Questions, answered without hedging.

The basics

What is MailSignals?

MailSignals is a self-hosted email tracker for Gmail. A Chrome or Edge extension adds a tracking pixel and signed links to the mail you send, a backend in your own Firebase project records what happens to them, and a dashboard shows opens, clicks, replies and bounces with the reason behind every verdict. It is open source under the MIT licence.

Who is it for?

Anyone who sends email that matters one at a time from Gmail, in Chrome or Edge, and wants to know what happened to it without paying a subscription or giving a vendor access to their mailbox: founders, freelancers, salespeople, recruiters, and people running their own infrastructure on principle. It is not a mass-mailing tool, a CRM or an e-signature product.

Does MailSignals need access to my Gmail account?

No. Sign-in asks Google for openid, email and profile only. There is no Gmail OAuth scope anywhere in the product: everything Gmail-related happens inside the Gmail page through the extension, using the InboxSDK library. That is why no Google verification review, no annual CASA security assessment and no user cap apply.

Is it free?

The software is free and MIT-licensed. You run it in your own Firebase project, which needs the pay-as-you-go Blaze plan because Cloud Functions require it; the free quotas still apply, and one person's email sits well inside them. Typical running cost is $0 to $3 a month, almost all of it the domain.

Which browsers and mail clients does it work with?

The extension runs in Chrome and Edge (Manifest V3) on Gmail in the browser. Recipients can use anything: the pixel and links work wherever images load and links are clicked, and the classifier recognises Gmail, Apple Mail, Outlook, Yahoo, Proton, Thunderbird and plain browsers, plus the proxies and scanners in front of them.

Is there a hosted version I can sign up for?

Not today. MailSignals is built to be self-hosted, and the reference deployment at app.mailsignals.io is the author's own instance with sign-in limited to test users. The self-hosting guide takes about an hour, most of it waiting for DNS and certificates.

Accuracy and what it can see

How accurate is open tracking?

Less accurate than any tracker's green tick implies, and MailSignals says so. Gmail fetches images through a proxy and caches them, Apple Mail downloads them on delivery before anyone reads, and security gateways fetch everything. MailSignals classifies each request with one of 15 rules, records a confidence and a reason, and counts only what a person was plausibly behind. Replies beat clicks beat opens, and the interface is built to say so.

Will it count my own opens when I look at my Sent folder?

On desktop Gmail with the extension installed, no. The extension tells the backend which sent messages you are looking at, and any pixel hit within 20 seconds of that is withdrawn as your own; a direct fetch from your own network with a Gmail referrer is recognised too. On a phone without the extension a proxied self-open cannot be told apart, so the dashboard offers "That open was me", and the recommended fix is Gmail's "Ask before displaying external images" setting on every device.

What about Apple Mail Privacy Protection?

Apple's proxy downloads the pixel when the message is delivered, whether or not anyone reads it. MailSignals labels that "Delivered, open unconfirmed", shows an amber tick, and does not count it as an open at the default sensitivity. You can choose the lenient setting if you would rather count it.

Can it tell me which recipient of a group email opened it?

No, and it will not guess. One message carries one pixel, so an open on a multi-recipient message means someone read it. The tooltip says "N recipients, so we cannot tell which one", and per-contact statistics are only updated for single-recipient messages.

Can it see if a recipient deleted, archived or reported my email?

No. Nothing leaves the recipient's mailbox when they do those things, so no tracker can observe them, whatever it claims. MailSignals reports the two recipient-side outcomes a sender can actually see: a delivery failure, from Gmail's own notice, and a reply.

How does it detect replies without the Gmail API?

From the Gmail page. A thread that contains one of your tracked sends and gains a newer message from someone else is a reply; the extension notices it in the open thread and in the Inbox list. A reply to a thread you never open and that never appears in the Inbox can be missed, so "mark as replied" exists as an escape hatch.

Privacy and recipients

What does it store about the people I email?

A timestamp, the user agent, the IP truncated to a /24 (IPv4) or /48 (IPv6) plus a salted hash of it, the referrer and HTTP method. Never the full IP address, never a location, never the content of the email. Behind Gmail, Outlook.com, Yahoo and Apple the request comes from the provider's proxy anyway, so even the truncated network describes a data centre.

Does it read or store my email?

For mail sent from Gmail in a browser, the body is never read, transmitted or stored: the extension adds a pixel and rewrites eligible links in the page. Subject line, recipients, Gmail ids and the URLs of tracked links are kept so you can recognise the message. If you set up an agent key, the agent posts each body to your own deployment to have the pixel added; it is rewritten in memory and not stored.

Are tracking pixels legal?

It depends where your recipients are. In the EU and UK the ePrivacy rules treat a pixel as access to the recipient's device, which needs consent, and France's CNIL now requires prior consent for marketing pixels. In the United States open tracking is lawful. MailSignals gives you the controls to comply: a do-not-track domain list, an optional disclosure footer, a per-message off switch, minimal retention and no location. You are the data controller for what you send.

Does any data leave my project?

No. Nothing is sent to any service other than your own Firebase project and Google's own services (Gmail itself, and Firebase Auth for sign-in). The one embedded third-party library, InboxSDK, is loaded with its crash reporting and usage telemetry switched off. This website sets no cookies and loads no scripts either.

Can I export or delete everything?

Yes. Messages, events, contacts and links export as CSV or JSON, guarded against spreadsheet formula injection. "Delete everything" removes every message, event, link, contact, statistic and alert and keeps only the account, its settings and its linked-mailbox list. Because the data is in your own project, delete means deleted.

Self-hosting and operations

What do I need to self-host it?

Node 22 and pnpm 10, the Firebase and gcloud command-line tools, a Google account, a domain with two spare subdomains (one for the dashboard, one for tracking), and a card for Firebase's Blaze plan. Budget about an hour for a first run.

Why does it want a separate tracking subdomain?

Because the tracking host's reputation is shared with every recipient's spam filter. Keeping it free of anything else means one blocklisting cannot take the dashboard down with it. The host serves only the pixel and the redirects, plus a minimal page and a robots file that disallows crawling. Commercial trackers share one tracking domain among all their users, which is why it ends up on blocklists.

I have several Gmail accounts in one browser. Which ones are tracked?

Only the ones you link. The address you signed in with is linked automatically; any other Gmail account the extension sees is recorded as "needs a decision" and refused until you approve it in Settings. The server enforces this before anything is written, so mail from a colleague's account on a shared machine can never be filed under yours.

What happens to my email if MailSignals breaks?

It sends, unmodified, on time. The extension never cancels a send; every hook is wrapped so a failure leaves the message untouched, and anything that rewrites a body returns the original on any doubt. Losing tracking is always preferred to touching your correspondence.

Can it track email my AI agent sends?

Yes. An agent that sends through the Gmail API never touches the browser, so the extension cannot see it. Instead the agent asks your deployment to prepare the message: it gets the body back with the pixel and signed links added, sends it with its own Gmail access, and confirms the ids afterwards. A small MCP server exposes this as five tools. The agent holds no signing key and makes no policy decision.