Privacy

The headers you paste

Email headers contain personal data: your address and the sender's, names, IP addresses that can reveal a location or employer, internal server names and message IDs. That's why MailDingo never uploads them. The analyser is a script served from this site that runs on your device; the text you paste stays in your browser tab and disappears when you close or clear it.

This isn't only a promise. Every page is served with a Content Security Policy that includes connect-src 'self' and form-action 'self', which instructs your browser to block any attempt to send data to another site, and the analyser itself makes no network requests at all. It loads three data files from this site (the Public Suffix List, Unicode's look-alike table and the example messages) when the page opens; those requests contain nothing you typed. You can check this in your browser's developer tools (Network tab) while you analyse a message. The paste box is not a form and has no submit target, and the address bar never contains your headers.

MailDingo sets no cookies and loads no third-party scripts, fonts, images, analytics or trackers. The offline cache (service worker) stores only the site's own pages and files, never your input.

If this ever changes, for example if advertising is added, this page will say so before it happens, and the analyser will still run entirely on your device.

Server logs

Like almost every website, the server keeps a log of requests: the time, the page requested, the referring page, the browser's user-agent string, and a shortened network address (the last part of the IP address is removed before anything is written, so the log cannot point to one connection). The log is used only to count visits and to stop abuse, is never shared or sold, and is deleted after 30 days. The legal basis under the GDPR is legitimate interest in running and securing the site.

The hosting proxy in front of this site (measured 2026-10-26): successful requests are not logged there. Requests that fail at the proxy are recorded with the visitor's IP address and browser user-agent, with cookies and authorization headers redacted, and are currently kept until the proxy is restarted. A retention limit for those records is under review.