Open-source · self-hosted · on Cloudflare
Give out a random address instead of your real one. Mail sent to it is parsed and delivered straight to you, as a Discord DM, a Telegram message, or a Slack DM, no separate inbox to check, no account, no web app. Torch it when you're done.
Forks the repo, creates the database, deploys the Worker.
/new mints a random address, permanent by default.
Use it anywhere you don't want your real address going.
Parsed, HTML to text, links intact, attachments forwarded.
/torch kills it whenever you're done with it.
Same six commands, wherever you already are.
Structured slash commands, ephemeral replies visible only to whoever ran them, mail delivered as a DM regardless of which channel a command was run in.
Plain-text /command args, private chats only so a reply is never visible to anyone but you, works on a single Worker with no extra infra to run.
Slash commands prefixed /cm- (Slack reserves the bare names), ephemeral replies visible only to whoever ran them, works from a DM or any channel alike.
One Worker, no external dependencies.
A hosted service is a third party operator sitting between you and your mail, an account you have to trust with it. Cindermail is one Worker you deploy yourself: no account system to trust, no operator with visibility into your specific mail. It still runs on Cloudflare's infrastructure, same as any self-hosted software runs on someone's servers, but the account, the data, and the access are yours alone.
No. Leave DISPOSABLE_DOMAIN unset and it runs on mail.tm's domain
instead, no domain, no DNS, no Email Routing needed. Your own domain is better if
you'll use it for signups, since public mail.tm addresses get blocklisted by some
sites; mail.tm mode is the zero-setup option to try it first.
Yes, any combination, all sharing the same D1 database and the same address pool, just distinguished by who owns each address. Telegram can even run in a different mode than the rest, one on your own domain and one on mail.tm, if it's split onto its own Worker.
It's parsed once and delivered, not stored. The status page's totals are running counts, not a log: no addresses, no content, no owners, just numbers.
/new refuses once you're at the configured cap (5 by default) and tells
you your current count against it. Torch one you don't need to make room, or raise
MAX_ACTIVE_ADDRESSES if you're running this just for yourself.