Inside out: How the Mail Bridge provides its functionality without compromising your privacy

After the general article about how we at Mailbutler always protect our users' privacy, and the article how we designed our Smart Assistant with a focus on privacy, I would like to explain how we further continued this privacy-centric engineering approach with the latest addition to Mailbutler's core components, the Mail Bridge.

Why is the Mail Bridge needed?

With macOS 14 (Sonoma), Apple decided to shut down support for Mail plugins in its native email application Mail. Until then, it was possible to extend Mail with functionality and that's what we have been doing with earlier versions of Mailbutler. Most features we added were implemented directly into the internals of Mail.
As an example, for email tracking, our Mail plugin took care of adjusting the sending process of Mail itself to insert the hidden tracking pixel into the email before it was actually sent out by Mail. Due to the support for Mail plugins in macOS, it was possible to apply small adjustments to Mail's own behaviors.

This is not possible any longer if you use macOS 14 (Sonoma). As we already explained in our article about compatibility with macOS Sonoma, we worked hard on still providing all the features our users love. And we succeeded!
A major component that was developed for a Sonoma-compatible version of Mailbutler is the Mail Bridge.

How does the Mail Bridge work?

As we are not able to adjust the behavior of Mail itself, we needed to find new ways of still being able to adjust the emails our users send out to include the functionality that they expect when using Mailbutler.

Let's first have a quick look at how emails are normally delivered from a sender's computer to the recipient's inbox: When sending an email with Mail, it is sent out without any advanced functionality, such as email tracking. After hitting "Send" the outgoing email is handed over to an SMTP server, which is basically a service that takes care of delivering emails to the SMTP server of the recipient, where it is normally simply stored in the recipient's inbox.

How an email is generally delivered from a sender's computer to the recipient's inbox.

Mailbutler's Mail Bridge acts like an additional, local SMTP service that takes care of enriching outgoing messages with features, such as email tracking, and afterwards handing it over to the actual SMTP server for final delivery. Thus, all outgoing emails take another step between Mail as the sending email application and the regular SMTP delivery service.
It's actually not uncommon that emails are passed between multiple SMTP services before their final delivery. Mailbutler simply extends this delivery chain by one more intermediate hop, the Mail Bridge intermediary.

How Mailbutler's Mail Bridge extends the regular email delivery chain by enhancing the email on the sender's device.

Tracking

Whenever email tracking is activated for an outgoing email, and that email is going through the Mail Bridge, an invisible tracking image is added to the content of the message. If link tracking is activated, too, all web links in the email message are further adjusted to include tracking functionality. These modifications of your outgoing emails are minimal invasive and do not need to process any other parts of these messages.
The original email content is not processed, stored, or modified as this is not required to provide Mailbutler's email tracking functionality.

Template Rendering

If a message template was used to compose an outgoing email passing through the Mail Bridge, all contained placeholders are replaced according to the message's recipient information. By this, Mailbutler ensures that the further delivered email is personalized for the actual recipient.
Any other content is not processed, stored, or modified as this is not required to provide Mailbutler's message template functionality.

Smart Send Later

When using Mailbutler's Smart Send Later feature and a scheduled email is passing through the Mail Bridge, it will actually stop further delivering that particular scheduled message. Instead the Mail Bridge stores the outgoing email in the "Mailbutler - Scheduled" mailbox to deliver it later when the scheduled delivery date is due. From Mail's perspective the email is properly "delivered" while it is actually discarded (for now) as the user configured it to be sent later.
Again, we do not store the content of that scheduled email on our servers. Instead, we put the message temporarily aside by saving it in the user's mailbox.

How is your privacy protected?

The most important aspect of the design of our Mail Bridge is that it works directly on your computer. All aforementioned adjustments of your outgoing email messages happen on-device and nothing about that email's content might leak to external services – not even Mailbutler's.
As already described earlier, we always minimize the amount of information we store about our users' emails; mostly it is only message identifiers and optionally meta information, such as recipient names, and the subject.

From the perspective of the recipient, an email that went through the Mail Bridge initially, does not look any different to an email that was sent without Mailbutler's Mail Bridge being involved. The only practical difference is that it was not the Mail application that handed over the outgoing email to the sender's SMTP service, but it was the Mail Bridge as an intermediary. But as this happened already on the sender's computer and not somewhere on the internet, the email is still sent from the computer – just as before.

Hopefully this article provided a solid overview of how important privacy protection is to us at Mailbutler and how deeply this principle is designed into our newest addition to the Mailbutler feature set, the Mail Bridge.

I look forward to reading your comments on this story, your follow-up questions on data privacy aspects, and also requests for more details about certain key aspects of the Mailbutler system and its inner workings.