Privacy Policy

Openly (“Openly”, “we”) is a tool that shows you when emails you send from Gmail are opened, how many times, and when. This policy explains how we handle personal data for three groups of people:

• People who sign in to Openly (“you”, when you use the dashboard and the Gmail extension).
• People who receive an email that was sent with Openly tracking turned on.
• People who visit this website without signing in.

For your account we are the controller. For the details of emails you track, including who you sent them to, you decide why and how they are used, and we act as your processor.

If you use the Gmail extension, it reads the compose window in your browser to find the recipients and subject and to add the tracking image. With the “PDFs” box ticked, when you attach only PDF files to a message, it uploads those PDFs to us (instead of attaching them) and puts a link in the message; with the box unticked, or when other kinds of file are attached too, it does nothing with your files. It sends only the recipients, the subject and, when the “Links” box next to Send is ticked, the web addresses of the links in the message. On Gmail’s list pages it also reads each row’s subject, the addresses shown and the time, on your computer only, to put a tick beside the emails you tracked; that text is compared there and never sent to us. You can switch the ticks off in the extension’s popup. About once a minute the extension also asks Openly for the number of opens and clicks on your tracked emails, to show a green dot on its toolbar icon and a count on the Gmail button; this uses the same key and the same data as the dashboard, and can be switched off in the popup too. The extension can also show a small button in Gmail’s top bar that opens a panel with your latest opens and clicks; it shows the same data, fetched the same way, and reads nothing from the Gmail page except where to put the button. It does not read your inbox or your other mail.

• To run Openly: sign you in, record your tracked emails and their opens, and show you the results.
• To keep the service safe: prevent abuse and protect accounts.
• To contact you about your account if we need to.
• To meet legal obligations and handle disputes.

We don’t sell personal data, we don’t show ads, we don’t use analytics trackers, and we don’t use your data to train AI models.

Where GDPR applies we rely on contract (to give you the service you signed up for) and legitimate interests (security and preventing abuse). For the people who receive a tracked email, the sender relies on their own legitimate interests, and is responsible for any consent that local law requires for tracking technologies.

We use these providers to run Openly. They only receive what they need for their part.

We may also share data if the law requires it, to protect people from harm, or in a merger or sale of the business (with notice to you).

We don’t use advertising or cross-site tracking cookies.

Cloudflare and Google run services worldwide, so data may be processed outside your country, including in the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses.

A person sent that email, not us, and they are responsible for it. Openly doesn’t send email and adds no unsubscribe link. To stop receiving emails from the sender, ask them.

How the tracking works. The sender’s email can contain a tiny invisible image. When your mail app loads it, our server records that the email was opened and when. We learn only the time and the kind of mail app that loaded it (for example Gmail or Outlook), and nothing else about you: not your IP address, location or exact device. If an email is opened in more than one kind of mail app, the sender sees a note that it may have been read on another device or passed on. Many mail apps load images automatically, so an “open” does not prove you read the email.

Tracked PDFs. The sender can share a PDF as a link to an Openly viewer page instead of attaching the file. When you open it, our server records the time and the kind of app, and which pages were on screen and for how long. The page says so at the top. For an email sent to several people, the page may first ask for your email address so the sender can tell who opened it; it says that the sender will see it, you can type any address you like, and nobody but the sender sees it. The sender can delete the document at any time, which ends the link.

Tracked links. The sender can also have the links in an email replaced with Openly addresses (on t.tryopenly.com). When you click one, our server records the time and the kind of app, and sends you straight on to the real page. Security filters often click links automatically, so a “click” does not prove a person did. The sender can switch this off for any email.

Your choices. You can stop the image from loading by turning off automatic image loading in your mail app. You can also ask us what we hold about you, or ask us to delete it, by emailing mail@openlee.xyz with the address that was emailed. We will remove the tracked emails that list your address and their opens.

• Tracked emails and their opens: until you ask us to delete them or close your account. We don’t delete them automatically yet.
• Reminder settings and the record of reminders sent: until you delete the email they belong to or your account.
• Documents and their views: until you delete the document (on the Documents page) or your account.
• Sign-in sessions: they expire after 30 days, and signing out ends one immediately.
• Extension keys: when you revoke one it stops working at once. We keep a record that it was revoked.
• You can delete your account and all its data yourself, at the bottom of the Extension page in the dashboard; it happens at once. If you ask us by email instead, we do it within 30 days. Backups, if any, age out on a short cycle.

• Everything is sent over encrypted connections.
• We store no passwords, because you sign in with Google. Sign-in tokens and extension keys are stored only as one-way hashes.
• Every account is separate: you can only ever see your own emails and keys.
• Changes made from the dashboard are protected against forged requests, and the sign-in step is protected against interception and forgery.

No system is perfectly secure. If a breach affects your data we’ll tell you and the regulator where the law requires.

You are responsible for how you use tracking. Depending on where you and your recipients are, the law may require you to tell recipients that you track opens and to get their consent first. Openly does not tell your recipients for you. Don’t use it to track people in ways they would not expect or that the law doesn’t allow.

Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its use, receive a copy, and withdraw consent. You can revoke any extension key yourself on the Extension page. For anything else, email mail@openlee.xyz. You can also complain to your data protection authority.

If you are someone who received a tracked email, we may refer your request to the sender, as they decide how the email is used, but we will help.

Openly is for adult use and is not directed at anyone under 18. We don’t knowingly collect their data.

We may update this policy as the product changes. We’ll change the date at the top and, for significant changes, tell people with an account by email or in the app.

Openly · mail@openlee.xyz