Privacy Policy

What Google data we access, and why

Fast Mail Tracker connects to your Gmail with two scopes: the restricted https://mail.google.com/ scope, and the standard openid email profile scope for sign-in. We hold the full mail scope because two things the product does to guarantee accurate tracking - sending each copy as you over SMTP, and permanently removing a stray tracked copy from your own Sent folder - are authorized by no narrower scope. Everything we do inside your Gmail is listed below, in full.

Each operation is confined to a message you chose to involve: the copies we sent on your behalf (found by the exact Message-ID we generated for them), the specific draft you chose to send (by its own id), and, only when you send a reply, the Message-ID and References headers of the message you're replying to (headers only, so the reply threads correctly). We do not list, browse, or search your mailbox, and we never read the body of any message we did not send for you.

How the access works, end to end

Two views of the same flow. The first traces the product's promise down to the only scope that satisfies it: every narrower route dead-ends before it reaches accurate tracking. The second shows the exact Gmail calls, in order, each tagged with the narrowest scope that grants it.

Why not a narrower scope? Two of the operations above can be performed with the full https://mail.google.com/ scope and no other: submitting mail over SMTP as you - the narrower gmail.send uses the Gmail API, which derives recipients from the message headers and cannot split the SMTP envelope from the visible To/Cc line, the exact mechanism per-recipient tracking depends on - and permanently deleting a stray tracked copy, which the narrower modify scope cannot do (it can only move the copy to Trash, where its tracking pixel survives). Because the full scope is already required for those two, it also covers the read, insert, and label operations. So mail.google.com is the minimum single scope that supports the product - not a convenience.

How we protect this data

• Encrypted in transit. All traffic - between your browser, our servers, Google, and your recipients' opens - travels over TLS.
• Encrypted at rest. Your Google OAuth refresh token is sealed with AES-256-GCM and cryptographically bound to your account (the key is derived over your user, organization, and email), so a copied token blob is useless anywhere else. All other data, including your tracking metadata, is encrypted at rest by our managed cloud database.
• Least access. The sealed token can be opened only by the sending service that needs it to deliver your mail; each organization's data is isolated from every other tenant's.
• Minimal retention. We do not store your mailbox contents. For a message you choose to track, we keep the message you send through us (its subject and body) and the tracking metadata your dashboard shows (recipients, opens, clicks, timestamps), plus an encrypted refresh token so we can keep sending for you without repeated reconnects - nothing more.
• Deletion on your command. Disconnecting Gmail revokes our access at Google and deletes the stored token immediately. Deleting your account (Settings → Delete account) revokes that Google access too and permanently removes your account, organization, and tracking data (see "Revoking access" below).

Sharing & disclosure

Google user data obtained through the Gmail send-as scope is used solely to deliver the email you compose and to insert the delivery notification into your own inbox. It is not shared with, sold to, or used by any advertiser, data broker, or third party, outside the subprocessors below required to run the service. The same list is published and kept current on our subprocessor registry.

Limited Use

AI & your data

Fast Mail Tracker does not use Gmail data, or any other data obtained through Google APIs, to train artificial intelligence or machine learning models - generalized or otherwise. No part of the product runs your messages through an AI model today.

What we don't do

We don't sell your data, and we don't build advertising profiles from it. Tracking data is engagement information tied to your account, for your follow-up, not a product we resell.

Your recipients

Tracking records that an email was opened or a link was clicked. It's designed as a signal for your own follow-up, not surveillance. You can turn tracking off for any individual message.

Revoking access

You can disconnect Fast Mail Tracker's access to your Gmail account two ways:

• In your Fast Mail Tracker account: open Settings → Gmail connection → Disconnect. This revokes the grant at Google and deletes the stored refresh token right away.
• In your Google Account: visit myaccount.google.com/permissions and remove Fast Mail Tracker's access directly from Google.

You can delete your account and all its data at any time from Settings → Delete account. Deletion cancels any active subscription, revokes our access at Google, and permanently removes your account, organization, and tracking data. You can also write to privacy@fastmailtracker.com and we'll do it for you.

Your rights

You can access, export, or delete your data from your account, or by contacting us. Where the GDPR applies, you have additional rights described in our GDPR compliance guide.

Questions about this page? Write to privacy@fastmailtracker.com or contact us.