Your emails stay yours.
A read receipt shouldn't mean handing over your inbox. MailViewed is built so it never reads your mailbox. Here's exactly how, in plain English.
The extension uses no Gmail API permission and doesn't fetch, search or download your mailbox. It works only inside the Gmail page you have open: the email you're sending, the ticks in your sent list, and a conversation you open (to notice a reply, to recognise your own tracked email so your view isn't counted as an open, and, if someone else tracked that email with MailViewed and you're one of its recipients, to confirm to them through us that it was displayed to you). The only Gmail permission MailViewed ever requests is the optional, send-only gmail.send, used by Compose and by individual copies for group emails. Send-only means exactly that: it can't read any mail.
We store zero content from the emails you send: no body, no attachments, not even a preview. A tracked email is identified by its subject, recipients, and time; the only email text we keep is what you choose to save yourself, your templates and signature. Two features pass a message through our server on its way out, because we send it for you through your own Gmail: Compose (the body is encrypted and held for its 10-second undo window and the send) and individual copies for group emails, a Pro setting that's on by default once you connect Gmail (held in memory only while each person's copy goes out; you can turn it off in Settings). Either way it's used only to send the email and discarded right after.
Sign-in uses Google's official OAuth. It shares only your basic Google profile (name, email address and profile photo; we keep just the name and email), never your Google password, and no ability to read your mailbox. Connecting Gmail, for Compose and individual copies, is a separate, optional grant of the send-only gmail.send permission. You can revoke either from your Google account at any time.
Every connection to MailViewed runs over HTTPS/TLS. Data moving between your browser, the extension, and our servers is encrypted on the wire.
Your Google connection is stored as an encrypted token (AES-256-GCM). Email bodies you send through Compose are never written to disk unencrypted: they're held briefly, encrypted, and deleted as soon as the send finishes. Individual copies are never written to disk at all. The encryption key lives only on our server, never in the database.
Delete the tracked emails in your dashboard, or your whole account, in one click. Deleting your account removes your data from our live database immediately and cancels any subscription still billing; backup copies are deleted after 30 days, except the three newest, which are kept until newer ones replace them. Pro accounts can export their tracking data as JSON from Settings, and anyone can ask us for a full copy. Tracking data expires on its own after 12 months; only the web addresses behind tracked links can outlive their email, for up to 12 months and unlinked from you, so links in emails you already sent keep working.
Least-privilege permissions, per-account isolation, rate limiting, hardened HTTP security headers, parameterized database queries, and no secrets in any code that ships to your browser.
What MailViewed can and can't see
- The subject line of emails you choose to track
- The recipients' names and addresses
- The links you choose to track
- When a tracked email is opened or a tracked link is clicked, and whether it was a person or an automated scanner
- Who replied to a tracked email, and when, never what they wrote
- The body or attachments of your emails. We never keep them; Compose and individual copies pass through our server only to be sent
- Anything in your inbox or other emails
- Your Google password or account credentials
- Emails you didn't choose to track. The one exception: if you open an email someone else tracked with MailViewed, the extension tells us it was displayed to you, and in which Gmail address, so that sender's read receipt is confirmed. We keep only the time
How the tracking pixel actually works
A tracking pixel is just a tiny (1×1) invisible image with a unique link. When your recipient's email opens and loads images, their device requests that image, and that request is the “opened” signal. It reports the time, plus the IP address and browser (user-agent) of whatever fetched it (Gmail fetches images through its own proxy, which hides the reader's own address). We don't turn IP addresses into locations.
The important part: a pixel cannot read, scan, or access the text of the email. It has no view into what was written: it's an image request, not a content reader. The uniqueness comes from the ID in the link, which is how we know which email was opened, not what it said.
We never collect the recipient's message content. All we learn about a reply is who sent it and when, spotted by the extension in a conversation you open in your own Gmail, never by reading anyone's mail.
Still not sure? Revoke us in two clicks.
You stay in control. Remove MailViewed from your Google account at myaccount.google.com/permissions anytime, or uninstall the extension to stop tracking new emails. Neither one erases what we already hold; to delete it, use Delete account in Settings. For the legal details, see our Privacy Policy.