Zero-read design
We never store or read your message body or attachments. We keep only what tracking needs: recipients, subject, send time and a random token.
Security
We track the open. Never the email.
Track My Mails is built so we can tell you when an email is read — without ever reading it ourselves.
Hashed browser tokens
Each connected browser gets its own token, stored only as a one-way hash. Revoke any browser in one click; idle tokens expire after 90 days.
Dedicated tracking domain
Pixels and links are served from t.staff-clock.com over HTTPS. It only returns a 1×1 image or redirects — it never hosts or downloads files.
Encrypted push alerts
Desktop and phone alerts use standard Web Push with end-to-end encryption (aes128gcm). No third-party push service sees your data.
Google sign-in only
We never ask for or see your Google password. Sign-in uses Google's own secure login, and the extension needs no Gmail API access.
Protected database
Every row is locked to its owner by row-level security. Admin actions are role-checked on the server and written to an audit log.
Anti-abuse built in
Sending-speed checks and rate limits stop spammers early, protecting our tracking domain's reputation — and your deliverability.
You control deletion
Free history is kept 7 days, paid history 365 days. Request full data or account deletion anytime; subscriptions are cancelled first.
Found a security issue?
Email hello@trackmymails.com with details. We reply within 2 business days and fix confirmed issues fast.