Back to the workbench
Privacy architecture

Your email never leaves your computer.

Local processing is an architectural boundary—not a promise that depends on deleting a server copy later.

The local path

What happens after you choose a file

Browser memory only

  1. The app loads

    Your browser downloads the interface and the email parsers.

  2. You choose a file

    The browser grants this tab access only to the file you selected.

  3. Parsing stays local

    JavaScript reads the file in browser memory. The subject, body, recipients, and attachments are not sent to our servers.

  4. The Smart Brief stays local

    Supported desktop Chrome can use its built-in Prompt API with Gemini Nano. Every other browser receives the grounded deterministic brief. Neither path sends email content to OpenThatEmail.

  5. Hostile content is contained

    Email HTML is sanitized and rendered in a restricted frame. Remote images are blocked by default, and email text cannot grant tools or permission to the AI.

  6. Closing the tab ends the session

    Opening, processing, and analyzing an email creates no cloud copy. A private share is a separate action: the browser encrypts selected content before temporary ciphertext is stored.

Verify it yourself

Watch the network while opening a file.

  1. Open your browser's Developer Tools.
  2. Select the Network panel.
  3. Drop an MSG or EML file into OpenThatEmail.
  4. Confirm that no request contains the file or its email content.

Normal requests may include the application code, public-page analytics, and coarse product metrics. A live DKIM lookup, remote image load, cloud AI provider, or encrypted share happens only after the related control explains the network boundary.

Never transmitted by local tools

The private parts stay private.

Email body
Subject
Sender or recipients
Attachments
Filenames
Raw headers
Message IDs
Exact file size
Coarse product metrics

We measure whether a tool worked—not what you opened.

Cookie-free Vercel Web Analytics records aggregated page views on public pages. OpenThatEmail removes query strings and URL fragments and excludes every private share route. Separate same-origin metrics can record broad format, result, timing, item-count, and browser-family buckets. They do not include filenames, subjects, addresses, message IDs, headers, bodies, attachments, generated briefs, reply drafts, or search terms.

Return to the local workbench