# Privacy and security

Messages are read through browser file APIs or pasted text and kept only in
memory. There is no storage, telemetry, analytics, remote-resource request or
server integration. Closing/reloading the page clears the workbench.

Limits reduce accidental resource exhaustion but do not make Mail Tools a
forensic parser. HTML loses links, styling and embedded resources by design.
Downloaded attachments remain untrusted. Authentication results and Received
headers are self-asserted text; no DNS or cryptographic verification occurs.

Focused redaction removes a fixed set of top-level transport/authentication
headers. It does not rewrite nested `message/rfc822` content and can leave names,
addresses, message IDs, MIME metadata, tracking tokens, body content, document
metadata and attachments. Review outputs independently.