Poof
A privacy-first disposable email service built with Next.js. Generate a temporary inbox, receive real emails in real-time, and burn everything when you're done — no accounts, no server-side storage.
Features
- Disposable inboxes — Random address generated per device, no sign-up required
- Real-time delivery — New emails show up within ~3 seconds; the browser polls an API route that reads them straight from Resend (no webhook, no Redis)
- Client-side encryption — Email content is AES-GCM encrypted in the browser before being stored in IndexedDB
- Auto-burn timer — Inbox self-destructs after 5 minutes, 1 hour, 24 hours, or never
- Burn on command — Instantly wipe an address and all its emails
- Address history — Browse emails from past addresses; clear all history permanently
- OTP & verify-link detection — One-time codes and verification links are automatically flagged
- Attachment support — Attachments stored as encrypted data in IndexedDB
- Zero server-side storage — The server is a relay only; emails are never persisted on the backend
- Dark / light theme
- Responsive — Mobile-friendly layout: email on one line, compact burn timer (flame + countdown + duration) with Copy/New as icon-only; rounded email box with draining border
Tech Stack
| Layer | Technology |
|---|
| Framework | Next.js 16 (App Router, Turbopack) |
| UI | HeroUI, Tailwind CSS v4 |
| Icons | Phosphor Icons |
| Email provider | Resend (inbound receiving API) |
| Real-time | Short polling (~3s) of /api/email/inbox/[address] |
| Local storage | IndexedDB via idb |
| Encryption | Web Crypto API — AES-GCM 256-bit |
| Language | TypeScript |
How It Works
User opens app
└─> Device config created in IndexedDB (email address + burn timer)
└─> Browser polls /api/email/inbox/[address]?since=<cursor> every ~3s
(every 15s while the tab is in the background)
Sender sends email to [email protected]
└─> Resend receives it via inbound MX and keeps it
Next poll
└─> Server lists recent inbound emails from Resend (cached ~2s, shared by all polls)
└─> Filters to the polled address, fetches the full email + attachments
└─> Returns new emails and a cursor; the browser saves the cursor so
nothing is missed between polls or reloads
Browser receives new emails
└─> Email content encrypted with AES-GCM device key
└─> Stored in IndexedDB
└─> UI updates instantly
User burns the inbox
└─> All emails deleted from IndexedDB
└─> Device config wiped
└─> New address generated on next visit
Getting Started
Prerequisites
- Bun 1.3+ (package manager)
- Node.js 20.9+ (required by Next.js 16)
- A Resend account with a verified domain and inbound email enabled
1. Clone and install
git clone https://github.com/yourusername/poof.git
cd poof
bun install
2. Configure environment
cp .env.local.example .env.local
| Variable | Required | Description |
|---|
RESEND_API_KEY | Yes | Your Resend API key |
NEXT_PUBLIC_EMAIL_DOMAIN | Yes | Your verified domain (e.g. yourdomain.com) |
NEXT_PUBLIC_APP_URL | No | Your deployed app URL (use an ngrok URL for local inbound) |
NEXT_PUBLIC_GITHUB_URL | No | If set, shows a GitHub link in the footer |
3. Configure Resend inbound
- Go to Resend → Domains → your domain → Inbound
- Add the MX record Resend provides
No webhook is needed — the app reads inbound emails through Resend's API using
RESEND_API_KEY, so it also works locally without a tunnel.
Rate limits: Resend rate-limits API calls per team. Polls on the same server instance share one cached listing (refreshed at most every 2s), and the client backs off on 429. For high traffic, ask Resend to raise your limit.
4. Run locally
bun run dev
Open http://localhost:3000.
Project Structure
app/
api/
email/
inbox/[address]/route.ts # GET — new emails for an address, read from Resend
generate/route.ts # POST — optional server-side address generation
layout.tsx
page.tsx
globals.css
components/
email-address-bar.tsx # Address display, copy, regenerate (icon-only on mobile)
burn-timer.tsx # Countdown + duration picker; compact row on mobile
inbox.tsx # Email list
email-viewer.tsx # Email content renderer
history-panel.tsx # Past addresses + clear all history
theme-toggle.tsx
theme-provider.tsx
sound-toggle.tsx # Optional new-email sound
favicon-badge.tsx # Unread count in favicon
hooks/
use-email.ts # Core state: config, emails, burn logic, history
use-inbox-poll.ts # Polls the inbox route, tracks the cursor
use-is-mobile.ts # Viewport ≤640px for responsive layout
use-new-email-sound.ts # Optional sound on new email
lib/
inbox.ts # Resend receiving API reads + short-lived cache
crypto.ts # AES-GCM encrypt / decrypt (Web Crypto)
db.ts # IndexedDB schema + CRUD via idb
domains.ts # Address generation
email-utils.ts # OTP extraction, link detection, burn progress
utils.ts # Class name utilities
API
GET /api/email/inbox/[address]?since=<epoch ms>
Returns emails sent to address that Resend received at or after since, oldest first, plus the server time now. The client sends now (minus a 30s overlap) back as the next since and skips IDs it has already stored. Returns 429 with Retry-After when Resend rate-limits.
Response:
{
"emails": [
{
"id": "resend-email-id",
"from": "[email protected]",
"subject": "Your OTP",
"html": "<p>Your code is 123456</p>",
"text": "Your code is 123456",
"receivedAt": 1712345678901,
"attachments": []
}
],
"now": 1712345680000
}
Privacy Model
| Data | Where stored | Encrypted |
|---|
| Email content (HTML / text) | IndexedDB (browser) | Yes — AES-GCM 256-bit |
| Attachments | IndexedDB (browser) | Yes — AES-GCM 256-bit |
| Device config (address, timer) | IndexedDB (browser) | No |
| Encryption key | localStorage | No (base64 raw key) |
| Emails in transit (Resend → app → browser) | HTTPS only | TLS |
| Emails at rest (server) | Resend (inbound storage, per your Resend retention) | Per Resend |
| Emails at rest (this app) | Nowhere — only a few seconds of in-memory cache | — |
This app never persists email content. Inbound emails live in your Resend account (as they do with any Resend inbound setup); the API route only caches them in memory briefly to stay under Resend's rate limits.
Scripts
bun run dev # Start dev server with Turbopack (suppresses Node deprecation warnings)
bun run build # Production build
bun run start # Start production server
bun run lint # ESLint
bun run format # Prettier
bun run typecheck # TypeScript type check
If you see a DEP0169 url.parse() deprecation warning, it comes from a dependency (e.g. Next.js or a transitive package). The dev script sets NODE_OPTIONS=--no-deprecation to hide it. To show it again (e.g. to trace the source), run node --trace-deprecation ./node_modules/.bin/next dev --turbopack.
Vercel: Polling uses short, normal requests, so there are no long-running functions to tune. To suppress the DEP0169 warning on Vercel, set the environment variable NODE_OPTIONS = --no-deprecation in your project’s Environment Variables (Settings → Environment Variables).
Contributing
See CONTRIBUTING.md for development setup and pull request guidelines. This project adheres to the Contributor Covenant Code of Conduct.
License
MIT — see LICENSE.
