What the extension can see
Updated September 2026
A browser asks you to approve a list of permissions at the moment you install something, which is the worst moment to read one. Here is that list in advance, with the reason for each. It is taken from the extension's own manifest.
Permissions
| What it asks for | Why |
|---|---|
storage | To keep your sign-in on this computer, and whether the tracking switch is on. |
notifications | To tell you the moment one of your emails is opened. |
alarms | To check for new opens on a schedule while the browser is running. |
declarativeNetRequest | To stop your own browser fetching your own tracking pixel, so looking at a message you sent does not get counted as the recipient opening it. |
Sites it runs on
These addresses and no others. It has no access to any other page you visit — not your bank, not your search history, not the rest of your browser.
| Address | Why |
|---|---|
mail.google.com | To find the compose window, put the tracking switch on it, and insert the pixel into the message you are writing. |
outlook.live.com, outlook.office.com,
outlook.office365.com,
outlook.cloud.microsoft | |
mail.yahoo.com | |
mail.zoho.com, .eu, .in,
.com.au | |
flyls.com | So signing in on the website signs you in to the extension, without typing the password twice. |
What leaves your browser
| Sent | Never sent |
|---|---|
| The subject line of a message you chose to track | The body of any message |
| The recipient addresses of that message | Any message you did not switch tracking on for |
| The id of the pixel that was inserted | Attachments, drafts, contacts, or the contents of your mailbox |
Tracking is off unless you turn the switch on for that message. A message sent with the switch off is never mentioned to this site at all.
What it cannot tell you
Stated here rather than discovered later.
- An open that never loads an image is invisible. Many mail clients block remote images until the reader chooses to show them. Until they do, nothing has happened that anyone could observe — not Flyls, and not any other tracker.
- A proxy's country is not the reader's country. Gmail and most large providers fetch the image through their own servers. When that happens the location belongs to a data centre, and it is labelled “Mail Proxy” rather than given a city it cannot know.
- Every mail system fetches the image twice. Once as the message is delivered, before anybody has looked at it, and again when a person opens it. The first is discarded and the second is recorded — which is why a message never shows as opened the moment you send it. In practice that separation is right about 95% of the time on opens, and 100% on link clicks, where a click is a real person navigating and nothing automatic can stand in for one.
The people you write to
Tracking someone without telling them is regulated differently in different countries, and in some — the EU under GDPR among them — the obligation sits with you as the sender rather than with the tool. Flyls gives you what your own messages report; what you may do with that where you live is yours to check. The terms say the same thing in the language lawyers prefer.