I have three email services and am trying to consolidate, because obviously that’s ridiculous. I pay for Proton’s services and use their Password, VPN, and Docs services. Email is there, but it’s not my favorite. I also had a Fastmail account I retained from years of email use before switching to HEY for a while.
Lately I’ve become curious about email tracking protection.
The gist: use whatever you want. For most people, the features of these are the same. Proton edges out HEY and Fastmail insofar as you can pay with cash and they have encryption on their end. Obviously every email you send is probably sent to someone unencrypted.
All of these tests were conducted via each service’s website/web app, using Brave. I have uBlock installed, as well as NextDNS.
Proton Mail
This is Proton, upon receiving an email that I have not yet viewed:
This is Proton’s message, when viewed and cleaned:
And its privacy outcome:
Proton does a good job of this. It strips trackers and blockers as much as one can reasonably assume to. And it’s filtering most of the email “open” through Proton servers. It’s also intelligent enough to load images most of the time, but not when the image is doing ad tracking. Then it breaks the image.
Fastmail
This is what Email Privacy Tester shows when an email is received at Fastmail, but not yet opened:
The IP routes through Fastmail’s servers. Upon opening the email, this remains unchanged. Here’s what it looks like:
I know that not loading images is the best way to prevent any tracking. But it’s also a crummy way of using email.
Once images are loaded (all through Fastmail’s servers; my IP never leaked), this is the report:
HEY
Because HEY automatically loads emails and displays them with no option for images or not, simply receiving the email is the same as looking at the email, whether you actually look at it or not.
This is the privacy report:
Here’s what it looks like:
Takeaway – they’re all nearly the same
- None of these providers exposed my real IP address.
- HEY uses their own
- Fastmail uses Cloudflare
- Proton uses their own
- HEY’s user agent looks like Linux, and triggers everything via proxy.
- Fastmail uses a custom user agent identifier
- Proton appears as Mobile Safari, and also proxies everything. This is probably so they appear to be homogenous with a global army of iPhones.
- Most of the DNS and CSS tracking techniques are inherently “part of loading an email”, but the proxy is the only defense.
- HEY is most aggressive about showing you a big “We blocked a tracker” message. Proton displays a shield on every email, regardless if it has a tracker or not. You have to hover over it to see if it did anything.
If I had to give an edge to any of these, it’s probably Proton because they took the step to try and “blend into the crowd” based on their user agent string as Mobile Safari. They also use uniform IP ranges.
HEY is probably the most forward in identifying the service. Its proxy says “HEY” right there on the tin.
Fastmail’s use of Cloudflare means it’s using a highly recognizable infrastructure, which is possibly a vector for large organizations to categorize and analyze at scale, but I doubt that’s much of a threat.
As anyone with an understanding of HTML knows, the only way to fully prevent tracking is to block all images. Fastmail and Proton allow you to do this, but, I find it a pretty lousy way of using email. Every so often you need or want those images.
HEY’s web app layout means every time you even glance at your Feed (or Paper Trail) it “opened” the email and loads everything, which I guess doesn’t matter as it just triggers an “open” somewhere. This probably doesn’t matter too much but could indicate to someone that “You opened this email a lot, and perhaps that means we should contact you more or follow up.”
My bigger gripe is that I don’t love any of these services. Proton’s mobile apps are so wildly different from their desktop apps that I can’t even figure out how to do some actions. Best I can tell, there is no “block” feature in the mobile apps. And the keyboard shortcuts just sometimes fail to do anything. Reply to a message and hit “T” for trash and sometimes it just doesn’t do anything “because the cursor isn’t in the right spot.”
Update: Chris Basham, who has always been smarter than me, pointed out in Proton’s mobile apps you tap the general (not tap-obvious) sender info, then a dropdown, and then you can block a sender.
HEY’s certainly consistent, and I like the user flow. But the calendar is borderline useless to me, especially since I can’t use Calendly with it. I can’t use it with Proton, either, but at least that has the rationale of being super private behind it. HEY also suffers from a lack of organization, mostly by design. At this point, I couldn’t scroll to the bottom of my inbox if I tried, and darn near every email is just sorta saved forever. They have no storage limit, best I can tell, but it’s hard to manage.
Fastmail is most wide open. There’s probably a reason it’s the best choice for most people most all of the time.
