Privacy Policy

Last updated: 2026-08-27

Mailshade is a browser extension whose single purpose is privacy protection in supported webmail. It blocks requests to reviewed email-tracker endpoints, warns before recognized tracking redirects, and keeps a local report for the user. It also offers two separate choices: optional known ad-server request blocking on enabled clients, which is off by default, and opt-in DOM neutralization of high-confidence, directly delivered unknown pixels. Supported webmail clients are Gmail, Outlook, Office 365, Superhuman, Yahoo Mail, and Proton Mail.

Scope and user choice

Mailshade does not request access to every website. Each supported webmail client is disabled until the user enables it and grants that client's specific Chrome host permission. Mailshade's inbox content scripts then run only on the enabled webmail origins. Until that grant exists, Mailshade installs no network-block rules for the client origin and performs no DOM inspection, attribution, or reporting there. Chrome manages those permission grants.

The two optional protection settings are stored as adBlockingMode and unknownPixelAction, but a synced setting does not grant access. Ad-server rules and the unknown-pixel action run for a client only while its enabled intent and live host grant are both present in that browser profile. Shield adds no new permission and does not request <all_urls> access.

For Outlook and Office 365, matching and related opaque message frames use the same host-scoped persistent allFrames and matchOriginAsFallback registration. Mailshade does not request an auxiliary navigation-history permission for frame recovery.

Mailshade has no product-analytics service or inbox-data backend. It does not intentionally transmit core tracker-event history or inbox metadata. External transmissions described below are limited to paid-account operations, filtered crash reporting, and the separate public-website newsletter.

Safari edition

The Safari edition of Mailshade runs locally and does not offer or use paid services or external billing, does not initialize Hawk or any other crash-reporting service, and does not sync tracker history or preferences between devices. Safari may separately sync the extension's installation and enabled state when the user enables Safari extension sync; that system behavior does not transfer Mailshade's stored history or preferences. The Safari edition does not transmit extension data to Mailshade or its developer. Tracker detection, protection, and report storage are performed locally on the device. Access to each supported webmail site remains optional and occurs only after the user grants that site's Safari web-extension permission. Accordingly, the paid-features, Chrome Sync, and optional Hawk crash-reporting descriptions below apply to the Chrome edition and not to the Safari edition.

Data handled on enabled webmail pages

To detect a tracker and attach an indicator to the correct message, the extension handles locally:

• sender name, email address, and email domain when the webmail UI exposes them;
• opaque message and thread identifiers exposed by the webmail provider;
• image and link resource URLs in the rendered message;
• an image's rendered size and visibility for local high-confidence pixel assessment;
• requested ad-server domains that Chrome locally compares with the packaged rules when optional webmail ad blocking is on; and
• the current supported-webmail location and a numeric Chrome tab id for local execution context.

Subject and body text are not extracted for attribution, stored, or transmitted. On Outlook, Superhuman, and Yahoo, Mailshade may locally parse a sender-bearing row accessibility label that can also contain a subject. Attachments and recipient lists are not read or stored. Full page, image, tracking-link, and decoded destination URLs are used in memory for detection and link handling; they are not stored as readable event fields. They may contribute to derived local event or occurrence identifiers.

Data stored by the extension

Tracker events and sender statistics are stored in Mailshade's local IndexedDB. An event can contain:

• timestamp and event type (pixel or link);
• supported mail client and numeric tab id;
• tracker origin, domain, and identified vendor (not the URL path, query, or fragment);
• actual outcome (detected or dom-neutralized) and, for image events when available, delivery classification (direct, gmail-proxy, or provider-proxy);
• sender name, email address, and email domain, when available;
• opaque provider message/thread identifiers; and
• a local occurrence identifier used to avoid duplicate records for the same rendered message view.

Free retains a rolling seven days of event history. An active trial or Pro license retains the available history until the user clears it, the extension is uninstalled, or browser storage is otherwise removed.

Preferences, client-enable intent, adBlockingMode, unknownPixelAction, appearance, crash-report choice, and user-created muted-sender, strict-scan-sender, and tracker-domain allow lists are stored in chrome.storage.sync. Chrome may sync that data across browser instances when the user has Chrome Sync enabled. Synced client values and protection modes are intent only: Chrome host-permission grants stay local to each browser profile and are never copied through Mailshade sync. Runtime content-script, unknown-pixel, and DNR decisions require both enabled intent and a live host-grant check for that client in that profile. Trial, onboarding, license, and pending checkout state are stored in chrome.storage.local. Paid state can include the selected plan, one-time token, checkout id, license key, Polar product/customer identifiers, activation/validation times, expiry, and entitlement flags.

Rendered size/visibility observations and readable ad-request URLs are not stored. Ad blocking does not create an ad-request log.

Optional Shield modes

Known ad-server request blocking is off by default and operates only within enabled, host-granted webmail clients. Its packaged rules are generated from a pinned, tracker-excluded ads-only snapshot of Peter Lowe's ad server list. Chrome evaluates the bundled rules locally. Mailshade does not download a remote filter at runtime or transmit requested domains for filter matching. This mode is separate from the reviewed email-tracker endpoint protection.

Unknown-pixel DOM neutralization is a separate opt-in action. It uses local URL signals plus rendered image size/visibility and is eligible only for high-confidence direct delivery. Gmail and other provider-proxied images remain detect-only. The action replaces the rendered image source in the DOM, but DOM timing cannot prove that a network request which had already started was prevented. Mailshade therefore records the outcome as dom-neutralized, not as a network block.

Paid features

Paid features are optional. Chrome requests only the host access needed for the user-initiated paid action. Direct license activation requests Polar; customer-portal access requests Mailshade auth; starting checkout requests Polar, Mailshade auth, and an optional https://mailshade.org/* host grant for the first-party success bridge. Declining leaves Free features available. Paid actions do not transmit inbox content, sender lists, or tracker-event history.

• For direct license validation, the extension sends the license key and the Mailshade Polar organization id to Polar.
• To start checkout, the extension sends the selected plan and a locally generated one-time activation token to auth.mailshade.org. After payment, it sends the Polar checkout id and that token to exchange the matching checkout for its issued license key.
• To open the customer portal, the extension sends the locally stored license key to auth.mailshade.org so the service can create a Polar portal session.

After the user explicitly starts checkout and grants the optional https://mailshade.org/* host access, background dynamically registers a small first-party content script with the Chrome match pattern https://mailshade.org/upgrade-success*. The trailing wildcard is used only so the checkout query string matches. The content bundle immediately does nothing unless the origin/path are exactly https://mailshade.org plus /upgrade-success or /upgrade-success/; background independently repeats the sender-origin/path validation before activation. The registration is removed if the Chrome host grant is revoked, and other Mailshade paths are not processed.

auth.mailshade.org uses the request IP address for abuse-rate limiting on paid operations and passes the buyer IP to Polar when creating a checkout.

Polar sends signed webhook events to auth.mailshade.org for Founder-plan purchases, refunds, and cancellations. Mailshade processes each webhook payload in memory and retains only an append-only quota/idempotency ledger containing the Polar order id, product id, event type, event timestamp, and whether the event added or removed a Founder seat. The ledger is retained for the lifetime of the Founder quota service so duplicate, delayed, and out-of-order events cannot allocate the same limited seat twice. It does not contain inbox content or payment-card details.

The Mailshade web server keeps standard access and error logs for operational security, abuse diagnosis, and service reliability. Those logs may contain the source IP address, timestamp, request method and URL path/query, response status, referrer, and browser user agent. They are rotated daily and retained for approximately 14 days. Request bodies, inbox content, sender lists, and tracker event history are not written to those web-server access logs.

Polar is the Merchant of Record and processes payment and customer data under its own privacy policy. Mailshade does not receive or store card numbers or other payment-card details.

Optional crash reports

Crash reporting is off by default and is sent to Hawk only after explicit opt-in. A report may contain the error message and stack, Mailshade version, extension scope, browser user agent, window dimensions, and ordinary network metadata such as the source IP seen by Hawk.

Before sending, Mailshade filters URL-, email-, Polar-token-, and license-shaped strings. Console capture and automatic click, navigation, fetch, and other breadcrumbs are disabled. Filtering reduces accidental exposure but is not presented as a guarantee of anonymity. Mailshade does not intentionally attach inbox metadata or tracker-event history to crash reports. The SDK uses the same product-level identifier for all reports instead of a generated persistent per-install identifier.

Public website and newsletter

Using the extension does not require the newsletter. If a visitor subscribes to release notes on mailshade.org, the site sends the submitted email address and signup metadata to EmailOctopus for subscription and campaign delivery. The embedded form uses Google reCAPTCHA for spam protection. Subscribers can unsubscribe using the link in each email.

Mailshade release-note campaigns must be sent without open or click tracking where EmailOctopus provides those controls.

Service providers

Depending on the optional feature used, data may be processed by:

• Google Chrome Sync — syncing extension settings according to the user's browser account and sync choices;
• Polar — checkout, payment, customer portal, and license validation;
• Hawk — crash reporting after explicit opt-in;
• EmailOctopus — optional newsletter subscription and delivery; and
• Google reCAPTCHA — spam protection for the public newsletter form.

Access, export, and deletion

• Export all data: Settings → Privacy → Export all data downloads JSON with the current IndexedDB data plus Mailshade-owned sync/local storage. Because this is a complete portability export, it may contain the local license key and pending checkout state and should be handled accordingly.
• Clear history: deletes tracker events and sender statistics but keeps settings, onboarding, and paid state.
• Clear all data: deletes Mailshade's IndexedDB and sync/local storage. Chrome-managed host-permission grants remain under Chrome's permission controls.

Chrome Web Store Limited Use

Mailshade's use and transfer of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Mailshade does not sell user data, use it for advertising, creditworthiness, or purposes unrelated to its tracker-protection function.

Corresponding release source and checksums are published at https://mailshade.org/source/.

Contact

• privacy@mailshade.org for privacy questions and data-rights requests
• security@mailshade.org for security disclosures

Changes

The current policy and its last-updated date are published at https://mailshade.org/privacy/. Material product changes are also recorded in the Mailshade changelog.

← Back to home