Security
The strongest thing we can tell you is what we cannot reach.
Most security pages list what a company protects. The most important fact about MailSignals is what it was never given: no permission to read, send or delete your mail. Everything below follows from that, and each guarantee is enforced in code rather than promised in a policy.
- Gmail permissions requested
- 0
- Full IP addresses stored, ever
- 0
- Analytics or advertising services
- 0
- Automated tests on every change
- 451
The guarantees
Each of these is a property of how MailSignals is built, not a policy that could be revised quietly. Where one has a cost, the cost is stated.
Nobody at MailSignals can read your mail
Sign-in asks Google for your name, address and profile picture. There is no Gmail permission anywhere in the product, so nothing we run can read, compose, send or delete a message.
Why it matters. This is not a policy we could quietly change: the ability was never granted. Every alternative tracker holds the full mailbox scope, which means an insider, a bug or a breach on their side reaches your whole mailbox. On ours there is nothing to reach.
Only our servers can record that something happened
No browser, extension or API client can create or alter a message, an event, a click, a counter or a statistic. Clients may change exactly two things: their own settings, and whether they have read their own alerts.
Why it matters. A pixel hit is evidence. Evidence a client can forge is worthless, and anything able to write its own counters could also sidestep the classifier, which is the one thing that makes these numbers worth reading.
The tracking endpoint tells an attacker nothing
A request for a tracking pixel that does not exist gets byte-for-byte the same reply as a real one. Asking about a message belonging to someone else answers exactly as a malformed request does.
Why it matters. Tracking links are printed inside other people’s inboxes. If the endpoint answered differently for real and invented tokens, anyone holding one could learn which others exist.
No recipient’s full IP address is ever stored
Only the network, truncated to a /24 for IPv4 or /48 for IPv6, plus a salted hash. The full address exists for the microseconds the request is being handled and is never written anywhere. The same applies to you, the sender.
Why it matters. Truncation is enough to notice "same network as last time" and the hash is enough to tell two devices apart, and neither can be turned back into a person. The salt is secret, so the hash cannot be reversed by working through every possible address.
Your mail sends even when we break
The extension never cancels a send. Every hook is individually isolated, and anything that rewrites a message returns your original text on the slightest doubt. If the extension has been updated underneath an open tab it refuses to track rather than plant a pixel that cannot be registered.
Why it matters. The extension sits directly in the path of your correspondence. Any failure that delays, mangles or cancels a send is worse than the entire feature not existing.
Only a Gmail account you linked is ever tracked
A message is recorded only if the address it was sent from has been linked to your account, checked on our side before anything is written. The address you signed in with is linked automatically; every other one needs a deliberate decision.
Why it matters. A browser can hold several Gmail accounts at once and the extension runs in all of them. Without this, mail sent from a colleague’s or a family member’s account on a shared machine would be filed under whoever happened to be signed in.
Your data goes nowhere you have not been told about
No analytics, no advertising, no data broker, no third-party error reporting. MailSignals runs on Google Cloud, and the one other company that receives anything is Resend, which delivers your digest email while you have it switched on. The one external library the extension embeds is loaded with its own crash reporting and usage tracking switched off, which we verified by reading the code it actually ships rather than its documentation.
Why it matters. A library that phones home breaks the promise even when the payload is only telemetry, and defaults are set by people whose interests are not yours.
Uncertainty is reported as uncertainty
An Apple Mail prefetch is reported as delivery, never as a read. An open seen through a mail proxy is labelled a lower bound. An open on a message with several recipients never names one. A client we cannot recognise is recorded and counted nowhere.
Why it matters. It belongs on a security page because the failure it prevents is the same one: a number someone acts on that was never true.
How it is built
Tracked links are signed
Every tracked link carries a signature computed with a key belonging to your account alone, and the redirect verifies it before doing anything else. A tampered destination is refused rather than followed. Without this the redirect would be an open redirector, which would get the domain blacklisted within days and, worse, let a stranger send people anywhere under our name. The signing key never leaves our servers: the extension asks for finished links rather than the key to make them.
Keys for software are scoped and hashed
If you connect software that sends mail without a browser, it gets a key that reaches the agent endpoints and nothing else — it cannot read your history, change a setting, delete anything or create another key. We store only a salted hash of it, so the secret cannot be recovered from our database. Revoking one stops it on the very next request.
Every request is authenticated and scoped
Each API call carries a verified Google identity token, checked for revocation on every request, and each account can reach only its own data. That boundary is enforced by the database itself rather than by application code remembering to check, so a mistake surfaces as a refusal instead of as someone else’s data.
Abuse cannot become your problem
The tracking endpoint absorbs floods of invented tokens without touching the database. Data exports are protected against the spreadsheet formula-injection trick, because an export contains text that recipients chose. Signing out of the extension erases everything it held locally, including anything queued but not yet sent, which is the part that would otherwise be readable by the next person to use a shared machine.
Secrets live in a vault, not in code
The salt used to hash addresses and the keys used for notifications are held in Google Secret Manager and granted to the running service, never committed anywhere. If the salt were missing the service falls back to an obviously fake value, so a misconfiguration is visible rather than silently insecure.
Isolation is tested, not assumed
A suite of 73 checks runs against the live service as a genuine second user and tries to reach the first user’s data: reading it, writing to it, forging a link signature with the wrong key, using one kind of credential where another is required, and inflating one’s own open counts. Any of them succeeding fails the release. In total 282 checks run against the real service, alongside 451 tests that run on every change.
Reporting a vulnerability
If you believe you have found a security problem in MailSignals, please tell us before you tell anyone else, and we will treat it seriously and quickly.
Email hello@mailsignals.io with "security" in the subject. Include what you found and how to reproduce it. We will confirm we have received it, keep you informed while it is being fixed, and credit you when it is resolved if you would like that.
Please do not test against other people’s accounts or data, and please give us a reasonable chance to fix an issue before publishing it. A machine-readable copy of this contact lives at /.well-known/security.txt.
See what happened to your last email.
MailSignals is in early access, open to anyone and free while it is. Add the extension to Chrome or Edge, sign in with Google, and the next message you send is tracked.