VSH Media · Your data, explained

Privacy policy

Effective: November 6, 2026 (material compliance update November 6, 2026) Product: OpenEmail Chrome extension and hosted OpenEmail service Operator: VSH Media Owner: Marcos Avila Privacy contact: hello@vshmedia.com

This policy describes OpenEmail v0.1.30 and its hosted Cloudflare Worker/D1 service. OpenEmail adds open and click engagement signals to messages a sender deliberately sends with tracking enabled in Gmail or Outlook on the web. An “open” is a tracking-image load, not proof that a person read a message; mail proxies, previews, caches, and scanners can affect the signal.

Information OpenEmail handles

When you send a tracked email

For a message you choose to track, the extension sends the following to your configured OpenEmail Worker:

• The subject (up to 300 characters).
• Recipient email addresses and available display names in To, Cc, and Bcc (up to 50 recipients).
• Up to 100 HTTP/HTTPS destination URLs from the message and their visible link text (link text up to 120 characters; destination URLs up to 2,048 characters).
• A tracking identifier created by the Worker, plus registration and event-status requests.

The extension does not send the email body to OpenEmail. Local compose suggestions read the body in the browser to provide writing tips. If you request model-assisted subject suggestions, the subject alone can be sent to the Worker; the current production service has no AI provider configured.

When somebody opens a tracked email or clicks a tracked link

OpenEmail can process and store:

• The event type (open or click), timestamp, tracked-message and link identifiers.
• A coarse device hint—desktop, mobile, tablet, or Mac in the current interface—and a likely/proxy/automated classification derived from request headers.
• The destination URL and link label associated with the tracked message.

The Worker processes the incoming User-Agent to produce those hints and classifications; it does not store the raw User-Agent string in the application database.

IP addresses and location storage are off by default. The sender can separately enable storage for new events:

• IP setting: stores the connecting IP address for new opens/clicks and lets the sender reveal it.
• Location setting: stores the Cloudflare-derived coarse city and country for new opens/clicks.

These switches do not add that information retroactively. Gmail and other image proxies can make either value describe the proxy rather than the reader. Cloudflare necessarily processes connection metadata to deliver requests; its operational records are governed by Cloudflare’s own arrangements with its customer.

Account and sign-in information

The hosted flow requests Google’s openid email profile scopes. The intended account record is your verified Google sign-in email, display name, and Google subject identifier. The extension stores its session token and Worker URL in chrome.storage.local; the Worker stores a SHA-256 hash of the token. Hosted sessions are created for 30 days. Until the hosted sign-in service is configured, a custom debugging connection instead requires a Worker URL and API token supplied by the user.

In Gmail or Outlook, and on your device

• Compose integration reads the subject, recipients, message body, and links needed to add tracking. Body-derived local advice stays in the page.
• Gmail’s inbound-tracker feature inspects message-image URLs and sender addresses locally so it can block likely trackers. Restoring a blocked image causes the mail client to request that image URL. An allowed-sender address can be saved locally.
• The extension caches retrieved message subjects, recipient details, and engagement events locally so the popup and dashboard can display them.
• Preferences, pinned message IDs, dismissed event IDs, quiet hours, notification choices, and connection state are stored in Chrome local storage.

OpenEmail does not collect passwords, payment-card details, or general browsing history. It does not collect email bodies for storage on its Worker.

Why information is used

Information is used only to provide and improve OpenEmail’s single, disclosed purpose and its user-facing features:

• Add a tracking pixel and tracked links to messages you choose to track.
• Associate engagement events with your messages and show open/click counts, times, device hints, lead scores, and link activity.
• Authenticate your account, preserve settings, synchronize your popup/dashboard, and provide alerts.
• Operate rate limits, prevent abuse, troubleshoot reliability, and honor never-track requests.
• Block likely inbound trackers when you enable that feature.

We do not sell user data, use it for personalized advertising, share it with data brokers, or use it to determine creditworthiness. The store screenshots use fictitious sample records rather than user mailing data.

Sharing, processors, and third-party services

OpenEmail does not disclose user data except:

• Cloudflare provides the Worker runtime, D1 storage, request routing, and related infrastructure and processes data as needed to provide those services.
• Google handles Google sign-in when hosted authentication is enabled, and Gmail may proxy tracked images according to Google’s own policies.
• Mail providers and destination websites necessarily receive requests associated with sending email, loading a pixel, or following a tracked link. After a click, the destination site operates under its own policy; OpenEmail’s redirect uses a no-referrer response.
• AI processing, only if explicitly configured later: the supported optional subject-suggestion flow can send the subject—not the body—to the configured model provider. No AI provider is enabled on the current production service. Any material change will be disclosed before that processing is enabled.
• Access you specifically request; necessary security, malware/spam/phishing/fraud/abuse prevention, or legal compliance; or a business transfer after explicit prior consent, alongside any required applicable-law notice. Aggregate/anonymized derived data is subject to the same purpose/transfer limits.

Humans may not read user data except with the user’s explicit consent to read specific data for a requested support issue, when aggregated and anonymized and used only for internal operations, when necessary for security or abuse prevention, or when lawfully required. Support access must be limited and auditable; there is no routine human reading of user mail metadata.

Retention and deletion

• The hosted Worker’s default tracked-email retention period is 180 days from the recorded sent time. A daily cleanup removes expired tracked-email records and their linked recipients, links, and events. Backend configuration can change this period.
• Dismissing an event hides it from counts; it is not the same as deleting it. Signing out revokes the session but does not erase tracked-message records.
• Local caches and settings can be cleared through the extension/Chrome storage controls; removing the extension removes its local extension storage. This does not delete data already stored on the Worker.
• Never-track addresses can be retained on a suppression list so the preference continues to work.
• To request access, correction, deletion of tracked data, or account deletion, email hello@vshmedia.com from the associated address. Verification may be needed before acting on a request. No validated one-click hosted account-deletion interface is implemented in v0.1.30; production deletion and response times need approval and verification. Revoked/expired credentials may remain only where necessary in auditable account records; provider backups or mandatory operational records may take longer to expire.
• A requested recipient can ask the sender or VSH Media to stop future tracking of their address. Contact hello@vshmedia.com with the sender and recipient addresses concerned.

Your controls

• Turn tracking off globally before composing or turn it off for an individual message.
• Keep IP and coarse-location storage off, or turn either on independently for future events.
• Turn inbound-tracker blocking, engagement alerts, and lead heat tags on or off.
• Review privacy choices before connecting an account. The v0.1.30 build is not yet compliant: it lacks a prominent in-product disclosure and separate affirmative-consent step before data handling. Do not publish until the final build includes those controls and records consent before tracked sending, authentication, or optional IP/location handling.
• Contact OpenEmail to access, correct, delete, or suppress data as described above.

Sender responsibility: recipients’ information can be personal data. Senders are responsible for giving any legally required notice, obtaining consent where required, honoring opt-outs, and using tracking only for lawful purposes.

Security

API traffic uses HTTPS. Session/API tokens are retained in Chrome local storage on the user’s device and stored as SHA-256 hashes by the Worker; content scripts do not receive the token. The Worker limits request sizes and rate-limits API/authentication operations. These measures are designed to protect the service, but no Internet service can guarantee absolute security. OpenEmail does not claim an independent security certification.

Children

OpenEmail is a productivity tool and is not directed to children under 13. Do not use it to knowingly collect such children’s data.

Changes

We may update this policy to reflect product, legal, or operational changes. We will post the revised effective date here and prominently disclose any material change to data practices before enabling it.

Contact

Questions, privacy requests, or concerns:

VSH Media — OpenEmail privacy Owner: Marcos Avila Email: hello@vshmedia.com

Chrome Web Store Limited Use

Required affirmation: The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Accessed data and any derived or aggregated data are used only for the disclosed email-engagement purpose and related user-facing features. Transfers are limited to those necessary for that purpose, to comply with law, to protect against malware/spam/phishing/fraud/abuse, or a business transfer after any required explicit prior consent. Data is not sold, used for personalized advertising, provided to advertising platforms or data brokers, or used for creditworthiness or lending decisions. Humans may not read user data except with explicit consent to read specific data for user-requested support, for internal operations using aggregated and anonymized data, when necessary for security, or to comply with law.