Never the body. Never a full IP address. Never sold.

For mail you send from Gmail in your browser, the body is never read, transmitted or stored. The extension appends a pixel and rewrites eligible links in the page; it does not send the content anywhere. The one exception to "never read" is a bounce notice: the extension reads the visible text of Gmail's own delivery-failure message to find the address that failed and Gmail's reason, and sends only those.

If you use an agent key, that changes for the mail the agent sends. To put a pixel in a message it never sees, MailSignals has to be given the message: the agent posts the HTML body to us, we rewrite it and send it straight back. The body is processed in memory and not stored; what is kept afterwards is the same as for any other message. If you would rather that never happen, do not create an agent key; mail you send from Gmail in a browser is unaffected.

Retention

Raw events are kept forever by default. Set a retention window in Settings and a daily job deletes events older than it; the per-message counters survive. Sender view signals and unmatched pixel hits are pruned after seven days regardless, and the stored copy of each digest email after 30 days.

"Delete everything", in the dashboard's Settings, removes every message, event, link, contact, statistic and alert and any digest still queued for you, and keeps only the account, its settings and its linked-mailbox list. To close your account altogether — profile, settings, linked mailboxes, agent keys and your sign-in identity too — email hello@mailsignals.io from the address you sign in with; it is done within 30 days. Deleted data leaves the database at once; the database keeps earlier versions of a record for up to one hour, and MailSignals keeps no backups.

The legal position

Tracking pixels are regulated, and the regulation is tightening.

• EU and UK. The ePrivacy Directive treats a tracking pixel as access to information on the recipient's device, which needs consent. It is not covered by the legitimate interest that may justify sending the email itself. France's CNIL published a recommendation in April 2026 requiring prior consent for marketing pixels, with narrow exceptions for security and deliverability. Other EU regulators routinely follow CNIL's lead.
• One-to-one professional email sits in murkier territory than bulk marketing, but "murkier" is not "exempt".
• United States. Open tracking is lawful and CAN-SPAM does not prohibit it.

MailSignals gives you the controls to comply rather than deciding for you:

• Do-not-track domains. Recipients at these domains are never tracked. Use it for EU domains if you want a blunt instrument.
• Disclosure footer. An optional one-line notice appended to tracked mail.
• Per-message off switch. Tracking is a toggle on every compose window.
• Emails to yourself are never tracked, with no way to override it.
• Minimal retention, and no location recorded.

If you send marketing email into the EU, get consent at the point you collect the address, and record it. That is outside what this tool can do for you. The guide on pixels and the law goes into more detail; none of it is legal advice.

What MailSignals will not do

• It will not store your email bodies. For mail sent from Gmail in a browser it never sees them at all; for mail an agent sends, the body is rewritten in memory and discarded immediately.
• It will not store anyone's full IP address, yours or a recipient's.
• It will not sell your data, share it with anyone, or use it to train anything. There is no analytics service, no advertising network and no data broker anywhere in the product.
• It will not claim a read when all it saw was a proxy prefetch, and it will not claim a bounce undoes a read by someone else.

Where your data travels

• MailSignals’ own systems, running on Google Cloud in Belgium (region europe-west1). Everything above.
• Google. Gmail itself (the extension runs inside it), Firebase Authentication for sign-in, and InboxSDK's in-page contact lookup against Google's own endpoint using your existing Gmail session.
• Your digest email. It is on by default — daily, at 08:00 in your timezone, on days you sent tracked mail — and you can change or stop it in Settings. Delivering it means handing it to Resend, which necessarily sees what it contains: your address, and the subject lines and recipient labels of the period's messages. Turn the digest off and nothing is handed to Resend.
• Web Push. The server can fan alerts out to browser push services, but no client currently registers a subscription, so nothing is sent.
• Software you connect. If you create an agent key, whatever you give it to sends message bodies to MailSignals to have them prepared. That software holds its own Gmail credentials, which we never receive.

Who processes it for us

We will update this list before adding or replacing a processor.

Why we may process it

• Your account, and running the service you asked for — including the digest, while it is on: to perform our agreement with you (the Terms of Service).
• Keeping the service secure and preventing abuse, such as refusing mail from Gmail accounts you have not linked: our legitimate interest in a service that cannot be turned against the people it records.
• Data about the people you email: we process it on your instructions as your processor. Having a lawful basis for tracking them, and any consent the law requires, is up to you as the controller; the legal position below explains why it matters.

International transfers

MailSignals' database and services run in the European Union. BoostYard LLC, Google and Resend are companies in the United States, so your data may be accessed from or processed in the United States. Where data protection law requires it, those transfers rely on the safeguards each company offers for international transfers.

Your rights

Depending on where you live, you may have the right to access your data, to have it corrected or deleted, to restrict or object to how it is processed, to take it with you, and to complain to a data protection authority. Most of this you can do yourself: Settings → Export your data in the dashboard gives you everything as CSV or JSON, Delete everything removes your history, and your name and picture come from your Google account, so they change when it does. For anything else, or to close your account, email hello@mailsignals.io; we answer within one month.

If you are someone a MailSignals user emailed, the sender decides what is tracked and is responsible for it, so ask them first. If you cannot, write to us and we will help as far as the law and our role allow.

Children

MailSignals is for adults sending their own or their organisation's email. It is not directed at children, and we do not knowingly hold data about anyone under 18 as an account holder.

Changes to this policy

The current version is always on this page, with its effective date. Before a material change takes effect we will tell account holders in the dashboard or by email.

Third-party library telemetry

The extension embeds InboxSDK (by Streak) to integrate with Gmail's interface. By default that library reports crashes to its authors and publishes usage events, including a hash of the Gmail address, the extension id and a session id, to Streak's own Pub/Sub topic. MailSignals loads it with globalErrorLogging: false and eventTracking: false, so neither channel is active. The library also calls Google's own contact-lookup endpoint from inside Gmail using the user's existing session; that traffic stays with Google. This was established by reading the shipped bundle of @inboxsdk/core 2.2.21, and the project's rules require re-checking it before upgrading.