Politique de confidentialité

This policy explains, in plain words, what MailAfter (“we”, “us”) collects when you use our website and Chrome extension, why, who can see it, how long we keep it, and what you can do. It describes how the service actually works. If something is unclear, write to support@mailafter.app. The rules for using the service are in our Terms of Use.

1. Who we are

MailAfter is operated by KLabs. Contact: support@mailafter.app.

For your account details, we decide how the data is used, so we are the data controller. For the people who receive your tracked emails, you decide to use tracking and we process that information to provide the service to you (see section 4).

2. What we collect

Your account

• Your email address and display name.
• Your password, stored only in hashed form (we cannot read it).
• Your time zone (taken from your browser at sign-up, used to show times correctly) and the date and version of the Terms you accepted.
• Only if you turn them on: two-step verification (its secret is stored encrypted; recovery codes are stored hashed) and a Telegram chat link for alerts.
• A connection key for each Chrome you connect, stored on our side only as a hash. You can disconnect a device at any time.
• Your alert choices: how often to be alerted (every open, first open only, or a daily summary) and whether to get a reminder when an email has not been opened after a number of hours.
• Only if you press “That was me” on an open: a one-way code of that device (made from its network address and app identifier, so neither can be read back). Up to 20 are kept, and later opens from that device are marked as yours. Pressing “Not me” on that open removes the code, and it is included in your data download and deleted with your account.

Emails you track

• The recipients (To and Cc), the subject and the send time of emails you send while MailAfter is switched on, plus a random tracker ID that identifies the tiny image in that email.

The extension reads these details from the Gmail compose window when you send. It does not read the message text, attachments or your contacts list, and it does not connect to your Google account or use your Google password. To show open counts in your Sent list, it matches the subject lines it sees in your Sent list with your tracked emails on your own device; what it sees in your Sent list is not sent to us.

Opens

When a recipient’s mail app loads the tiny image, we record:

• the time of the open;
• the app or device identifier that the opening app sends (the “user agent”, which usually names the app or browser and the operating system), and whether the request came through an image proxy such as Gmail’s or Apple’s;
• a short one-way code derived from the visitor’s network address, so that repeat visits can be recognised without keeping the address.

We use these details to label each open as a likely person or a likely automatic load (for example a scanner, a privacy feature, or a load within moments of sending). This is a best guess made from the same details, with nothing extra collected, and it can be wrong. Automatic loads are shown separately and are not counted as opens by default.

Like every web server, we receive the visitor’s network (IP) address with each request. We use it only for that one-way code and for abuse limits, and we do not store it in our database. We do not keep web server access logs, and we do not look up anyone’s location from their address.

Security and abuse prevention

• A per-account security log (for example sign-ins and password changes, with the time and a short browser or device name) so that you can review activity on your account. The newest entries are kept.
• Your active sign-in sessions (device name, time, and a one-way code of the network address) so that you can see and end them.
• Short-lived counters and one-time-code records used to limit abuse. Counters that relate to a network address are kept for about a day at most.

Emails we send you

If account emails (such as email confirmation) are switched on, we send them through an email delivery provider, only for messages about your account. We do not use your address for marketing.

3. Why we use it, and our legal basis

Purpose	Basis (GDPR)
Provide the open-tracking service you ask for	Contract (Art. 6(1)(b))
Keep the service secure and prevent abuse	Legitimate interests (Art. 6(1)(f))
Show the extension’s privacy notice and record that you accepted it	Consent (Art. 6(1)(a))
Comply with legal obligations	Legal obligation (Art. 6(1)(c))

We do not use your data for advertising, profiling or sale, and we make no decisions about you by automated means.

4. People who receive tracked emails

A tracked email contains a tiny image. When the recipient’s mail app loads it, we record the open details listed above. Recipients can avoid this by turning off automatic image loading in their mail app.

If you use MailAfter, you are responsible for having a lawful basis to track your recipients and for telling them where the law requires it (for example under the ePrivacy rules and GDPR in the EU and UK). Do not use MailAfter to send spam or unsolicited bulk email.

If you received an email that contained a MailAfter tracker and want the related data removed, write to support@mailafter.app with the web address of the tracking image (it starts with mailafter.app/p/), and we will remove it.

5. Who can see your data, and who we share it with

You can see your own trackers and opens when you are signed in. Our admin tools show account details (email address, name, sign-up date) and counts, not your trackers or opens. Beyond that, we access tracked-email data only where needed for security, for support you ask for, or to meet legal duties.

We do not sell your data and we do not share it for advertising. We use a small number of service providers only to run MailAfter:

• our hosting provider, with servers in the European Union;
• Telegram, only if you connect it. Alerts then contain the tracker label (recipients and subject), the open time and number, and the app type, and are handled under Telegram’s own privacy policy;
• an email delivery provider, only for account messages such as email confirmation.

We disclose data to authorities only when we receive valid legal process, and only what it requires. We may also share data with advisers or authorities where needed to establish or defend legal claims or to stop misuse of the service.

Limited use. We use the information the extension handles only to provide and improve the open-tracking features you asked for. We do not sell it, use it for advertising or credit decisions, or transfer it for any other purpose. The use of information received from the extension will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

6. Where data is stored

Your data is stored on servers in the European Union. We may access it from outside the EU only as needed to run and secure the service, and only with the safeguards the law requires. Telegram, if you use it, processes alerts under its own terms.

7. How long we keep data

Data	How long
Account, trackers and opens	Until you delete your account
Security log	Until you delete your account (only the newest entries are kept)
Sign-in sessions	End after 30 days without use (60 days at most), or when you sign out
Abuse-prevention counters	About an hour to a day; one-time-code records up to about a week
Encrypted backups	Up to 30 days

When you delete your account, your account, trackers, opens, sign-in sessions, security log and Telegram link are removed from our live systems. Deleted data disappears from the encrypted backups as they expire, within 30 days. Emails you already sent keep their tiny image, but once your account is gone nothing is recorded for them.

8. Your rights and choices

• Get a copy of your data: Settings → Your data → download. It is one JSON file with everything stored for your account (trackers and opens).
• Delete your account and data: Settings → Delete my account (it asks for your password). See the support page.
• Correct your details: you can change your display name and password in Settings. To change anything else, write to us.
• Turn tracking off: use the switch in the extension, or uninstall it. Also in Settings you can end sessions, disconnect devices and unlink Telegram.
• Other requests (access, objection, restriction): write to support@mailafter.app. We aim to answer within 30 days.

If you are in the EU or UK you also have the right to complain to your local data protection authority.

9. Security

We protect data in transit with HTTPS, store passwords only as hashes, keep two-step secrets encrypted, store backups encrypted, rate-limit sign-in attempts, and offer two-step verification. No online service can promise perfect security. If a breach affects your data, we will tell you and the authorities as the law requires.

10. Cookies and local storage

We use two cookies, both strictly functional:

Cookie	What it does	How long
Sign-in	Keeps you signed in (only after you sign in)	Up to 30 days of inactivity (60 days at most)
Language	Remembers the language you choose on this website. Set only when you pick a language; holds just the language code	1 year

Our website uses no analytics or advertising cookies. If you have not picked a language, we read your browser’s language setting to suggest one, and we do not store it. Your browser also keeps your light or dark theme choice for the dashboard, and the extension stores its settings, your connection, and your never-track list (recipients or domains you choose not to track) on your own device only. That list is never sent to us.

11. Children

MailAfter is not meant for people under 16, and we do not knowingly collect their data. If you think a child has given us data, write to us and we will delete it.

12. Changes

If we change this policy in a meaningful way, we will update the date above and, where appropriate, tell you in the product.

13. Quick answers

14. Contact

support@mailafter.app

This page is provided for transparency and is not legal advice.