Privacy
Short version: your email is never uploaded. Long version below.
Outlook add-in
The Outlook add-in reads the selected message inside Outlook's add-in webview under its ReadItempermission. It keeps the original internet headers, rebuilds the body locally from Outlook's item data, sends no headers or body to Message Loupe, and stores no verdict history.
To evaluate the sender's domain, Message Loupe sends the domain name only — never message content — to public DNS (dns.google) and the public RDAP registry for that domain. When lookups are unavailable, the scan still runs; those two checks are simply skipped.
What we collect
Nothing about your email. When you drop a file or paste headers, the parser, content classifier, and verdict logic all run in JavaScript inside your browser. The contents of your email are never transmitted to us, our hosting provider, or any third party.
Domain lookups may happen. For non-webmail senders, your browser may ask Google Public DNS for the sender domain's MX records. A same-site Cloudflare function may relay that domain to public RDAP services for its registration age. The domain is sent in the request body rather than the URL. These requests never include email contents, headers, links, verdict, or the uploaded file.
No analytics, no cookies, no tracking. We don't embed Google Analytics, Plausible, Posthog, or any other tracker. The site is served from a CDN, with one narrowly scoped domain-age function.
Standard server logs. Our hosting provider (Cloudflare Pages) keeps short-lived request logs for availability and DDoS-mitigation purposes. These contain your IP address and the URL you requested, like every other website on the internet. They do not contain anything from your email.
What we don't do
- We do not upload, log, store, or transmit your email.
- We do not call third-party reputation services with your email data.
- We do not send message contents, headers, links, or verdicts to DNS or RDAP.
- We do not set cookies (other than what your browser may set automatically; none from us).
- We do not have a database. There is nothing to leak.
If you contact us
If you email us at hello@messageloupe.com, we'll have whatever you put in that email and your reply-to address. We use that to answer you and nothing else. We don't add you to a mailing list.
Verifying our claims
You can verify this behavior directly. Open your browser's network tab while you analyze a sample email; the only scan-time requests you should see are optional domain-only lookups to dns.google and the same-site /api/rdap endpoint.
Changes to this policy
We will update this policy if our data handling changes. We won't add tracking quietly.