What leaves your browser, and what does not

The short version: the email you paste is analyzed on your own device and is not uploaded anywhere. The longer version below is specific, because a privacy page that only says “we respect your privacy” is worth nothing.

The analysis itself

Parsing, scoring and every finding are computed by JavaScript running in your browser. The pasted text is held in a variable on the page and is discarded when you close the tab. No request carries it anywhere. You can confirm this yourself: open your browser’s network panel and run an analysis — you will see no upload.

What is kept in your browser

• Your theme choice (light or dark).
• Your language choice.
• Which sections you last ticked in the PDF export dialog.

That is the complete list. No header data, no addresses, no analysis results. These sit in your browser’s local storage and never leave it. There are no tracking cookies.

The one place data does leave: Network Checks

Blocklist and reverse-DNS lookups cannot be done inside a browser, so that tab is opt-in and only runs when you click it. When you do, the domain names found in the header and the sending server’s IP address are sent to Cloudflare’s DNS-over-HTTPS resolver and to ipapi.co for the IP’s country. The recipient address, the subject and the message body are never part of those requests.

The other thing that leaves: the Yes/No answer

After an analysis finishes the tool asks one question — whether it answered yours. If you click Yes or No, that single fact is recorded as a visit to a made-up address such as /app/feedback/yes, which is simply how the counting works; the address does not exist as a page and you are not taken anywhere. Answering No shows a short list of reasons, and picking one is recorded the same way. Nothing else is sent: not the header, not any address, not the score, not a session identifier. The page is not loaded with an analytics script, so no visit is counted and nothing leaves unless you actually click. Ignore the question and no request is made at all.

This is the one place where the “open your network panel and you will see no uploads” claim above needs a footnote, so it gets one here rather than being quietly dropped: click the answer and you will see exactly one request.

Exports and the share link

The PDF and the JSON are built in your browser and handed straight to your downloads. They are never uploaded. Note that the JSON contains what the header contained, including the recipient address — so if you forward that file, you forward those details with it.

The PDF ends with a QR code that reopens the summary. That link stores the summary in the URL fragment — the part after the # — which browsers never send to any server. It carries the score, the domains, the authentication results and up to three shortened critical findings, plus the sender address. It does not carry the recipient, the subject, the body or the raw headers.

What we do measure

The informational pages — the home page, this one, the about page and the headers guide — load Vercel Analytics, which counts page views and records referrer, country and device type. It does not identify you and does not read page content. The analyzer itself is plain static HTML with no analytics script on it at all, which you can verify by viewing its source.

The site is hosted on Vercel, which keeps standard web server request logs the way every host does.