OTPGmail Privacy Policy: What Data We Collect and Why

Last updated October 2, 2026

This policy explains what OTPGmail stores about you, why, who receives it, how long it is kept and what choices you have. It describes how the system actually works today.

The short version

We store account, order and top-up data, the content of emails that reach your rented inboxes, and support messages, to run the service and so you can look things up later.
Your OTPGmail password is stored as a salted hash, never in readable form.
No advertising cookies; visit statistics use no cookies and store no IP addresses.
Emails in an unfamiliar format may be analysed by an AI language service (Google), and support messages are machine-translated between Vietnamese and English.
Access logs are deleted after 90 days; order history, received email content and purchased-account details are kept so you can review them.
To ask for deletion, contact support.

Who is responsible for your data

OTPGmail (otpgmail.net), run by the OTPGmail team from Vietnam. Send any question about your data through contact and support.

What we collect and why

Data	What it includes	Used for
Account	Email, username, hashed password, API key, balance, language, country at sign-up (from network data), how you found us (referrer, campaign, first page), share code if enabled, internal admin notes	Signing in, running your account, measuring channels
Rentals	Service, issued address, code or link, content of the emails received	Showing codes, letting you review them, handling complaints
Purchased Gmail accounts	Email, password, recovery email, link or cookies delivered	Letting you view and download them again under History
Top-ups and balance	Amount, gateway, reference; for crypto also network, receiving address and transaction ID; every top-up, rental and refund entry	Crediting payments, reconciliation
Support	Messages with the admin and their machine translation; service requests (service name, sample email, your Zalo or Telegram)	Answering and handling your requests
Technical logs	IP address, browser, sign-in times, API request paths	Security and abuse prevention; deleted after 90 days

Emails that reach a rented inbox

The system reads emails sent to your rented inbox automatically to extract the code or verification link, and stores them with the order so you can review them.
Emails that do not match a known format may be sent to an AI language service (Google) to create extraction rules. For the iCloud version of "Any service", the beginning of an email from a new sender may be sent to identify the service.
An iCloud inbox can be used by several customers for different services; each customer sees only the email from the service they rented.
If you switch on a share code, anyone with that share code and an email address can view that address's codes.
A rented inbox is not your private mailbox: do not use it for accounts that hold sensitive personal data.

Credentials of purchased accounts

The login details we deliver (email, password, recovery email, link or cookies) are stored so you can view and download them again under History. Anything you download is yours to keep safe.

Payments

OTPGmail has no card gateway, so it never processes or stores card numbers. Bank transfers go through Vietnamese bank payment gateways; USDT/USDC and Binance payments are matched through exchange APIs and public blockchain data.

Cookies, browser storage and visit statistics

Cookies: og_at and og_rt keep you signed in; lang and theme remember your language and display mode for 1 year. No advertising cookies.
Browser storage (localStorage): the source of your first visit (kept for 90 days and sent with your sign-up), the stock source you picked for each service, and display preferences.
Visit statistics: no cookies and no stored IP addresses. Each visitor counts once a day as a hash that changes every day, together with page views, traffic source and country; bots and admins are not counted.
Our CDN and security provider may set its own technical cookies for bot checks.

Only the parties needed to run the service, by category:

Inbox and account suppliers: email sent to a rented inbox passes through their infrastructure.
Vietnamese bank payment gateways and crypto exchanges: to match your top-ups.
A CDN, security and bot-protection provider.
An email-delivery service, used only for password-reset codes. OTPGmail emails you only when you ask for a password-reset code; it sends no marketing email.
An AI language service (Google): analysing emails in unfamiliar formats, identifying senders for the iCloud version of "Any service", and machine-translating support messages and notices between Vietnamese and English.

Retention and deletion

Access and technical logs are deleted automatically after 90 days.
Order history, received email content and purchased-account details are kept so you can review them.
Top-up history and balance entries are kept for reconciliation.
To ask for your data to be deleted, message support through contact and support with your account email.

Security

The site runs over HTTPS; passwords are stored as salted hashes; password-reset codes are sent by email and expire after 10 minutes; sign-up includes a bot check. You can generate a new API key at any time on the Account page — keep your API key and batch code links private.

Users under 18

OTPGmail is not for anyone under 18; users must be at least 18 years old under the Terms of use.

Changes to this policy

October 2, 2026: first version.

Frequently asked questions

Does OTPGmail read the emails sent to a rented inbox?

Yes, automatically: the system reads them to extract the code or verification link and stores them with the order so you can review them. Emails in an unfamiliar format may be analysed by an AI language service (Google) to create extraction rules.

Is my password stored in plain text?

No. Your OTPGmail password is stored as a salted hash. The login details of short-lived Gmail accounts you bought are stored so you can view them again under History.

Does OTPGmail track me with cookies?

No advertising cookies. Visit statistics use no cookies and store no IP addresses; OTPGmail's own cookies are only for signing in, language and display mode.