Privacy & security center
Built to know less, not more
Read receipts only need a little data. We collect that, protect it carefully, and leave everything else alone — for you and for the people you email.
Security
How we protect your data
Encrypted in transit
Everything between your browser, the extension and openedyet.com travels over HTTPS.
Secrets encrypted at rest
Sensitive configuration, such as payment and email credentials, is encrypted with AES-256-GCM.
Hashed tokens and IPs
Extension tokens and sign-in codes are stored only as hashes. Recipients’ IP addresses are hashed with a secret salt before they touch the database.
Minimal permissions
OpenedYet for Chrome runs only on Gmail and openedyet.com. Google sign-in shares just your name, email address and picture — never your inbox.
Payments by Stripe
Card details go straight to Stripe, a certified payment provider. They never pass through or get stored on our servers.
Safe tracked links
Every tracked link is signed, so it can only lead to the page you linked to. Unsigned links show a warning instead of redirecting.
Data minimisation
What we store — and what we don’t
To show you a ✓✓, we need to know which email was opened and when. That’s close to all we keep.
- We store: your name and email address, the subject and recipients of your tracked emails, tracked link addresses, and the time, device type and email app of each open or click.
- We don’t store: the body of your emails, your attachments, your inbox, recipients’ raw IP addresses or precise locations.
You’re in control
Controls for senders and recipients
If you send tracked emails
- Turn tracking off for any email, or make it opt-in.
- Ask for a copy of your data at any time.
- Cancel your plan and delete your account whenever you like.
If you receive tracked emails
- Opt out of tracking from one sender, or from everyone.
- Ask us what we hold about you, and have it deleted.
- Block all read receipts by turning off images in your email app.
Deleting your data
To delete your account and all of its tracked emails and events, email support@openedyet.com from the address you signed up with. We confirm by email and erase everything within 30 days; backups roll over within a further 30 days. If you have a paid plan, cancel it first from your dashboard’s Billing page.
Reporting a security issue
Found a vulnerability? Please email support@openedyet.com with “Security report” in the subject and enough detail to reproduce it. We’ll acknowledge your report, keep you updated, and won’t take action against good-faith research that avoids harming users or their data.