Last updated: 22 August 2026
PhishWall reads your email in order to tell you whether it is phishing. This page explains exactly what it reads, where that reading happens, and what — if anything — leaves your computer.
The short version: nothing does, unless you switch something on.
The browser extension that works on its own.
When you open a message in Gmail, the extension reads that message from the page you already have open:
On your computer, inside your browser. The detection models — the ones that judge the wording, the links, and the phrases — are bundled inside the extension itself. They run in your browser like any other code on a web page.
Nothing. Not a summary, not a score, not an anonymous statistic.
This is not a promise about our intentions; it is a property of how the
extension is built. Chrome extensions must declare, up front, which servers
they are allowed to contact. This one declares none. You can verify that
yourself: open chrome://extensions, find PhishWall, and look at its
permissions. There is nothing there about network access, because it has none.
Nothing. No history, no cache of messages, no record of what was scanned. Close the tab and there is nothing left. The extension does not even request permission to store data.
One thing: mail.google.com. It cannot read any other site you visit, and it cannot act on any other tab. That restriction is enforced by your browser, not by us.
The version that uses the PhishWall application on your computer.
This one sends the message to PhishWall running on your own machine, at
https://localhost:8765. localhost means this computer, and only this
computer — that address is not reachable from the internet, from your home
network, or from us.
We cannot see it, because there is nothing to see: no request leaves the machine.
The desktop application has two settings, both off by default, both in the panel at the bottom of PhishWall:
External lookups. When the local models are unsure about a link, check that link against urlscan.io's public index. Only the link is sent, only when the models are unsure, and only if you have enabled this.
Help improve detection. Contribute anonymous information about phishing infrastructure: the shape of malicious links, the servers that sent them, authentication failures. Never the message. Never your address. Never anyone else's address.
If a link contains your email address — phishing kits often personalise them — that is removed before anything is sent. The removal keeps only characters from an approved list rather than trying to spot and delete personal ones, because a filter that removes what it recognises fails open on everything it does not.
Nobody. PhishWall has no analytics, no crash reporting, no advertising, no third-party scripts and no tracking of any kind — in the extensions, in the desktop application, and on this website.
This page loads no external fonts and makes no requests to anyone but the server it is served from. That is deliberate: a page telling you your mail stays on your machine should not hand your IP address to a font provider to say so.
PhishWall is not directed at children and collects nothing from anyone, including them.
Any change that caused information to leave your device would be a change to the product, not a change to a policy — so it would arrive as a new version you choose to install, described in its release notes, and this page would be updated with the date at the top before that version shipped.
Questions about privacy, or about anything on this page: open an issue.