Obsidian SuiteDocumentation
Obsidian Mail Client: all chapters

Docs / Obsidian Mail Client / Privacy & security

Privacy

Your mail goes between your PC and your mail provider. There are no ads, and the app doesn't send your mail anywhere to be read or checked. This chapter covers what the app does to keep senders from watching you, and the tools that show you what your mail reveals.

Tracking pixels

Many newsletters and marketing emails hide an invisible picture that reports when, where and on what device you opened them. The app blocks these pixels in every message, also when you choose Show images. A trackers blocked label above the message says how many were blocked and from which tracking services.

Pictures

Pictures from the internet don't load until you ask, because loading them also tells the sender you read the message. See Reading mail.

Newsletters add tags to their links (such as utm_ and fbclid) to see who clicked what. When you click a link, it opens in your browser without those tags.

Brand logos

For mail whose domain verified it, the app shows the company's registered logo (BIMI). To find it, the app looks up the company's record online (DNS, then its logo file), at most once a week per company. To turn this off, clear Show the brand logo of verified senders (BIMI) in File > Options > Security.

Privacy Report

View > Privacy Report shows how much of your mail tried to track you:

  • how many messages carried a tracking pixel,
  • Who they report to: the tracking services, and how often,
  • Senders that track you most.

Choose Last 30 days, Last year or All time at the top. The report is worked out on this computer from the mail the app keeps; nothing is sent anywhere.

Your Accounts

View > Your Accounts lists the services your mail shows you have an account with. It finds them in welcome, password, sign-in and code emails from those services, and only counts mail their domain vouched for.

Services that have had a data breach are marked Had a data breach, with what was exposed. To check, the app downloads the public list of breached sites from Have I Been Pwned once a day. None of your addresses or accounts leave the app. Latest email opens the most recent message from a service.

Your Addresses

View > Your Addresses makes a different address for every site you sign up to, using plus addressing: an address like [email protected] still reaches [email protected]. The three random characters at the end mean nobody can guess the address from the site's name. If one of those addresses starts getting mail from someone else, you know who let it out, and you can turn it off.

To make one:

  1. Type who it's for in For which site? (for example "Amazon") and pick the account.
  2. Click Make address. Use Copy to copy it, and give it to that site.

The list shows each address, how much mail it got and from whom. An address that Got out names the other senders that use it. For each address:

  • Send test mails the address from its account, so you can see it arrive.
  • Turn off sends its new mail to Junk from now on. Turn on undoes that.
  • Delete forgets the address; mail to it still reaches you.

This works with providers that deliver you+anything@ to you, such as Outlook.com, Gmail and Microsoft 365. The + part is visible, so a careful spammer could remove it; most don't. Turning an address off works in this app; the server still accepts the mail.

Subscriptions & Bills

View > Subscriptions & Bills reads the receipts, renewal notices and bills in your mail and lists what you pay regularly, how often, and roughly what it adds up to each month. Amounts are the latest seen; a charge that stops sending mail drops off. Everything is worked out on this computer.

Mail on this computer

The mail the app keeps on your PC is encrypted, and you can lock the app with Windows Hello. See Encryption, app lock and S/MIME.

To send someone a message only they can read, without them needing a certificate, use a secure link.