AccountProxy.com
Dashboard

A Private Extension for Your Browser

Most browser extensions that check your mail ask you to sign in with your main account, and from then on they hold the keys to everything. The AccountProxy extension for Chrome and Firefox works the other way round. It is built to know as little as possible: how many unread emails each of your identities has, and nothing more.

This article explains what the extension does, what it deliberately cannot do, and why it never needs your Account ID.

What it does

  • A badge on the toolbar icon with your total unread count across every identity you choose.
  • A count per identity when you open it, so you know where new mail landed.
  • Optional notifications when new mail arrives. They are off until you turn them on.
  • A button to open AccountProxy in a new tab, where you read and reply as usual.

That is the whole feature set. It does not read mail, send mail, or manage identities, and that is on purpose.

It never sees your Account ID

Your Account ID is the only credential for your account. Anything that holds it can sign in as you, so the extension never asks for it.

Instead, you create a separate API key under Dashboard → API access and paste it into the extension. That key is kept apart from your Account ID in every way that matters:

  • It cannot reveal your Account ID. The key is its own random credential. Nothing in it, or in what it returns, leads back to your Account ID.
  • It is read-only. It can fetch counts. It cannot read, send or delete mail, and it cannot change anything in your account.
  • It only sees the identities you pick. When you create the key, you choose which identities it covers. The rest stay invisible to it.
  • Identity names are optional. By default the extension shows "Identity 1", "Identity 2" and so on. Real identity names appear only if you allow them when you create the key.
  • References are unique to each key. The identifiers the API returns are derived per key, so two keys cannot be used to match up the same identity.
  • You can revoke it at any time. Revoking a key, or switching off API access entirely, stops it immediately. Your Account ID and everything else keep working.

If the key ever leaks, the worst anyone can learn is how many unread emails some of your identities have. They cannot sign in, read your mail, or find out who you are.

What stays on your device

  • The API key, the latest counts and your settings are kept in the extension's local storage. Nothing is synced through your browser account to other devices.
  • "Mark as read" in the extension is stored only on your device. It does not touch your inbox on AccountProxy.
  • Disconnecting removes the key and everything the extension stored. Uninstalling does the same.

What leaves your device

Almost nothing:

  • The extension talks to accountproxy.com only, and only after you press Connect. There are no other servers, no analytics and no third-party scripts.
  • It checks for new mail about every five minutes while your browser is open, and when you open the popup.
  • The key travels over HTTPS in a request header, never in a URL, and the extension never logs it.
  • It has no access to your browsing: no history, no page content, no tabs. It does not run on the websites you visit.

What we keep on our side

  • API keys are stored only as one-way hashes, so a copy of our database does not contain usable keys. A key's name is stored encrypted.
  • There is no usage record. We do not log when a key is used or how often.
  • Rate limits are counted in memory and never written down. Repeated attempts with a wrong key count toward the same abuse protection as failed sign-ins, keyed by a hashed IP address, never the address itself.

Notifications that don't give anything away

Notifications can appear on a locked screen or in a notification history long after you have read them. So they show a number only, such as "2 new emails across 2 identities". They never include identity names, senders, subjects or message content. They stay off until you switch them on in the extension's settings, and only then does the extension ask your browser for permission.

Set it up in a minute

  1. Create an API key under Dashboard → API access. Inbox statistics is the only permission it needs.
  2. Install the extension for Chrome or Firefox. Edge and other Chromium browsers can use the Chrome version.
  3. Paste the key and press Connect.

Use one key per device or browser. If you stop using one, revoke its key without affecting the others.

FAQ

Does the extension sign me in to AccountProxy? No. It never creates a session or holds anything that could. Opening AccountProxy from the extension is just a link: you sign in on the site with your Account ID, as always.

Can the extension read my email? No. The key it uses can only fetch counts.

What happens if I lose my laptop? Revoke that device's key under API access. Whoever has the laptop then sees nothing new, and the key never gave them a way into your account.

Is it required? No. The extension is optional. Everything works the same without it.

For the full details, see our Privacy Policy and Privacy by design.