Legal
Privacy Policy
Your emails stay on your device. Here's exactly how OpenMSG handles your data.
Last updated: 12 July 2026
This Privacy Policy explains how Corporate App Works Pty Ltd (ABN 82 698 098 369) of Victoria, Australia ("Corporate App Works Pty Ltd", "we", "us", "our") handles information in connection with:
- the OpenMSG desktop application for Windows (the "App");
- the website at openmsgviewer.com (the "Website"); and
- our support and licensing communications.
The short version: your emails stay on your device. The App opens .msg files entirely locally and never uploads email content, attachments, or message metadata to us or anyone else. The App does send us limited, pseudonymous usage analytics and crash reports (described in full below), and administrators can turn even those off.
1. Email files are processed locally
When you open a .msg file, all parsing and rendering happens on your device. The App does not transmit to us, and we do not collect:
- email bodies, subjects, or headers;
- sender or recipient names or addresses;
- attachments or their contents;
- file names or the contents of any file you open.
To display a message, the App extracts the email body, inline images, and attachments to a temporary folder on your device. These files stay on your device, and the App deletes them when it closes.
External content in emails. By default the App blocks external images and assets. If you choose to display external content, your device will connect to the relevant third-party server directly.
2. Usage analytics (telemetry)
Unless disabled (see Section 4), the App sends us small, pseudonymous usage events so we can understand how the App is used, prioritise fixes, and understand organisational usage for licensing purposes. Our analytics provider is PostHog (PostHog, Inc.), and events are processed on PostHog's United States infrastructure.
Each event contains:
| Data | Details |
|---|---|
| Pseudonymous device identifier | A randomly generated identifier created upon installation. This identifier contains no hardware details, cannot be reversed to identify your machine, and is reset if you completely uninstall and reinstall the App. |
| Session identifier | A random ID generated each time the App starts. |
| App version and OS version | e.g. 1.5.23, Microsoft Windows NT 10.0.19045.0. |
| Organisation domain (if detected) | The domain portion of your work sign-in (e.g. contoso.com). We use this to understand which organisations use the App, enforce licensing compliance (including detecting unauthorized Managed Service Provider sprawl, acquisitions, and domain consolidations), and protect our licensing revenue. |
| Event name and properties | Which feature was used, e.g. app launched/closed, attachment opened (with its file extension only, e.g. .pdf). |
Telemetry never includes email content, attachment content, file names, or your Windows username.
3. Crash reporting
Unless disabled, when the App encounters a serious error it sends a crash report to BugSplat (BugSplat, LLC) in the United States. A crash report contains exception types, stack traces, app versions, OS architecture (32/64-bit), and diagnostic notes. Crash reports may incidentally contain the name or path of the file that was being opened, or environment details within error messages, but never intentionally include email content.
4. Your choices and controls
- Registry / Group Policy opt-out. Administrators can fully disable analytics and crash reporting by setting
DisableTelemetryandDisableCrashReportingunderHKLM\SOFTWARE\Policies\OpenMSG. - Enterprise and Evaluation builds. In Enterprise and Evaluation builds of the App, analytics and crash reporting are permanently disabled. Because Enterprise builds transmit no analytics and no crash reports, Corporate App Works Pty Ltd receives and processes no personal data of end users of an Enterprise deployment.
- Deployment Liability. If your organization chooses to deploy the consumer version of the Software (which transmits telemetry) across an enterprise environment instead of the zero-telemetry Enterprise build, your organization assumes total liability for all resulting data protection and privacy compliance, as outlined in our Terms of Service.
5. Data stored only on your device
Temporary extraction files, App settings, and Windows Event Log entries (which may include file paths, your Windows username, and URI fragments for blocked links if enabled by your administrator) stay local to your device and are never transmitted to us.
6. Website
The Website is an informational site. Our hosting/CDN provider processes standard technical data (IP address, user-agent) in server logs for security and delivery.
The Website also uses PostHog (PostHog, Inc.) for privacy-focused web analytics so we can understand how visitors use the site. PostHog is configured with memory-only persistence (no cookies or localStorage), autocapture disabled, session recording disabled, IP address collection disabled, and person profiles limited to identified users only. This means we receive anonymous page view and page leave events with no ability to identify individual visitors. PostHog processes this data on infrastructure in the United States.
7. Support and licensing correspondence
If you email us (e.g. [email protected]), we receive your email address and correspondence to provide support, administer licences, and issue invoices. Please do not send us email files containing sensitive personal information.
8. Purposes and legal bases
Where privacy laws such as the GDPR (EU/UK) and the Australian Privacy Act 1988 (including the Australian Privacy Principles) apply, we process the data described above on these bases:
- Legitimate interests (Art. 6(1)(f)): pseudonymous analytics, maintaining and securing the App.
- Contract (Art. 6(1)(b)): processing billing details for commercial licences, and enforcing enterprise licensing compliance via organizational domain detection.
- Legal obligation (Art. 6(1)(c)): retaining tax records.
We do not sell or share personal information (as those terms are defined by the CCPA and similar US state laws), nor do we use it for automated decision-making. We do not knowingly collect information from children under 16; the App and Website are intended solely for general and business audiences.
9. Sharing and international transfers
We share data only with PostHog, BugSplat, and our hosting providers. Where data protected by EU/UK law is transferred internationally, we rely on appropriate safeguards.
10. Retention
Analytics events and crash reports are retained for a maximum of 24 months, after which they are deleted or aggregated. Support correspondence is retained while relevant and as required for tax and accounting compliance.
11. Security
Telemetry is transmitted over HTTPS. Access to our dashboards is restricted.
12. Your rights
Depending on your jurisdiction, you may have rights to access, correct, delete, or object to processing of your personal information. Contact us at [email protected]. Note that analytics data is pseudonymous and we may be unable to link a hashed device ID to your name.
13. Changes to this policy
We may update this policy from time to time to reflect changes in our legal obligations, data processing practices, or the App's features.
For Commercial License Holders:
For active commercial subscriptions and perpetual licences, the Privacy Policy in effect at the time of your purchase or last renewal governs your use for the remainder of your active term. Any material updates to this policy will automatically take effect upon your next subscription renewal or purchase of a support extension.
For Personal and Free Users:
Material changes will be highlighted on the Website (openmsgviewer.com) and within the App's update release notes. Continued use of the App following an update constitutes acceptance of the revised policy.
14. Contact
Corporate App Works Pty Ltd (ABN 82 698 098 369)
Victoria, Australia
Email: [email protected]
Website: https://openmsgviewer.com