mail-tools/docs/PRIVACY-SECURITY.md

Privacy and security

Messages are read through browser file APIs or pasted text and kept only in memory. There is no storage, telemetry, analytics, remote-resource request or server integration. Closing/reloading the page clears the workbench.

Limits reduce accidental resource exhaustion but do not make Mail Tools a forensic parser. HTML loses links, styling and embedded resources by design. Downloaded attachments remain untrusted. Authentication results and Received headers are self-asserted text; no DNS or cryptographic verification occurs.

Focused redaction removes a fixed set of top-level transport/authentication headers. It does not rewrite nested message/rfc822 content and can leave names, addresses, message IDs, MIME metadata, tracking tokens, body content, document metadata and attachments. Review outputs independently.