Only collect what the pixel needs.

When you create a pixel, the service stores a random public ID, a hash of the private management key, an optional label, status, timestamps, and request counters. Do not put an email address, message body, or sensitive information in the label.

Image-request activity

When the pixel URL is requested, the service records the server time and a conservative client classification. It does not store the raw request IP address or complete user-agent string in the pixel event table. For explicitly designated internal test pixels, we may temporarily retain a bounded user-agent string to compare controlled actions. This diagnostic mode is disabled for ordinary pixels, ends automatically at its configured deadline, and diagnostic records are removed after the test or by the cleanup process. Manually applied activity labels are stored separately from the observed source. Infrastructure providers may process network metadata for delivery, security, logs, and abuse prevention.

A short-lived keyed representation of the connecting address is used to limit pixel creation. It is not shown in reports and should not be treated as an anonymous person identifier.

Private management links

The management secret appears after the # character, so it is not sent to the server as part of the page request. The page uses it in an authorization header when fetching the private report. The full link may remain in browser history or be exposed if you copy or share it. Anyone holding it can view, pause, or delete that pixel.

There is no account recovery. The service stores only a hash of the management secret and cannot send a replacement link.

Saved in this browser

After creation, this browser stores the label, public pixel URL, full private management link, and creation and expiry times in local storage. That lets you reopen valid pixels without showing the private link in the normal result. Anyone with access to this browser profile may also open and manage them.

Forgetting a saved pixel removes only the browser copy. Deleting it from the activity page removes its current service records. Clearing browser data removes the saved list. If local storage is unavailable, the creation result shows the private link once so you can save it yourself.

Retention and deletion

Pixels expire 30 days after creation. At expiry the report stops exposing historical activity and the image route stops recording new requests. A scheduled cleanup removes expired business records, normally within 24 hours. Active deletion removes the current pixel and event records immediately; infrastructure backups and security logs may follow separate retention schedules.

Website, Gmail extension, and external services

The website tool does not authenticate with Gmail or send mail. The linked Chrome extension is a separate workflow in this release; website pixel history is not automatically combined with extension data. Cloudflare hosts the site, Functions, verification, and database. External links use their own privacy terms.

Clipboard and downloads

Copy and download happen after your action. Your browser, clipboard manager, download history, and operating system may retain the generated HTML or pixel URL according to their settings.