Tracking pixels and tracking protection

Most newsletters and a good share of ordinary business mail carry a tracking pixel: a picture one pixel wide, usually invisible, whose address is unique to you. When your mail program fetches it, the sender's server records that you opened this mail, when, from which IP address and on what kind of device. The same trick works with any external image, and links can be tracked in the same way.

Private.Ki treats the message as data to be displayed, never as a page allowed to call home. This article lists what that means in practice.

What happens when you open a tracked email

1. Nothing is fetched. External images are blocked until you ask for them. The pixel, like every other remote image, is replaced by a transparent placeholder on your device.
2. Obvious pixels are hidden. Images declared 1 × 1, images styled to one pixel, and images whose address matches common tracker patterns (/pixel, /beacon, /track, /open, type=open, stpe=pixel and the like) are marked and hidden so they do not leave stray gaps.
3. The rest of the message is defanged. Scripts, inline event handlers, frames, embedded objects, media, SVG and canvas elements are removed. External stylesheets, @import rules and web fonts are stripped — each of them is another way to make a device request a unique address. The message is rendered in a sandbox whose content-security policy forbids network access of any kind except images through our proxy.
4. No read receipt is ever sent. Private.Ki does not implement return receipts or disposition notifications, whatever the sender requested in the headers.

The result: opening a message, however many times, sends nothing to the sender.

If you load images

Choosing Load once, Trust this email or Trust sender changes the picture, and it is worth knowing exactly how:

• Images are fetched by our server through a short-lived proxy link, with no referrer. The sender's server sees Private.Ki's address, not yours, and learns nothing about your device or location.
• Hidden pixels are fetched too. Hiding removes the gap on screen; it does not skip the request. So once you load images, a sender with a unique pixel does learn that the mail was opened and at what time — just not by whom in terms of IP address or device.

Treat loading images as saying yes, I opened this. For senders whose newsletters you read anyway, that is usually fine. For a message from someone you do not know, do not load.

Links are tracked differently

A link like https://click.example.com/abc123 tells the sender which recipient clicked and when, then forwards to the real page. Private.Ki cannot rewrite or shorten such links for you, but it does keep the click clean:

• Every link opens in a new tab or the system browser with rel="noreferrer noopener", so the destination does not learn it was reached from your mailbox.
• A confirmation shows the full address before anything opens — see External links in emails.

What tracking protection does not do

• It does not tell you which mail contained a pixel. Use Show original and look for tiny images or /open-style addresses in the HTML if you want to know.
• It does not sanitise link addresses or remove tracking parameters.
• It does not stop the sender knowing your address is valid when you reply.
• Mail you send is not protected in this way: your own outgoing HTML is displayed to you unblocked in Sent, and your recipients' mail programs decide what to fetch from any images you include.

What our server sees

Common questions