Polymail Read Receipts: Is Polymail Tracking Your Email?

If a founder or sales rep emailed you from Polymail, there is a decent chance a small lightning bolt in their Sent folder turned blue the moment you opened it. Polymail read receipts are the product's core selling point, and Polymail email tracking goes further than opens: it logs the links you click and the attachments you download, then streams all of it into a live feed on the sender's screen. We read Polymail's help centre and privacy policy, checked its DNS and certificates, and pulled archived copies of its tracking URLs on 25 September 2026. You never agreed to any of it, and you get no notice when it happens. You can still stop most of it.

Key Takeaways

• Polymail's privacy policy, effective May 31, 2025, says its service can monitor "who opened them, forwarded them, what links they click on and attachments they download."
• share.polymail.io serves Polymail's open pixel at paths shaped like /v2/z/a/<id>/<token>.png, and an Internet Archive copy captured on 23 August 2026 is a 68 byte, 1 by 1 PNG.
• Polymail rewrites tracked links into share.polymail.io/v1/z/b/ redirects and hosts tracked attachments behind share.polymail.io/v1/z/f/ download links.
• Gmail's image proxy hides your location from Polymail, but Google says senders "may know whether you've opened an email that has an image."
• Polymail's own Settings include a "Block tracking" option that detects and blocks trackers in incoming mail, which is an admission that recipients have a reason to want one.

Is Polymail Still Operating in 2026?

Yes. Polymail is a live, paid email client for Mac, Windows, iOS and the web. Its pricing page lists a Basic plan at $10 a month with "Email tracking and activity feed" and up to 2 connected accounts, a Premium plan at $24 a month with up to 20 connected accounts and automated sequences, and a custom Enterprise tier with Salesforce integration. Both paid tiers offer a 7 day free trial. The homepage calls it "The Power Inbox Purpose-Built for Deal Makers" and promises "read tracking, follow ups, and scheduling built directly into email."

The company is not coasting either. Its download page describes a path "From YC beginnings to a thoughtful rebuild in 2025," Apple's App Store shows the iOS app at version 1.129, released on 22 September 2026, and Polymail's servers picked up fresh TLS certificates throughout August and September 2026 according to Certificate Transparency logs. Unlike MailTag, which went dark in 2026, Polymail's tracking pixels are still being served today.

What Does a Polymail Read Receipt Tell the Sender?

A Polymail read receipt tells the sender that you opened their email and exactly when, and it can repeat that alert every time you reopen it. According to Polymail's email tracking help article, the sender clicks a lightning bolt icon while composing, gets notified "the first time your email is opened," and "can also opt to receive notifications every time the email is opened." The icon turns blue after you read it.

The read tracking article fills in the rest:

• Per message toggle. Senders can switch tracking on or off for each email by hovering over the lightning bolt, and set a default in their settings. The docs do not say whether that default ships switched on.
• Activity Feed. Included in every plan, it gives the sender a live stream of how recipients engage, "showing opens, link clicks, and attachment downloads."
• Hover details. Hovering over the bolt in the Sent folder shows "who opened the email and when."
• Sequences. On Premium and Enterprise, the Sequences dashboard reports open rates, link clicks, attachment downloads and reply status across automated campaigns of up to 20 stages.

You do not need to use Polymail for any of this to work. Polymail's help centre answers that question in three words: "No, they don't!" Tracking "works no matter what email client your recipient uses." The privacy policy adds one more verb the help docs leave out. It lists "forwarded them" among the behaviours Polymail can monitor, and describes email tracking as a feature that shows the sender the status of sent mail without any notification to the recipient.

Where Does the Polymail Tracking Pixel Live?

Polymail's open pixel lives on share.polymail.io, under paths shaped like /v2/z/a/<id>/<token>.png. The privacy policy explains the method in plain terms: "The function of tracking an email is performed by embedding a tracking pixel in the sent email and detecting when a network request has been made to load that pixel." It does not name the host, so we went looking.

The open pixel

The Internet Archive holds 304 distinct captures of share.polymail.io URLs under /v2/z/a/, spanning 2017 to 2026, and all but three truncated entries end in .png. We downloaded the archived copy of one captured on 23 August 2026: it is a PNG image, 1 by 1 pixel, grayscale with transparency, 68 bytes. A 2021 capture from a second host, welovepg.polymail.io, uses the identical path and returns the identical file. That is a textbook spy pixel. The same path is already listed as a Polymail tracker in AdGuard's mail tracking filter and in several open source tracker lists.

Tracked links and tracked attachments

Clicks go through a different path. The policy says "Click throughs can be tracked by proxying sent links through Polymail's servers." The Archive holds more than 500 distinct share.polymail.io URLs under /v1/z/b/, most of which answer with an HTTP 302 redirect; the archived copy of one captured on 4 January 2026 forwards to an ordinary company homepage. Tracked attachments sit under /v1/z/f/, and archived captures from 2025 serve PDF files straight from Polymail's server. That matches the attachment tracking article, which says "Tracked attachments are hosted in the cloud" and open "through a link in the browser," so the sender sees who downloaded the file and when.

What the live servers say

On 25 September 2026, share.polymail.io and welovepg.polymail.io both resolved to Cloudflare addresses, and both answered their root with the same JSON banner: {"code":3.14159265359,"description":"We ♥️ PG"}. As a control, a made up subdomain returned no address at all (NODATA from Cloudflare's name servers, not a wildcard). A made up pixel ID under /v2/z/a/ returned the same JSON 404 as a nonsense path, so a live probe alone cannot prove the pixel route; the archived captures do that. We deliberately did not request any real tracking URL, because doing so would log a fake open against someone's email. CertSpotter shows a fresh certificate for share.polymail.io issued on 1 September 2026, so the host is actively maintained.

Why Won't You Find a Bulk Email Platform Behind It?

Because Polymail sends through the sender's own mailbox. Polymail describes itself as an email client, and its rate limits article says it "must follow these rules too," quoting Gmail at 500 emails a day and Google Workspace at 2,000 (500 for new or trial accounts). Sequences use a "Send From" connected address. A tracked Polymail message therefore arrives from Gmail or Outlook servers with the rep's normal signature and passes SPF and DKIM for their own domain. Nothing in the headers flags a campaign tool; the only giveaway is inside the HTML.

Polymail's own company mail is a separate matter. The polymail.io SPF record authorises Google plus two fixed IP addresses, its MX records point at Google, the bounce subdomain pm-bounces.polymail.io is a CNAME to Postmark's pm.mtasv.net, DMARC reports go to a Postmark address, and a Brevo verification token sits in the root TXT record. We cover what those two platforms do with opens in Is Postmark Tracking Your Email? and Is Brevo Tracking Your Email?.

How Can You Tell a Polymail Tracked Email?

Look for share.polymail.io in the message source or behind its links. Three quick checks work in Gmail on the web:

• Show original. Open the message, click the three dot menu, choose Show original, then search the page for polymail.io. An image tag pointing at share.polymail.io/v2/z/a/ is the open pixel.
• Hover over links. If the status bar shows share.polymail.io/v1/z/b/ instead of the site named in the text, the click gets logged before you reach the page.
• Check attachments. A file that arrives as a link to share.polymail.io/v1/z/f/ rather than a real attachment is a tracked download.

None of these markers are guaranteed on every Polymail email, since the sender can switch tracking off per message. Their absence means that particular email is clean, not that the sender never tracks.

Does Gmail's Image Proxy Stop Polymail?

No, it only blurs the details. Google's Gmail image help page says its scanning means "Senders can't use image loading to get information about your computer or location," and in the next breath admits that "Sometimes, senders may know whether you've opened an email that has an image." Gmail fetches the pixel from its own servers, so Polymail sees a Google address instead of yours. The request still happens, and the lightning bolt still turns blue. Gmail does nothing about the share.polymail.io link redirects or attachment links either, because those fire only when you click.

Polymail Sells a Tracker Blocker Too

The most revealing line in Polymail's documentation is not about tracking. It is about blocking. A help article titled Preventing people from tracking you says "Polymail now detects and blocks email tracking on your incoming messages to prevent senders from knowing when you've opened their emails!" and shows a green check mark on protected mail. "Email Tracking Blocker" appears as a line item on the pricing page, and the privacy policy says remote images are "proxied through our servers for enhanced privacy and security."

So the same subscription that lets a rep watch you read their pitch also shields the rep from being watched by everyone else. That asymmetry is the whole business model of sales email tools: Superhuman, Spark and Newton made similar trade offs. A vendor does not build a tracker blocker for its own paying customers unless it believes tracking is something a reasonable person would want to stop. The recipient on the other end deserves the same option, and the tool that offers it just has to sit in their inbox, not the sender's.

What This Means for Your Inbox

Polymail pitches itself to "founders, operators, and revenue teams," which describes the people most likely to email you about a deal, a job or an investment. Read timing is leverage in those conversations. A rep who sees you reopen a proposal three times knows when to call. A founder who sees a PDF downloaded twice knows the deck got forwarded internally, and the policy's "forwarded them" wording suggests Polymail may try to surface that too.

Scale is the other half. Premium allows 20 connected accounts, and Polymail's own figure for Gmail is 500 sends a day per account. That puts the theoretical ceiling at 10,000 tracked emails a day from a single $24 seat, or 40,000 on established Google Workspace accounts at 2,000 each. Few people hit that, but it shows this is not a one to one courtesy feature; it is outreach infrastructure. The broader landscape of these tools is mapped in our guide to email tracker Chrome extensions, and European regulators have started asking for consent to open tracking, as covered in France's 90 day ultimatum to email marketers.

How Do You Block Polymail Tracking in Gmail?

You block the pixel before it loads and route clicks around the redirect. Free options first:

• Turn off external images. In Gmail, go to Settings, See all settings, scroll to Images and choose "Ask before displaying external images". This stops the share.polymail.io pixel along with every newsletter image, until you click "Display images below." It does nothing for links.
• Hover before you click. If a link points at share.polymail.io/v1/z/b/, copy the visible destination and type it yourself when you can.
• Ask for a real attachment. A tracked file only reports when you open its link. Replying for a normal attachment is awkward but effective.

Extensions do this automatically. An honest look at what exists in September 2026:

• Ugly Email. Open source, flags tracked mail with an eye icon. The Chrome Web Store link on its own website now opens an empty listing, so in practice it is a Firefox add on, and that version was last updated on 6 March 2024.
• PixelBlock. About 40,000 Chrome users, last updated on 2 December 2025. Focused on blocking pixels rather than links.
• Trocker. Version 3.4.1, updated on 10 July 2026, for Chrome and Firefox. Blocks pixels, warns about click tracked links, and runs in Gmail, Yahoo and Outlook.com.
• Polymail itself. Switching to Polymail as your own client gets you its tracker blocker, but it means moving your inbox out of Gmail's interface and into a paid app.
• Gblock. Stays inside Gmail. Its built in blocklist already carries a polymail.io rule for image requests, so the share.polymail.io pixel is blocked before it loads, and the list updates automatically from Gblock's servers when trackers change hosts. Links are routed through Gblock's own proxy, which resolves the redirect away from your browser. One honest limit: that hides your IP address and device, but Polymail's server can still log that a click happened.

A deeper comparison of the free three lives in our Ugly Email, PixelBlock and Trocker guide, and the full playbook is in how to block email tracking in Gmail.

What We Could Not Verify

We did not capture the raw source of a live Polymail email in September 2026, so the pixel and link paths come from Internet Archive captures, the most recent from August 2026, read against Polymail's own description of its method. Polymail's current docs do not say whether read tracking is on by default for new accounts, and they do not say whether senders see a device or location for each open, so we make no claim either way. We could not confirm how Polymail detects forwarding. A third subdomain, views.polymail.io, resolves but returned a Cloudflare 525 error on 25 September 2026, so we do not know what it serves.