Privacy
Last updated October 7, 2026
What happens to what you check
When you drop in an email, paste a link or paste text, it's read by your own web browser, on your own device. It is never uploaded. Attachments are looked inside (for example, what a ZIP file contains or whether an image holds a QR code) right there in your browser too.
The page is locked down by its security settings: it can't load anything from other websites - no outside scripts, fonts, images or trackers - and it can't connect to any other website. The only connection it can make is to TrustThisEmail's own lookup service, and only when you ask for online checks.
What you check is only held in your browser's memory while the page is open. It isn't saved. Close or refresh the page and it's gone.
Optional online checks
After a result, you can choose Run online checks. Nothing is sent unless you click it (or tick "Always run online checks on this device"). When you do, the page sends:
- website names from the email or link - just the name, like
example-shop.top, not the full link, so codes or personal details in links aren't sent; - fingerprints (SHA-256 hashes) of attachments - a code that identifies a file without revealing what's in it.
It never sends the email, its text, the sender or recipients, full links, or the files themselves. Well-known sites (like big banks, retailers and email providers) are skipped because there's nothing to learn about them.
Our lookup service then asks public sources about them: the domain registration records (to see how old a website is) and, from abuse.ch, the URLhaus list of malware websites and the MalwareBazaar list of malware files. Those sources see the website name or fingerprint coming from our service, not from you. Answers are kept for a few hours so repeat lookups are faster; we don't keep a record of who asked.
What we collect
Nothing about you or what you check. Specifically, the site has:
- no accounts or sign-ups,
- no cookies, and nothing stored on your device - except one setting, only if you tick "Always run online checks on this device" (it stays in your browser; untick it to remove it),
- no analytics or tracking scripts, and no ads.
Our web host
The site is delivered by Cloudflare. Like any web host, Cloudflare handles basic connection details - such as your IP address, browser type and which page was requested - in order to deliver the page and protect it from attacks. From that, we can see overall counts, like how many visits the site got and from which countries. We don't see who you are. Cloudflare never receives what you check - only, if you run online checks, the website names and fingerprints described above.
VirusTotal links
If an email has an attachment, the results show its digital fingerprint (a SHA-256 hash) and a link to look it up on VirusTotal, a malware-scanning service run by Google. Nothing is sent unless you click that link. If you do, VirusTotal receives only the fingerprint - not the file and not the email - and its own privacy notice applies.
Check it yourself
You don't have to take our word for it. On a computer, open your browser's developer tools (F12), go to the Network tab, and then check an email. You'll see that nothing is sent when you check something. If you then click "Run online checks", you'll see one request to /api/lookup - open it to see exactly what it contains.
Changes
If this policy changes, this page will be updated and the date at the top will change.