The address is not an access-control system
There is no mailbox password, account ownership check or guarantee that an address is allocated only to you. Anyone who knows an address may be able to retrieve its mail.
Use it for low-stakes, short-lived needs. Do not send or receive identity documents, payment details, medical information, confidential work, or recovery links for important accounts. A disposable address does not make another website anonymous or safe.
Less active content, not a guarantee of safety
Mail is shown as text. Scripts, remote images and embedded content are not loaded in the reader. Web links are shown separately with their destination domain; opening one leaves KilgoreTM.
Sender names and domains can be misleading. Check the full destination before opening a link. Do not enter passwords or codes into a page just because an email asks you to.
Attachments are download-only, limited to 10 MiB, and not scanned for malware. Use your device’s protection tools and do not open files from untrusted senders. KilgoreTM does not provide end-to-end encrypted email.
Look after the copies you create
By default the app keeps your addresses, names, pins and message-organisation flags in tab session storage when available. If you opt in, those details are also saved in this browser and shared with other tabs using device mode. Message bodies and attachments are not saved in that database.
Forget address removes the selected address from the active storage mode and clears its displayed inbox, not external mail records. Session-only mode does not delete the device copy; use Storage to delete saved inboxes explicitly.
Your clipboard, browser restoration, downloads and another tab can retain copies independently. On a shared device, clear site data and downloaded files, replace sensitive clipboard contents, and do not rely on closing a window as a secure wipe.
Mail data is not placed in the offline cache. Shared request limits and temporary failures can still prevent access; do not rely on this service for urgent or consequential communications.
Report a vulnerability privately
Email Contact@thekilgore.com with the subject “KilgoreTM security”. Include a short description, the affected route or feature, a minimal reproduction using synthetic data and the impact you observed.
- Do not access another person’s mailbox, collect personal information, disrupt availability, or continue beyond what is necessary to demonstrate the issue.
- Do not target third-party infrastructure. This reporting channel is not permission to test systems you do not own.
- Keep sensitive details private while the report is assessed. Do not post live secrets, message contents or exploit data in public channels.
There is no published bounty, guaranteed response time, certification or promise of legal safe harbour. Ask for written authorisation before any testing that could affect other users or availability.
Machine-readable reporting contact: security.txt. General abuse and privacy concerns can use the same private email with the appropriate subject.