Is Your Email Tracker Reading Your Inbox? Check Its Permissions

When you install a Gmail extension, you approve two kinds of access: Chrome permissions (what the extension can do in your browser) and, when you sign in, Google account permissions (what it can do with your Gmail and other Google data). Most people click Allow on both without reading.

For email tools, those screens can be the difference between "can send a message for you" and "can read every email you've ever received". Here's how to read them.

Google account permissions (OAuth scopes)

When an extension asks you to sign in with Google, the consent screen lists the scopes it wants. For Gmail, the common ones are:

Your email address — low risk

The extension learns which Google account you're using. That's enough to identify you; it can't read or send mail.

Send email on your behalf (gmail.send) — medium risk

The extension can send messages from your account, which scheduled sending and mail merge need. It doesn't allow reading your mailbox, but a malicious extension could send spam as you.

Read your email (gmail.readonly) — high risk

The extension can read every message and attachment in your mailbox, including password resets, bank statements and personal conversations. Some features genuinely need it — detecting replies in a thread, for example — but not every tool that asks for it uses it.

Change or delete your email (gmail.modify or full Gmail access) — very high risk

On top of reading and sending, the extension can change, move or delete your messages.

Other Google services can appear on the same screen — Google Sheets or Contacts, for example. For each one, ask whether it matches a feature you'll actually use.

Chrome permissions

The Chrome Web Store listing and the install prompt show what the extension can do in your browser. For Gmail tools, the key line is site access: an extension that runs on mail.google.com can see and change the Gmail pages you have open. That's how every Gmail extension adds buttons or tracking to your compose window, so it's expected. Be wary of an extension that wants to "read and change all your data on all websites" when it only works in Gmail.

How to check what you've already allowed

1. Open chrome://extensions and click Details on an extension to see its permissions and site access.
2. Open your Google Account's third-party connections page to see which apps can access your Google data, and remove the ones you no longer use.

Red flags

• Inbox read access for a feature that doesn't need it. Open tracking works by adding a pixel to outgoing mail; it doesn't require reading your inbox.
• Access to all websites for a tool that only works in Gmail.
• Contacts access for a simple tracker.
• No privacy policy, or a vague one. If a company won't say what it does with your data, assume the worst.

What Zestmail asks for

We built Zestmail to track opens without access to your inbox. When you sign in, it asks Google for three scopes:

1. Your email address — to identify your account.
2. Send email on your behalf (gmail.send) — used for mail merge and scheduled sending.
3. See your Google Sheets (spreadsheets.readonly, read-only) — used to load mail merge recipients from a spreadsheet.

It doesn't request permission to read, change or delete your Gmail messages, or access to your contacts. In Chrome, it runs on Gmail so it can add the tracking pixel when you click Send, and it uses standard extension permissions for notifications, storage, background sync and its side panel. You can delete the data Zestmail keeps on its servers at any time from the extension's Settings.

What you can do

1. Audit your extensions — check what the ones you have installed can access right now.
2. Remove what you don't use — every extension with Gmail access is one more party that can touch your mail.
3. Prefer tools whose access matches their features.
4. Read the privacy policy, especially what it says about sharing with third parties and how long data is kept.

Your inbox is one of the most sensitive places you keep data. Treat access to it accordingly.