Extension privacy policy

The short version: Email Link Checker only scans when you press Check. Your email — its HTML, subject, preheader and copy — stays in your browser. Three narrow things can leave it, all of them listed below by name: destination URLs for HTTP status checks, bounded DNS query names for DKIM and DMARC, and a redacted findings payload if you deliberately create a shared report. Nothing is sold, and nothing is shared with third parties.

This notice covers the Email Link Checker Chrome extension and the backend service it talks to at emaillinkchecker.shelfcompass.com. The ShelfCompass marketing website is covered by the site privacy notice.

What stays in your browser

All of the following is processed locally and never uploaded by the extension:

• The email HTML and the normalised snapshot built from it.
• The subject, the preheader and all visible copy.
• Every analysis result, including findings, evidence and element references.
• Spelling checks, which run against a dictionary bundled inside the extension package and the brand terms you configure. No text is sent anywhere for spelling.
• Browser rendering previews, which run in a sandbox with scripts and remote resources blocked.
• Your brand profile, report state and temporary capabilities, held in chrome.storage.local on your own machine.

Scanning happens only on an explicit action by you. There is no background scanning, and the extension does not read your other messages, does not open other emails, and does not send, schedule or modify campaigns.

What leaves your browser, and where it goes

1. Destination URLs, for HTTP status and redirect checks

When URL status is checked, the extension sends only eligible destination URLs to:

• https://emaillinkchecker.shelfcompass.com/api/email-link-checker/url-status/v1/check

The service uses those URLs for one purpose: to determine the HTTP status, the redirect chain and the final destination. Links that are recognised as unsubscribe, preferences, or one-time-token actions are excluded before a request is ever created, and so are links containing embedded credentials — the extension will not visit a link that could unsubscribe you or consume a single-use token.

The service does not retain request bodies or full URLs after responding, and does not write URL host, path or query values to application or access logs. Aggregate counts, durations and outcome codes may be kept for reliability monitoring.

Caching. Results are cached very briefly to avoid re-probing the same address within one review session: 60 seconds for a successful response, 30 seconds for an HTTP error, and 10 seconds for a timeout, an unreachable target or a request blocked by the target policy. The cache is keyed by a keyed hash of the URL, and the stored entry holds only the outcome — never the URL, the final URL or the redirect chain.

2. DNS query names, for delivered-email authentication

When a delivered message is analysed, the extension sends only bounded DKIM and DMARC DNS TXT query names — at most twelve per check — to:

• https://emaillinkchecker.shelfcompass.com/api/email-link-checker/authentication/v1/dns

Raw MIME, headers, subject and email body are never sent to this endpoint. DKIM signature verification and DMARC alignment evaluation run inside the extension. A DNS failure is reported as unverifiable rather than as a defect on your side.

3. Test Inbox capability commands

Test Inbox is a separate workflow that only starts when you start it. The extension asks the service for a short-lived, unguessable email address and an access token at:

• https://emaillinkchecker.shelfcompass.com/api/email-link-checker/test-inbox/v1/inboxes

It sends capability-management requests only. It never uploads the current page, the email HTML, the subject, the preheader, the snapshot or raw MIME.

After you or your email platform send a test message to that address, the extension downloads the received raw MIME over HTTPS as a bounded stream, rejects oversized or malformed responses, analyses it locally, and does not persist the raw message.

On the service side: at most 10 MiB is accepted; the temporary raw message is stored encrypted at rest with AES-256-GCM; it is deleted when the capability is deleted; and it becomes inaccessible after the displayed one-hour retention period.

Once a message has been received, the selected decoded HTML or text body may move once from the extension's background worker to its trusted side panel, so that final delivered links, UTM parameters, redirects and HTTP status can be checked. A page content script cannot request that data, it is never stored, and only destination URLs can leave the browser afterwards, through the URL-only checker described above.

4. Shared reports, only when you confirm

Creating a shared report is optional and requires a scope confirmation before anything is uploaded. The extension then sends only the critical, warning and unverifiable findings to:

• https://emaillinkchecker.shelfcompass.com/api/email-link-checker/shared-reports/v1/reports

Email HTML, the details of passed findings, DOM references, recipient-token query values, and unsubscribe or preferences URLs are omitted or redacted before upload. The service validates the same restriction again on arrival rather than trusting the extension.

The redacted payload is stored behind an unguessable capability URL for 24 hours, the page is marked noindex, and the extension holds a separate delete capability so you can remove the report immediately instead of waiting for it to expire.

Feedback submitted on this website

This one is not the extension. The extension never sends feedback and never contacts this endpoint. It is reached only when you fill in the form on /email-link-checker/feedback in an ordinary browser tab and press send, which posts to:

• https://emaillinkchecker.shelfcompass.com/api/email-link-checker/feedback/v1/reviews

What is stored: the message text you typed, and — only if you filled them in — the rating, the name, the contact address and the extension version. Nothing else is recorded with it.

What is not stored: no IP address. The abuse limit needs to recognise a network for a short window, so it keeps a short-lived keyed digest of the address and never the address itself. There are no cookies on this site, no analytics, and no browser fingerprint of any kind.

The submission is also forwarded to a private Telegram chat belonging to the developer, so that a broken check gets seen the same day rather than the next time a database is opened.

Retention is different here, deliberately. The other endpoints on this page hold a temporary capability and expire it on a clock — one hour for a Test Inbox message, 24 hours for a shared report. A review or a bug report is not a capability, and expiring it would defeat the point of having asked for it, so it is kept until it is deleted on request.

To have yours removed, email admin@shelfcompass.com. Quoting the message, or the contact address you gave, is enough to find it.

Retention at a glance

• Test Inbox raw message — 1 hour, encrypted at rest with AES-256-GCM, deleted immediately if you delete the capability.
• Shared report — 24 hours, redacted, noindex, deletable on demand.
• URL status cache — 10 to 60 seconds depending on the outcome, and the URL itself is not stored.
• URL status logs — no host, path or query values are written; only aggregate counts, durations and outcome codes.
• Feedback submitted on the website — kept until you ask for it to be deleted, unlike the timed expiries above.
• Everything else — kept on your own machine in chrome.storage.local, and removed when you uninstall the extension.

What is never collected

• Your email HTML, subject, preheader or copy — the extension never uploads the message.
• Your inbox history, your contacts or your recipient lists.
• Recipient-token query values, unsubscribe URLs and preferences URLs, which are excluded from network checks and redacted out of shared reports.
• Analytics, advertising identifiers or usage tracking. The extension contains no analytics SDK.
• Accounts, names, payment details or any personal profile — the extension does not ask you to sign in.

Who we share it with

Nobody. The data described above is not sold, not rented, not used for advertising, and not shared with third parties. It is processed only by the ShelfCompass-operated service at emaillinkchecker.shelfcompass.com and only for the purposes named on this page.

Permissions, and why each one exists

The extension is Manifest V3 and requests the narrowest set of permissions that lets it work. All executable code ships inside the package: no remotely hosted code, no CDN scripts, no eval.

• activeTab — so the extension can read the page you are on, and only when you press Check. There is no declaratively registered content script; the scanner is injected on demand.
• scripting — to perform that on-demand injection into the tab you selected.
• sidePanel — to display the report in Chrome's side panel without modifying the email application you are working in.
• storage — to keep the active brand profile, report state and temporary capabilities locally on your machine.
• Host access to emaillinkchecker.shelfcompass.com — the single permanent host permission, used for URL status, Test Inbox, bounded authentication DNS and the optional shared-report API.
• Optional access to Gmail, Mailchimp and Klaviyo origins — requested only when you scan one of those supported platforms, so that an open panel can re-scan the email after you navigate. These are optional permissions, not granted at install.

A broad <all_urls> host permission is deliberately not requested. Adding any new permission or any new network call requires this disclosure to be updated in the same change.

Your choices

Every network interaction described here is under your control. Do not press Check and nothing is scanned. Do not use Test Inbox and no address is issued. Do not create a shared report and nothing is uploaded. Uninstalling the extension removes everything it stored locally, and any Test Inbox message or shared report still in flight expires on the schedule above — or immediately, if you delete it from the panel first.

Children

Email Link Checker is a professional tool for people who send marketing email. It is not directed at children and is not intended for use by them.

Changes

If this notice changes, the date at the top of this page is updated. Any change to what the extension sends over the network requires this page to change in the same release.

Contact

Questions about this policy, or a request about data we hold? Write to admin@shelfcompass.com.