changes, and change the date at the top. Our full Privacy Policy covers our customers and visitors to our site as well.
Final Dynamics LLC, doing business as SignupBouncer
c/o Northwest Registered Agent, LLC, 502 W 7th St, Ste 100, Erie, PA 16502-1333, USA
support@signupbouncer.com