Is an Email Tracking Chrome Extension Safe? Permissions Explained

An email tracking Chrome extension runs inside your inbox, so it is fair to ask what it can see. The good news is that Chrome tells you exactly what an extension is allowed to do. Here is how to read those permissions, the red flags to watch for, and what mailcheck asks for, line by line.

Table of contents

Where to check an extension's permissions

Open chrome://extensions, click Details on the extension, and look at "Site access" and "Permissions". The Chrome Web Store page also lists them under "Privacy practices". Two questions matter: on which websites does it run, and what can it do there?

Red flags

• "Read and change all your data on all websites" for a tool that only needs your webmail.
• Access to your browsing history, tabs or downloads, which a tracker does not need.
• No privacy policy, or one that says nothing about email content.
• A publisher you cannot identify, or an extension with no updates for a year or more.

What mailcheck asks for, and why

• Site access limited to your webmails: Gmail, Outlook.com, Zoho Mail, Hostinger Mail, Mail Orange and SFR Mail. It does not run on any other website.
• Storage: to remember your settings and your sign-in on this browser.
• Notifications: to tell you when an email is opened.
• Alarms: to check for new opens at regular intervals.
• Declarative net request: a rule that blocks the tracking image when you reopen your own sent email, so your rereads are never counted as opens.
• Network access to our own server only, to record the emails you track and fetch their opens.

What it does not do

mailcheck never stores the body of your emails. It records what is needed to track: the subject, the recipient, and when the email was opened or a link clicked. The full detail is in what we store and what we never see, and the extension's privacy policy is on its own page.

Good habits with any extension

• Install only from the Chrome Web Store.
• Review permissions again when an update asks for new ones.
• Remove extensions you no longer use.

Conclusion

A safe email tracking Chrome extension asks only for what tracking needs: access to your webmail, notifications, and its own server. Check the permissions before you install, and you will know exactly what you are trusting.

Frequently asked questions

Can an email tracking extension read my emails?

It runs on your webmail pages, so the question is what it stores and sends. mailcheck never stores the body of your emails.

Why does mailcheck need the declarative net request permission?

To block the tracking image when you open your own sent email, so your rereads never count as opens.

Does mailcheck run on other websites?

No. Its site access is limited to the webmails it supports and to its own sign-in page.

All articles