---
title: Privacy · MailWeft
description: What happens to an email you check.
---

MailWeft does not store the emails you check. The email is held in the server's memory for the length of the request and is not written to disk. The server runs with its request log turned off.

## What leaves the server

The rule checks, the B3 model, the scam memory and the sentence check run on the MailWeft server. Nothing is sent elsewhere for them.

The [LLM judge](/how-it-works#llm-judge) sends part of the email to Anthropic, the model's provider:

- The newest message, with quoted history removed.
- The sender's display name and domain, the Reply-To domain, the subject and the authentication results.
- The results of the other checks.

Before sending, MailWeft replaces these with placeholders:

- The part of an email address before the `@`. The domain stays, since it is evidence.
- In links, IDs in the path and the query string. The host stays.
- Phone numbers, long numbers and IDs that mix letters and digits.
- Names of three or more letters from the To, Cc and Delivered-To lines, wherever they appear, and any name after a greeting such as "Dear".

The sender's display name is kept, since a brand name there is evidence. An email that still looks personal after this is not sent, and the judge line says so. The scrubber uses patterns and can miss unusual cases, such as a name in a signature.

For each judge call the server logs a fingerprint (hash) of what was sent and received, the model, the tokens used and the time, but not the email. If the call fails, the provider's error message is saved too, and it can repeat part of what was sent.

## When the judge runs

The judge runs when you press **Run it** under the result (or ⌘↵), open a sample, or open a file, and once after you stop editing an email for 2 seconds. It never runs twice on the same text. With **When needed** (the default), it runs only when the B3 score is unsure, a rule fired, or B3 is not loaded. With **Always**, it runs every time. The checks that run as you type, when the page opens, from a share link, and after **Reset** leave the judge off.

To keep it off, choose **Settings › LLM judge › Off**. With the API, add `?llm=off`.

## Your API key

The judge can run on your own Anthropic key: **Settings › LLM judge › API key…**. The key is stored only in this browser and sent with each check over HTTPS. The server uses it for that one judge call and never saves or logs it. **Remove key** deletes it from the browser.

## Limits

Without your own key, the judge may run 30 times an hour for each address. With your key there is no such limit. Emails larger than 1 MB are rejected.

## In the browser

The playground saves the line wrap, judge, view and column-width settings, and your API key if you add one, in your browser. A share link puts the whole email in the link, after the `#`. Browsers do not send that part to the server, but anyone you give the link to can read the email.