What Mailcheck Stores, and What It Never Sees

You are about to give a browser extension access to your inbox. The honest question is not whether it is useful. It is what it can see once it is in there. Here is the entire list of what mailcheck stores, what it never touches, and how to verify the same thing about any other tracker you are considering.

Table of contents

The question nobody asks out loud

Installing an email extension is a strange act of trust. Your inbox holds your contracts, your salary, your medical appointments and every password reset you have ever requested. Most people click Add to Chrome and think about it later, or never.

We would rather answer the question before you ask it, because the answer is short and it is the same answer whether you are a free user or a paying one.

The complete list of what we store

For each email you choose to track, and only for those:

• The subject line, so you can recognise the email in your dashboard.
• The recipient address, for the same reason.
• Your sending address and provider, Gmail or Zoho Mail.
• The time you sent it.
• The time of each open, and the browser identification string that loaded the image.
• A short one-way hash of the network address that loaded it. Not the address. A hash, truncated, which cannot be turned back into an address.

If you switch on click tracking, add to that list the links you put in your own email and the time each was clicked.

That is everything. There is no seventh item we left off the list to make it look shorter.

What we never see

The body of your emails. Your attachments. Your drafts. The emails you receive. The emails you send without switching tracking on. Your contacts. Your calendar. Your password.

The extension runs inside Gmail and Zoho Mail, so a browser could technically let it read what is on the screen. It does not, and that is not a promise you should take on faith. The section below explains how to check it yourself in about four minutes.

Why the body of your email stays out of it

Partly because it is none of our business. Mostly because storing it would make us a liability to you rather than a tool.

A company that holds the text of its customers' emails holds something worth attacking. It also holds something a court can ask for, an acquirer can value, and an employee can be tempted by. The cheapest way to never leak your emails is to never have them, and that constraint shapes the product: every feature we build has to work without reading what you wrote.

It is also why our AI follow-up coach asks for consent email by email rather than reading everything in the background. The default is that we do not have it.

What your recipient sees

This part matters as much, because tracking involves someone who never agreed to anything.

Your recipient receives an image one pixel wide, invisible in practice, hosted on our domain. Their mail client loads it or does not. We learn that it was loaded, when, and by roughly what. We never learn their name, we never contact them, and we never build a profile of them across senders. Someone who is tracked by two different mailcheck users is not linked into one person in our database.

If they use Apple Mail with Privacy Protection on, or block remote images, the image is either preloaded by a proxy or never loaded at all, and you see either a false open or nothing. We wrote about that in Apple Mail Privacy Protection.

How to check any tracker for yourself

Do not take our word for it, or anyone else's. Two checks, no technical background required.

Read the permissions. On the Chrome Web Store, scroll to the permissions the extension requests. An open tracker needs to run on your mail provider's pages and to talk to its own server. If it asks to read your browsing history, or to run on every website you visit, ask why.

Watch what it sends. Open your inbox, press F12, go to the Network tab, and send yourself a tracked email. You will see the request that registers it. Click it and read what was sent. If the body of your message is in there, you have your answer, and it is not the one you wanted.

That second check takes four minutes and works on any extension, including ours. We would rather you did it.

Conclusion

Email tracking has a bad reputation partly because some tools earned it. The useful question is not whether tracking is creepy in the abstract, but what a specific tool actually keeps.

Ours keeps six things, all of which you could write on a postcard, and none of which is the content of your email. If that is still too much for the way you work, turning it off is one click and the extension does nothing at all.

Frequently asked questions

Where is the data stored?

In the European Union, on Cloudflare infrastructure, by a French company. See our privacy policy for the formal version.

Can I delete everything?

Yes, and without asking us. Deleting your account removes the tracked emails and the open history with it.

Do you sell or share this data?

No. There is no advertising business attached to this product, and the data is not aggregated into anything sold to anyone.

Why store the browser identification string at all?

Because it is how we recognise an image proxy, which is what tells a real open apart from a machine loading everything on delivery. Without it, your counts would be far less honest.

Is the recipient informed?

Not by us. Whether to tell them is your decision and depends on your jurisdiction and your relationship with them. Our article on tracking and the GDPR covers the reasoning.

All articles