PRIVACY & SIGNAL ACCURACY · SEPTEMBER 2026

Useful insights. Respectful boundaries.

Openline is a personal Gmail tracking tool. It records requests for an image in an email you explicitly choose to track. It does not provide certified read receipts.

What an open signal means

A signal means the tracking image was requested. Gmail proxies and caches images; Apple Mail and security tools may load images before a person reads a message. Repeated reads may produce no new request. The sender’s own views, forwarded messages, scanners, and preloads can also produce signals. This server does not collect country-level geolocation. No signal does not mean the email was unread.

Google image proxy and recognized automation are labeled using request headers. Everything else is “Unverified request”, including undetected proxies. These labels are heuristics, not identity checks. Network and country describe the requesting connection and must not be interpreted as the recipient’s location.

What is collected

When you enable tracking in a Gmail compose window, the extension uploads its subject and one recipient address. It never uploads your message body, attachments, inbox, contacts, Gmail password, or Gmail session cookies. Chrome requires Gmail page access to insert the image and privacy link; the extension processes only supported compose windows for tracking.

For each signal, the application stores a timestamp, source category, and, for unverified requests, a coarse network prefix (IPv4 /24 or IPv6 /48). Known proxy and automation requests have no network or country recorded. Raw IP addresses and full user-agent strings are processed transiently for classification and retry deduplication, and are not saved to the application database. Caddy access logging is disabled for this service; application error logs omit addresses, subjects, tokens, and raw network addresses. The server provider may process operational metadata under its own policies.

Your choices

Tracking is off by default for every email. A visible recipient privacy link accompanies the pixel. Its recipient can stop tracking that link and erase its existing activity, without signing in. Global Privacy Control and Do Not Track request headers suppress collection when the requesting client forwards them. Image blocking is always respected.

Senders can stop a tracker, delete an email’s record, export their data, revoke extension connections, or delete all workspace data in Privacy & data. Message records expire after 30 days: expired links immediately stop recording and expired data is removed on the next dashboard or new-message request, and by a daily maintenance job. Extension credentials expire after 90 days. Pairing codes expire after 10 minutes and work once. Local backups are retained for up to seven days. Dashboard session cookies expire after seven days and are invalidated on logout or password change.

Use and service providers

Data is used only to provide the disclosed email-tracking feature and secure its operation. It is not sold, used for advertising, or shared for unrelated purposes. The operator’s server hosts the application and its SQLite database. Caddy terminates HTTPS. Authentication uses a password hash and a secure, HTTP-only session cookie. The Chrome extension does not use Gmail APIs. The use of information received from Google APIs, if introduced, must adhere to the Chrome Web Store User Data Policy, including Limited Use requirements. Human access to user data is restricted to the owner and to consented support, security, or legal needs.

Responsible use

Use tracking only where permitted, provide required notices, and obtain recipient consent where required. A privacy link is a notice and opt-out; it is not a substitute for legally required consent. Do not use Openline for covert surveillance or to bypass mail-client privacy protections. Chrome Web Store approval has not been obtained; this build is distributed as an unpacked extension for evaluation.