Privacy policy

The short version

We collect the minimum needed to show you when your emails are opened.
We never get access to your inbox and never store the body of your emails.
We never store recipients’ IP addresses — only a one-way hash.
Every recipient can opt out of tracking at any time.
We don’t sell data, show ads or use tracking cookies.

1. Who we are

OpenedYet (“OpenedYet”, “we”, “us”) is a read-receipt service for Gmail, operated by OpenedYet. For the data described in this policy about our users, we are the data controller. You can reach us at any time at support@openedyet.com.

2. What this policy covers

This policy applies to the openedyet.com website, the OpenedYet dashboard, our emails and the OpenedYet for Chrome browser extension (together, the “Service”). It covers two groups of people:

Users — people who install OpenedYet and send tracked emails.
Recipients — people who receive an email tracked with OpenedYet.

3. Data about our users

What we collect	Why	Legal basis (GDPR)
Name, email address, profile picture and Google account ID (from Google sign-in), or your email address (sign-in link)	To create your account and sign you in	Contract
For each tracked email: subject line, recipients’ names and addresses, send time, Gmail’s conversation and message IDs, whether the footer was included	To show you the status of your emails in Gmail and your dashboard	Contract
Web addresses of tracked links	To redirect clicks to the right page and show you click counts	Contract
Opens, clicks and notifications related to your tracked emails	To provide read receipts, alerts, reports and reminders	Contract
Settings, time zone and plan	To run the Service the way you’ve chosen	Contract
Billing details: Stripe customer and subscription IDs, plan, billing period and status (card details are handled by Stripe only)	To take payments and keep accounting records	Contract; legal obligation
Technical data: hashed extension tokens, a session cookie, error and security logs, rate-limit counters	To keep the Service secure and working	Legitimate interests
Messages you send to support or through our contact form	To answer you	Legitimate interests

4. Data about recipients of tracked emails

When a user sends a tracked email, we receive the recipients’ names and email addresses from that user. When a recipient opens the email or clicks a tracked link, we record:

the date and time of the open or click;
the technical identifier sent by the recipient’s email app or browser (the “user agent”), from which we work out the general device type and email app;
optionally, the country the request came from;
a salted, one-way hash of the IP address, used only to recognise repeated or automatic opens. We never store the IP address itself.

The sender sees when and how often their email was opened, the general device type and email app, and which tracked links were clicked. We don’t record precise location, and we don’t build profiles of recipients across senders.

Legal basis. We process this data based on legitimate interests — the sender’s interest in knowing whether their message was received, and ours in providing the Service — balanced by keeping data to a minimum, disclosure in the free-plan footer, and an opt-out that works for everyone. Depending on the law that applies, the sender may be considered the controller of this data and OpenedYet its processor. Either way, recipients can contact us directly and we will help.

Opting out. Any recipient can stop OpenedYet from tracking their emails at openedyet.com/opt-out or via the “Opt out” link in the footer of a tracked email. To make an opt-out work, we keep a one-way hash of the recipient’s email address and the scope chosen (one sender, or everyone). More information for recipients.

5. What we never do

Access your Gmail inbox, contacts or other Google data beyond your basic profile.
Store the body or attachments of your emails.
Store raw IP addresses of recipients.
Sell or rent personal data, or use it for advertising.
Use analytics, advertising or tracking cookies on our website.

6. Google data and the Chrome Web Store

Google sign-in requests only the basic scopes openid, email and profile. We use them only to identify you and sign you in. OpenedYet does not request access to Gmail through Google’s APIs.

OpenedYet for Chrome runs on mail.google.com and openedyet.com only. In Gmail it adds the tracking image and tracked links to emails you send with tracking on, shows ✓ and ✓✓ next to tracked emails, and tells our server when you view your own tracked emails so those views aren’t counted. To do this it reads the subject, recipients and links of emails you send with tracking on and sends them to our servers. It doesn’t send us the body of your emails, and it doesn’t read your other emails’ contents.

Limited Use disclosure. OpenedYet’s use of information received from Google APIs and through OpenedYet for Chrome adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements, and to the Google API Services User Data Policy. In particular, we use this data only to provide and improve the Service’s single purpose — read receipts and email tracking; we don’t transfer it to others except as needed to provide the Service, to comply with the law, or as part of a merger or acquisition with notice to you; we don’t use or transfer it for advertising or to determine creditworthiness; we don’t sell it; and our staff don’t read it unless you ask us to (for example in a support request), it’s needed for security or to comply with the law, or it has been aggregated and anonymised.

We share data only with providers who help us run the Service, under agreements that require them to protect it:

Our hosting provider — stores our servers, databases and backups.
Stripe — processes payments and stores card details. Stripe’s privacy policy.
Google — provides Google sign-in, if you choose it. Google’s privacy policy.
Email delivery — our mail server, or an email delivery provider, sends sign-in links, alerts and reports.

We may also disclose data if the law requires it, or to protect the rights and safety of our users, recipients or OpenedYet.

8. International transfers

Some providers, such as Stripe and Google, may process data outside the European Economic Area. Where that happens, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

9. How long we keep data

Account data and tracked emails: for as long as your account is open. When you ask us to delete your account, we erase it within 30 days; backups roll over within a further 30 days.
Open and click events: for as long as the tracked email is in your account. Your plan controls how much history you can see, not how much we keep, so that upgrading can show it again.
Opt-out records: kept for as long as needed for the opt-out to keep working (only a hash of the email address).
Billing records: for as long as tax and accounting law requires.
Security logs and rate-limit data: up to 90 days.

10. How we protect data

All traffic to openedyet.com is encrypted with HTTPS. Sensitive settings are encrypted at rest with AES-256-GCM, extension tokens and sign-in codes are stored only as hashes, and recipients’ IP addresses are hashed before storage. Access to production systems is limited to the people who need it. Read more in our privacy & security center.

11. Your rights

Depending on where you live, you have the right to:

access the personal data we hold about you and get a copy of it;
correct inaccurate data;
have your data erased;
restrict or object to processing, including processing based on legitimate interests;
receive your data in a portable format;
withdraw consent where we rely on it;
complain to your local data protection authority.

To exercise any of these rights, email support@openedyet.com from the address concerned. We reply within one month. Recipients can also opt out instantly at openedyet.com/opt-out.

12. Children

OpenedYet isn’t intended for children under 16, and we don’t knowingly collect their data as users. If you believe a child has created an account, contact us and we’ll delete it.

13. Changes to this policy

We’ll update this page when our practices change and change the date at the top. If a change is significant, we’ll tell users by email or in the dashboard before it takes effect.

14. Contact us

OpenedYet
Email: support@openedyet.com