Extension privacy policy

The short version: Email Link Checker only scans when you press Check. Your email — its HTML, subject, preheader and copy — stays in your browser. Three narrow things about an email can leave it, all of them listed below by name: destination URLs for HTTP status checks, bounded DNS query names for DKIM and DMARC, and a redacted findings payload if you deliberately create a shared report. Separately, the extension reports its own errors and sends anonymous usage statistics; neither contains your email, its links or the address of the page you are on, and statistics can be turned off. Nothing is sold.

This notice covers the Email Link Checker Chrome extension and the backend service it talks to at emaillinkchecker.shelfcompass.com. The Shelf Compass marketing website is covered by the site privacy notice.

What stays in your browser

All of the following is processed locally and never uploaded by the extension:

• The email HTML and the normalised snapshot built from it.
• The subject, the preheader and all visible copy.
• Every analysis result, including findings, evidence and element references.
• Spelling checks, which run against a dictionary bundled inside the extension package and the brand terms you configure. No text is sent anywhere for spelling.
• Browser rendering previews, which run in a sandbox with scripts and remote resources blocked.
• Your brand profile, report state and temporary capabilities, held in chrome.storage.local on your own machine.

Scanning happens only on an explicit action by you. There is no background scanning, and the extension does not read your other messages, does not open other emails, and does not send, schedule or modify campaigns.

What leaves your browser, and where it goes

1. Destination URLs, for HTTP status and redirect checks

When URL status is checked, the extension sends only eligible destination URLs to:

• https://emaillinkchecker.shelfcompass.com/api/email-link-checker/url-status/v1/check

The service uses those URLs for one purpose: to determine the HTTP status, the redirect chain and the final destination. Links that are recognised as unsubscribe, preferences, or one-time-token actions are excluded before a request is ever created, and so are links containing embedded credentials — the extension will not visit a link that could unsubscribe you or consume a single-use token.

The service does not retain request bodies or full URLs after responding, and does not write URL host, path or query values to application or access logs. Aggregate counts, durations and outcome codes may be kept for reliability monitoring.

Caching. Results are cached very briefly to avoid re-probing the same address within one review session: 60 seconds for a successful response, 30 seconds for an HTTP error, and 10 seconds for a timeout, an unreachable target or a request blocked by the target policy. The cache is keyed by a keyed hash of the URL, and the stored entry holds only the outcome — never the URL, the final URL or the redirect chain.

2. DNS query names, for delivered-email authentication

When a delivered message is analysed, the extension sends only bounded DKIM and DMARC DNS TXT query names — at most twelve per check — to:

• https://emaillinkchecker.shelfcompass.com/api/email-link-checker/authentication/v1/dns

Raw MIME, headers, subject and email body are never sent to this endpoint. DKIM signature verification and DMARC alignment evaluation run inside the extension. A DNS failure is reported as unverifiable rather than as a defect on your side.

3. Test Inbox capability commands

Test Inbox is a separate workflow that only starts when you start it. The extension asks the service for a short-lived, unguessable email address and an access token at:

• https://emaillinkchecker.shelfcompass.com/api/email-link-checker/test-inbox/v1/inboxes

It sends capability-management requests only. It never uploads the current page, the email HTML, the subject, the preheader, the snapshot or raw MIME.

After you or your email platform send a test message to that address, the extension downloads the received raw MIME over HTTPS as a bounded stream, rejects oversized or malformed responses, analyses it locally, and does not persist the raw message.

On the service side: at most 10 MiB is accepted; the temporary raw message is stored encrypted at rest with AES-256-GCM; it is deleted when the capability is deleted; and it becomes inaccessible after the displayed one-hour retention period.

Once a message has been received, the selected decoded HTML or text body may move once from the extension's background worker to its trusted side panel, so that final delivered links, UTM parameters, redirects and HTTP status can be checked. A page content script cannot request that data, it is never stored, and only destination URLs can leave the browser afterwards, through the URL-only checker described above.

4. Shared reports, only when you confirm

Creating a shared report is optional and requires a scope confirmation before anything is uploaded. The extension then sends only the critical, warning and unverifiable findings to:

• https://emaillinkchecker.shelfcompass.com/api/email-link-checker/shared-reports/v1/reports

Email HTML, the details of passed findings, DOM references, recipient-token query values, and unsubscribe or preferences URLs are omitted or redacted before upload. The service validates the same restriction again on arrival rather than trusting the extension.

The redacted payload is stored behind an unguessable capability URL for 24 hours, the page is marked noindex, and the extension holds a separate delete capability so you can remove the report immediately instead of waiting for it to expire.

5. Error reports and anonymous usage statistics

These are about the extension, not about your email. Both are sent by the extension's background worker, and neither ever contains email HTML, the subject, the preheader, visible copy, snapshots, links, page or tab addresses, brand rules or Test Inbox capabilities.

Error reports. When the extension itself fails, it sends a report to a self-hosted error tracker (GlitchTip, Sentry protocol) operated by the developer, and a copy of each delivered report to the same server's log store:

• https://errors.freshbox.ee/api/11/envelope/
• https://errors.freshbox.ee/logs/rum/v1/default/logs

A report contains the error type and message, a stack trace of the extension's own code, the extension version, the browser and operating system from the user agent, the browser interface language, a random install ID generated by the extension, a few enumerated context values (scan stage, trigger, platform name, rejection reason), and the IP address the server sees, from which it derives a country and city. Before anything is sent, every web address except the extension's own code is cut down to its scheme, and email addresses, file names, quoted text and credentials are replaced with [Filtered]. Error reports cannot be turned off, because they are sent only when something in the extension breaks.

Usage statistics. The extension sends a closed list of events to Google Analytics 4 through the Measurement Protocol:

• https://www.google-analytics.com/mp/collect

The events are: installed and updated (with version numbers), panel opened, scan completed (trigger, platform such as Gmail or Klaviyo, editor or inbox mode, verdict, whether the report is incomplete, the number of critical, warning, unverifiable and passed findings, and duration), scan failed (trigger and rejection reason), element highlighted (outcome), report exported (method), report shared, brand rules saved, and Test Inbox created. Any parameter not on that list is dropped before sending, and text values are accepted only as short enumerated tokens. Each event carries the random install ID and a session ID; no cookies are used. Statistics are on by default; turn them off in the side panel under More → Privacy & scope → Share anonymous usage stats.

Feedback submitted on this website

This one is not the extension. The extension never sends feedback and never contacts this endpoint. It is reached only when you fill in the form on /email-link-checker/feedback in an ordinary browser tab and press send, which posts to:

• https://emaillinkchecker.shelfcompass.com/api/email-link-checker/feedback/v1/reviews

What is stored: the message text you typed, and — only if you filled them in — the rating, the name, the contact address and the extension version. Nothing else is recorded with it.

What the feedback service does not store: your IP address. The abuse limit needs to recognise a network for a short window, so it keeps a short-lived keyed digest of the address and never the address itself. The extension has no browser fingerprinting; its own error reports and usage statistics are described in section 5 above and never include feedback. This marketing website uses Google Analytics measurement without cookies by default and analytics cookies only with consent, under the website privacy policy; feedback contents are not sent as analytics parameters.

The submission is also forwarded to a private Telegram chat belonging to the developer, so that a broken check gets seen the same day rather than the next time a database is opened.

Retention is different here, deliberately. The other endpoints on this page hold a temporary capability and expire it on a clock — one hour for a Test Inbox message, 24 hours for a shared report. A review or a bug report is not a capability, and expiring it would defeat the point of having asked for it, so it is kept until it is deleted on request.

To have yours removed, email admin@shelfcompass.com. Quoting the message, or the contact address you gave, is enough to find it.

Retention at a glance

• Test Inbox raw message — 1 hour, encrypted at rest with AES-256-GCM, deleted immediately if you delete the capability.
• Shared report — 24 hours, redacted, noindex, deletable on demand.
• URL status cache — 10 to 60 seconds depending on the outcome, and the URL itself is not stored.
• URL status logs — no host, path or query values are written; only aggregate counts, durations and outcome codes.
• Feedback submitted on the website — kept until you ask for it to be deleted, unlike the timed expiries above.
• Error reports — held in local extension storage until delivered and dropped after 3 days if they cannot be; on the server, error events are kept for 14 days and log records for 30 days.
• Usage statistics — event data is kept in Google Analytics for 2 months.
• Everything else — kept on your own machine in chrome.storage.local, and removed when you uninstall the extension.

What is never collected

• Your email HTML, subject, preheader or copy — the extension never uploads the message.
• Your inbox history, your contacts or your recipient lists.
• Recipient-token query values, unsubscribe URLs and preferences URLs, which are excluded from network checks and redacted out of shared reports.
• Advertising identifiers, cookies or cross-site tracking. Usage statistics carry a random install ID, never an account or a name.
• Accounts, names, payment details or any personal profile — the extension does not ask you to sign in.

Who we share it with

The data described above is not sold, not rented and not used for advertising. Email-related data is processed only by the Shelf Compass-operated service at emaillinkchecker.shelfcompass.com, and error reports only by the developer's own server at errors.freshbox.ee. The one third party is Google, which processes the anonymous usage statistics in section 5 as Google Analytics.

Permissions, and why each one exists

The extension is Manifest V3 and requests the narrowest set of permissions that lets it work. All executable code ships inside the package: no remotely hosted code, no CDN scripts, no eval.

• activeTab — so the extension can read the page you are on, and only when you press Check. There is no declaratively registered content script; the scanner is injected on demand.
• scripting — to perform that on-demand injection into the tab you selected.
• sidePanel — to display the report in Chrome's side panel without modifying the email application you are working in.
• storage — to keep the active brand profile, report state and temporary capabilities locally on your machine.
• Host access to emaillinkchecker.shelfcompass.com — the single permanent host permission, used for URL status, Test Inbox, bounded authentication DNS and the optional shared-report API.
• Optional access to Gmail, Mailchimp and Klaviyo origins — requested only when you scan one of those supported platforms, so that an open panel can re-scan the email after you navigate. These are optional permissions, not granted at install.

A broad <all_urls> host permission is deliberately not requested, and error reports and usage statistics need no host permission at all. Adding any new permission or any new network call requires this disclosure to be updated in the same change.

Your choices

Every network interaction about your email is under your control. Do not press Check and nothing is scanned. Do not use Test Inbox and no address is issued. Do not create a shared report and nothing is uploaded. Usage statistics can be switched off in the side panel at any time. Uninstalling the extension removes everything it stored locally, and any Test Inbox message or shared report still in flight expires on the schedule above — or immediately, if you delete it from the panel first.

Children

Email Link Checker is a professional tool for people who send marketing email. It is not directed at children and is not intended for use by them.

Changes

If this notice changes, the date at the top of this page is updated. Any change to what the extension sends over the network requires this page to change in the same release.

Contact

Questions about this policy, or a request about data we hold? Write to admin@shelfcompass.com.