No surprises
Privacy Policy
Privacy is a first principle here, not an afterthought.
Here's exactly what happens to your data, in plain language.
Last updated: May 2026
What we never store
These things never touch our database or disk. Ever.
Your .eml file
Processed in server memory and discarded immediately. Never written to disk or stored in a database.
Email content
Subject lines, body text, sender addresses, and URLs from your email are never logged or stored.
Your IP address
Used only to enforce rate limits. Immediately hashed with HMAC-SHA256 and a secret salt. The raw IP is discarded. The hash cannot be reversed.
Attachment files
Only the SHA-256 hash of your attachments is used to query VirusTotal. Actual file bytes never leave our server.
Your identity
No user accounts. No name, email address, or any personally identifiable information collected at any point.
Scan history
We keep no record of what emails you've scanned. Each analysis is isolated and discarded. There is no log linking you to a scan.
Argus Relay: email forwarding
Argus Relay is an optional feature that lets you forward suspicious emails to relay@mailargus.tech and receive a verdict reply. It has a slightly different privacy model from the web scanner. Here's exactly what changes.
Your email address
We receive your email address as part of the forwarded message envelope. It is used solely to send your verdict reply. The raw address is never logged or stored in our database. Only an irreversible HMAC-SHA256 hash is kept for rate limiting (see below).
Rate limiting
A one-way HMAC-SHA256 hash of your email address is stored alongside a daily scan count (max 3/day). The raw address cannot be recovered from this hash. The record resets daily.
Forwarded email content
When you forward an email to Argus Relay, it is briefly received by our mailbox on Namecheap's mail servers and deleted immediately after processing. It is never written to our application database. The same third-party services (Claude AI, urlscan.io, VirusTotal, Google Safe Browsing) receive the same extracted fields they would from a web scan.
Namecheap mail infrastructure
Inbound and outbound relay emails pass through Namecheap Private Email servers, which handle delivery. Namecheap will have a server-side record of the email transaction. We have no control over Namecheap's own retention policies.
Full report link
Every relay verdict email includes a "View full report" link to a page on mailargus.tech. Creating that page stores the verdict, the findings, and the public threat intelligence for 7 days, after which it is permanently deleted. This is the one way the relay path differs from the web scanner, where the equivalent link is opt-in. The forwarded email's body, its raw headers, and your email address are never stored, and the link is unguessable rather than listed anywhere.
MailArgus Extended: the browser extension
The MailArgus extension scans the Gmail message you are already reading, so you don't have to export an .eml first. It sends that message through the same pipeline as the website, and stores no more than the website does.
What it reads
The extension never reads your inbox and never scans in the background. It reads exactly one message — the one on your screen — and only after you click the toolbar icon, choose the right-click item, or press the keyboard shortcut.
How that is enforced
The extension asks for no standing permission to Gmail. It uses Chrome's activeTab, which grants access to a tab only at the moment you invoke the extension, and only for that tab. Between those moments it can see nothing at all. That is why installing it does not warn you about reading your email — it genuinely cannot, until you ask.
The toolbar icon
The toolbar icon glows purple when a Gmail message is open, so you can see at a glance that a scan is one click away. It does not learn that by reading the page. Chrome does the matching itself, through a feature built for exactly this, and simply swaps the icon; the extension is never told which page you are on and receives no notification at all. That is why this adds nothing to the permissions you are asked for at install.
What happens to the message
The message is held in memory, sent to our server over HTTPS for analysis, and discarded. It is never written to disk, never stored in a database, and never saved anywhere in your browser. Exactly as if you had uploaded the file on the website.
What it stores
Three settings that stay until you remove the extension: the scan depth you picked, whether you have seen the first-run tip, and whether you asked for reduced motion. None of them is about your mail.
While your browser is open it also keeps four working values, all cleared when you close it: which tab has a scan running, how many scans you have left today, what the toolbar icon is showing, and the result of your last scan. That last one is there so the glowing icon always has something behind it. Chrome shuts idle extensions down, and without it the glow would outlive the result and clicking it would run a second scan. What is kept is our analysis rather than your email: the verdict, how confident we are, and the reasons. Those reasons can name a sender domain or a link, because naming them is the point of the analysis. Your message itself is never stored, none of it leaves your browser, and all of it is gone when you close it.
Sharing
The extension creates a share link only if you press the share button, the same as on the website. Unlike Argus Relay, it never creates one automatically.
Daily limits
The extension shares the website's daily scan allowance rather than having its own, using the same hashed-IP counter described above. Scanning from the extension uses the same quota as scanning on the site.
Opt-in on the web scanner
On mailargus.tech a share link is created only when you explicitly click Share and confirm, and every scan without sharing leaves no stored data. Scans sent through Argus Relay always get one, because the verdict email links to it.
What's stored
Verdict, AI summary, findings, authentication status (SPF/DKIM/DMARC), sender identity fields, signal counts, and urlscan.io and VirusTotal results.
What's never stored
Email body content and raw headers are excluded from shared links. These are the fields most likely to contain personal information, and they are never written to our database.
7-day retention
Shared scan data is permanently and automatically deleted after 7 days. Share links become inaccessible once expired. There is no way to extend the retention period.
What we do collect
Four minimal data points, all anonymous.
Rate limiting counters
A one-way hash of your IP and of your scan token, the date of your scans, and a count of scans used per scan depth (Light/Standard/Ultra). Light and Standard are counted per day. Ultra is counted over a 90 day window, because free Ultra scans are meant as a small taste rather than a daily allowance, so that counter stays active until the window ends. This exists to enforce the scan limits, and we keep it for 90 days so we can see how much the service is being used, spot abuse, and plan capacity. We can tell that one anonymous key ran a lot of scans. We cannot tell whose it is: the hash is one-way and we never store the address it came from.
Scan token
A random ID we generate on your first visit and store in your browser, so your daily scan allowance follows you instead of following your network. It is not a device fingerprint: nothing about it is derived from your device, your browser, or your connection, and it cannot be used to recognise you anywhere else. We store it only as a one-way hash, alongside the same scan counts described above. Clearing your cookies clears it, and doing so costs you nothing beyond the scans you have already used today.
Threat-intel cache
To reduce load on free-tier threat intelligence services, reputation results for domains and URLs are cached briefly (1–24 hours depending on source) keyed by a one-way hash of the domain or URL, not the domain or URL itself. A cache entry only matches if a future lookup already knows the same value — nothing can be recovered from the hash.
Aggregate analytics
Anonymous totals: scans per day, verdict counts, API performance metrics, and country-level geographic counts (e.g. "3 scans from Germany today"). No user-level information whatsoever. These stats power the public counter on the home page.
Third-party services
Four external services are involved in every scan. Here's exactly what each one receives.
Anthropic (Claude AI)
Receives extracted email fields: headers, auth results, body text, URLs. Raw .eml bytes are never transmitted. On Ultra scans, a screenshot of the scanned link's landing page (captured by urlscan.io) may also be sent for visual analysis — this is an image of the destination website, not your email content. Governed by Anthropic's privacy policy.
urlscan.io
Receives the main CTA URL for a live browser scan. Uses unlisted visibility. Never appears in public search results. Governed by urlscan.io's terms.
VirusTotal
Receives the SHA-256 hash of attachments (never file bytes) and the final destination domain for a reputation check. Governed by VirusTotal's privacy policy.
Google Safe Browsing
The final destination URL is checked against Google's Safe Browsing threat database. Only the URL is transmitted. No identifying information. Governed by Google's privacy policy.
RDAP registration lookup
The sender's domain name is sent to the free public RDAP registry gateway (rdap.org) to check registration age and registrar. No other information is transmitted.
ipinfo.io (geo lookup)
Your IP address is sent to ipinfo.io to resolve a country code (e.g. "US"). Only the 2-letter country code is stored. Never the IP itself. This data is used only for aggregate geographic analytics. Governed by ipinfo.io's privacy policy.
Cookies
MailArgus uses two cookies, both HttpOnly and containing no personal information. The first is a scan token, set on your first visit: a random ID that lets your daily scan allowance follow you when your network changes, and that lets people sharing one office or campus connection each get their own allowance instead of competing for a single one. The second is set only if you use the Stargate passphrase unlock, and grants unlimited scans. The scan token lasts a year. The unlock cookie lasts seven days and then expires on its own, and it can be revoked at any time without affecting anything else. We do not use advertising cookies, tracking pixels, or any third-party analytics.
Your rights
Because we do not store personally identifiable information, there is nothing to access, export, or delete. Rate limiting records for Light and Standard become inactive the following day; the Ultra counter stays active until its 90 day window ends. All of them are deleted after 90 days. Aggregate statistics, including how many scans ran at each depth and what they cost us to run, are retained indefinitely as they contain no personal data.
