Extenshiextenshi.io/blog
Back to articles
extension-reviewgmailmailtrackboomerangstreakemail-trackingprivacychrome-extensions

Mailtrack vs Boomerang vs Streak: Gmail extension privacy review

Mailtrack vs Boomerang vs Streak, plus Right Inbox and Gmelius: Gmail extension privacy judged by their real Chrome manifests and policies, not marketing.

Maxim Kosterin
11 min read
Three hairline envelopes in a row on paper-white; the third is sealed with a soft orange watercolor wax seal shaped like a small watching eye, framed by a faint ink circle.
Three hairline envelopes in a row on paper-white; the third is sealed with a soft orange watercolor wax seal shaped like a small watching eye, framed by a faint ink circle.

The five Gmail extensions in this review — Mailtrack, Boomerang, Streak, Right Inbox and Gmelius — add up to about 4.75 million Chrome users. Open tracking, send-later, a CRM in your inbox, shared team inboxes. All five are Featured in the Chrome Web Store and one click from install, so hardly anyone gives them a second thought.

So I gave it one. If you're weighing Mailtrack vs Boomerang vs Streak, star ratings won't tell you what each can touch. I pulled the CRX packages Chrome actually installs from Google's update servers, read each manifest.json, and compared it with the listing's privacy declaration and the vendor's policy.

Versions as of October 9, 2026: Mailtrack 12.96.0, Boomerang 1.9.6, Streak 7.114, Right Inbox 11.0.2, Gmelius 9.1.47. Permissions change with any update, so treat this as a dated snapshot.

This is not a malware exposé — none of the five looks malicious. It's about what the access means and where the paperwork is stale. I didn't contact the vendors; everything here is public.

TL;DR verdict

Mailtrack — 3M users. Hosts scoped to Gmail, its own domains, logging endpoints and attachment storage. Declares PII and personal communications. Honest paperwork; open tracking itself carries EU consent obligations.

Boomerang — the narrowest host access of the five: none at all. But its privacy policy dates from March 2019.

Streak — deepest integration (code injected into Gmail's own page context). Store declaration: "will not collect or use your data." Service policy: collects registration and customer data. Both true — they cover different things.

Right Inbox — cleanest manifest here: literally zero API permissions. Also stalest: no update since January 2026, and a 2019 privacy policy.

Gmelius — tight host list, PII declared, Swiss-based. It does open tracking of its own, too.

Bottom line: the real risk isn't these five — it's look-alike listings in store search and policies nobody reads.

What the five extensions do

  • Mailtrack® – Email Tracker for Gmail — open/click tracking, by Mailsuite. 3,000,000 users, 4.4★ (11.8K ratings).
  • Boomerang for Gmail — send later, reminders, snooze, by Baydin Inc. 900,000 users, 4.2★ (2.1K ratings).
  • Streak CRM for Gmail — pipelines and deals inside Gmail. 700,000 users, 4.5★ (6.5K ratings).
  • Right Inbox for Gmail — reminders, tracking, notes, by VoilaNorbert LLC. 100,000 users, 4.6★ (12.3K ratings).
  • Gmelius — shared inboxes, SLAs, AI assistants, by Gmelius SA. 50,000 users, 4.6★ (691 ratings).

All five listings carry a privacy declaration. After the August policy update I covered, read those as promises.

Mailtrack: scoped hosts, disclosed data

Mailtrack's manifest requests three API permissions: storage, notifications and declarativeNetRequestWithHostAccess. Its host list is refreshingly specific: mail.google.com, its own domains (mailtrack.io, mailsuite.com), Google's user-content host, Rollbar for error reporting, Datadog's EU log intake and two Amazon S3 buckets for attachments. No <all_urls>, and content scripts run only on Gmail and Mailtrack's own sites.

Its store declaration lists personally identifiable information and personal communications, not sold to third parties. The privacy policy was last modified in March 2026. The listing adds GDPR compliance, ISO certification and a yearly Google audit — claims I can't verify from a package.

What no manifest shows: open tracking embeds a pixel in the emails you track. For email to EU recipients, that's a regulated act. More below.

Boomerang: smallest footprint, oldest policy

Boomerang's manifest was the surprise: management and activeTab, and no host permissions at all. Its content script loads only on mail.google.com. That's as narrow as Gmail integration gets.

management looks scary out of context, since it lets an extension see your other extensions. The listing explains it: a troubleshooting feature lists installed extensions known to conflict with Boomerang. Request the odd permission, document why — good pattern.

The paperwork shows its age. The privacy policy says "Last modified: March 5, 2019," and that the information in your messages "allows us to analyze the content of your email" for its features. Seven and a half years is an eternity in privacy law; that policy predates the store's current declarations. The declaration lists PII and personal communications, not sold; the listing cites SOC 2 Type 2 certification.

Streak: a "no data" declaration next to a CRM

Streak is the paperwork puzzle. Its Chrome Web Store privacy section says: "The developer has disclosed that it will not collect or use your data." Its service privacy policy — Rewardly, Inc., d/b/a Streak, effective September 27, 2024 — says registration may ask for your name, email address, mailing address or credit card information. It also describes handling data about its customers' contacts as a "data processor."

Both can be true at once: the store declaration covers what the extension collects; the policy covers the service. But for a CRM whose job is reading your inbox, "will not collect or use your data" deserves a raised eyebrow. Read both documents, not just the badge.

Technically, Streak is the deepest integration of the five. Its manifest requests storage, scripting, management and declarativeNetRequestWithHostAccess. Hosts cover mail.google.com, all of *.google.com, *.googleusercontent.com, *.streak.com and mailfoogae.appspot.com, a legacy Streak domain that still serves a page titled "Streak: Gmail CRM for High-Performing Teams." LinkedIn sits in optional_host_permissions, so it's requested at runtime rather than at install.

Its main content script loads on every *.google.com page, not just Gmail. Another runs in Gmail's MAIN world at document_start: inside Gmail's own JavaScript, before the page loads. Powerful, and worth knowing about.

Right Inbox and Gmelius: the minimalists

Right Inbox's manifest lists an empty permissions array. Zero. Host access is limited to https://*.rightinbox.com/, with content scripts on mail.google.com and inbox.google.com. The store declaration says it "will not collect or use your data," and its privacy policy was last updated October 14, 2019.

On manifest hygiene, it wins. The catch: version 11.0.2 shipped January 26, 2026, more than eight months ago, while every other extension here updated within two weeks. Stale isn't abandoned, but unattended dependencies are their own risk.

Gmelius carries activeTab, declarativeNetRequest, scripting and storage. Hosts are limited to Gmail, *.googleusercontent.com and its own domains, plus optional access to gml.email. Its declaration says it handles PII; the listing pitches "Swiss-grade privacy", and its policy promises your data is "never used to develop, improve or train generalised AI or machine-learning models".

One detail worth knowing: Gmelius does open tracking too, and its tracking URLs point at gml.email. The package also ships a ruleset named blockTrackerImageRuleset that blocks image loads from that domain inside Gmail.

Mailtrack vs Boomerang vs Streak: side by side

Mailtrack Boomerang Streak Right Inbox Gmelius
Users 3,000,000 900,000 700,000 100,000 50,000
Rating 4.4★ 4.2★ 4.5★ 4.6★ 4.6★
Last updated Oct 7, 2026 Sep 29, 2026 Oct 8, 2026 Jan 26, 2026 Oct 1, 2026
API permissions 3 2 4 0 4
<all_urls> host access No No No No No
Store declaration PII + communications PII + communications Will not collect/use Will not collect/use PII
Policy last modified Mar 2026 Mar 2019 Sep 2024 Oct 2019 Jun 2026

Nobody requests all-websites access — unlike the AI writing assistants in my Grammarly/QuillBot review, which hold exactly that <all_urls> permission.

Look-alike listings around "Mailtrack"

Here's what actually worries me. Researching the real Mailtrack, I found store listings with near-identical names.

One, titled "MailTrack", had 53 users, version 0.1.0 and no developer name. Its data declaration listed PII, authentication information, personal communications, location and user activity, and nothing in the listing indicated any connection to Mailsuite. When I re-checked on October 9, the listing no longer loaded and Chrome's update server no longer served the package.

Another, "Email Tracker for Gmail" (20,000 users), is still listed. Its developer contact sits at mailtrack.email, its description calls the product "Mail Track for Gmail", and its declaration says it won't collect or use your data. Nothing in it ties it to Mailsuite either.

I'm describing behavior from store listings, not making accusations. But this is how look-alike listings get installs: users search a brand and click the first plausible tile. It's the same dynamic as vetting an MV2 replacement without installing a clone. The store has form here, too: in February, SecurityWeek reported over 300 malicious Chrome extensions caught leaking or stealing user data.

When you install by brand name, check the developer and the install count first. 53 users and a declaration covering authentication information and location? Keep walking.

One more thing manifests can't show: what tracking does to the recipient. Mailtrack and friends embed a small remote image, a pixel, in the emails you track. When the recipient's mail client loads it, the tracking service logs the open. How these tools get inside Gmail is covered in what browser add-ons can really see in your inbox.

Regulators have caught up. In April 2026, France's CNIL published its final recommendation on tracking pixels in emails under article 82 of the French data protection act. Consent is generally required before a pixel fires, with narrow exemptions. The final version added one: individual measurement of deliverability for emails tied to a service the recipient requested.

If your Mailtrack habit includes cold outreach to EU recipients, that part deserves real legal advice, not a blog post.

FAQ

Is Mailtrack safe to use? Nothing in its manifest reaches beyond Gmail and its declared endpoints, and its declaration is upfront about PII. "Safe to install" and "compliant for tracking EU recipients" are different questions.

Can Boomerang read all my email? Its content script runs inside Gmail, and its 2019 policy says the service analyzes email content for the features you use. So yes: inside Gmail, its content script sees whatever Gmail shows you. What it lacks is host permissions, so it can't reach any other site.

Does Streak collect my data? The extension's store declaration says no. The company's service policy describes collecting registration data and processing data for its customers. Read the policy, not the badge.

How do I check this myself? Open chrome://extensions and read the permissions. Or search the extension in our catalog: each page lists the permissions from the published package. To check everything installed at once, run npx @extenshi/guard scan (free account; docs). One caveat: the catalog's automated safety score combines malware, permission and obfuscation checks on the package's code, so it can rate an extension differently from the manifest-and-policy read in this post. Open the findings to see why.

Final recommendation

  • Open tracking: Mailtrack — honest declaration, tightly scoped hosts.
  • Scheduling: Right Inbox for the smallest permission list, if an eight-month-old build doesn't bother you; Boomerang for active development. Both run on 2019 privacy policies.
  • CRM in Gmail: Streak — the deepest integration here; mind the declaration-vs-policy gap.
  • Team inboxes: Gmelius — Swiss-based, PII declared, hosts limited to Gmail and its own domains.
  • Whatever you pick: install from the vendor's exact listing and re-check permissions after major updates. Not every change triggers a prompt.

See the security report for Mailtrack — what the automated scan flags inside its code →

Sources

This article is based on publicly available extension packages, store listings, vendor policies and news reporting. Extenshi does not independently verify all claims made by third-party researchers. References to specific companies or products reflect the findings of cited sources and do not constitute accusations of intentional wrongdoing. If you believe any information is inaccurate, please contact us at [email protected].

Related Articles