Security & trust

What MyEmailTracker sees of your emails, what it does not, and where your data lives. This page is meant to be forwarded as-is to your DPO or IT department.

What the extension sees

The extension acts only inside the open Gmail tab: it inserts the pixel on send, shows the ✓✓ and notifies you. It requests no API access to your mailbox: our servers can neither read, store, nor send your emails.

  • Metadata of the emails you track: recipients (encrypted), subject, timestamp
  • Open and click events on those emails
  • Minimal Chrome permissions: local storage, notifications, and only the Gmail pages and our own app

What we never see

  • The content of your emails and your attachments
  • Your inbox and the emails you receive
  • Your Google password (OAuth sign-in)

Your data

Recipient addresses encrypted at rest, IPs and user agents purged after 12 months, no recipient profiling. You can delete your account, and everything in it, at any time from your settings.

Hosting and subprocessors

Application and database hosted on Heroku (Salesforce), European Union region. Subprocessors: Stripe (payments), Twilio SendGrid (transactional emails), Google (OAuth sign-in and push notifications). Transfers are covered by the Data Privacy Framework and standard contractual clauses.

For your DPO

The full detail (legal bases, retention periods, recipient rights) lives in our privacy policy. Need a data processing agreement (DPA) or an answer to a security questionnaire? Contact us.