---
title: Privacy · MailWeft
description: What happens to an email you check.
---

MailWeft does not store the emails you check. The email is held in the server's memory for the length of the request and is not written to disk. The server runs with its request log turned off.

## What leaves the server

The rule checks, the B3 model, the scam memory and the sentence check run on the MailWeft server. Nothing is sent elsewhere for them.

The [LLM judge](/how-it-works#llm-judge) sends part of the email to Anthropic, the model's provider:

- The newest message, with quoted history removed.
- The sender's display name and domain, the Reply-To domain, the subject and the authentication results.
- The results of the other checks.

Before sending, MailWeft replaces these with placeholders:

- The part of an email address before the `@`. The domain stays, since it is evidence.
- In links, IDs in the path and the query string. The host stays.
- Phone numbers, long numbers and IDs that mix letters and digits.
- Names of three or more letters from the To, Cc and Delivered-To lines, wherever they appear, and any name after a greeting such as "Dear".

The sender's display name is kept, since a brand name there is evidence. An email that still looks personal after this is not sent, and the judge line says so. The scrubber uses patterns and can miss unusual cases, such as a name in a signature.

For each judge call the server logs a fingerprint (hash) of what was sent and received, the model, the tokens used and the time, but not the email. If the call fails, the provider's error message is saved too, and it can repeat part of what was sent.

## When the judge runs

The judge runs only when you press **Check** (or ⌘↵), open a sample, or open a file, With **When needed** (the default), it runs only when the B3 score is unsure, a rule fired, or B3 is not loaded. With **Always**, it runs on every one of these. The playground checks the email as you type, when the page opens, from a share link, and after **Reset**, all with the judge off.

To keep it off, choose **Settings › LLM judge › Off**. With the API, add `?llm=off`.

## Limits

The judge may run 30 times an hour for each address. Emails larger than 1 MB are rejected.

## In the browser

The playground saves the line wrap, judge, view and column-width settings in your browser. A share link puts the whole email in the link, after the `#`. Browsers do not send that part to the server, but anyone you give the link to can read the email.