Privacy

Inbox Unpack reads email files in your browser. No message, attachment, header, subject, address, search term or file name is sent anywhere. This page explains how that is enforced, so you can check it yourself.

There is nowhere to upload to

This site has no server code, database or file storage. It is just pages and scripts that run in your browser. There is nothing to upload a message to.

Your browser enforces it

Every page tells your browser to:

• Block any connection to another website, so nothing can send your mail elsewhere.
• Block every form from being submitted, including one hidden inside a message.
• Block every remote image in every message.
• Stop other websites from showing this site inside their own pages.

Our automated tests check that opening and converting a file never sends anything to another website, and never sends a file name, address or attachment name.

Why there is no “load remote images” button

Allowing remote images for one message would mean loosening the browser rule for the whole site, for every visitor and every message. That is a bad trade for a convenience.

Instead, we list every remote item a message refers to: the full address, the server it comes from, and whether it looks like a tracker that would tell the sender you opened the message. Nothing is fetched. If you need the images, download the original file (it is kept exactly as it was) and open it in a mail app, knowing what that will tell the sender.

Analytics

We use analytics that count page views only. Nothing about your files is ever sent to it: no sender, recipient, subject, message text, attachment name, file name, file size or any other file detail. Our tests check this against every request the page makes.

There are no cookies, no accounts, no saved message content and no fingerprinting. The only thing saved in your browser is your light or dark theme choice.

Fonts and libraries

Everything, including fonts, is served from this site. No outside service is contacted at any point.

What happens to a file you open

It is read into memory and discarded when you close the tab or press Start over. Nothing is saved to your device except the files you choose to download.

Suspicious messages

Opening a suspicious message here is what this site was built for. Message content is cleaned and then shown in a locked-down frame that cannot run scripts or reach the rest of the page, with several layers of protection on top. See How it works for the detail.

Changes

If any of this stops being true, we will update this page. It describes how the site works today.