FOLD Documentation
Early access
Security and privacy

Links, HTML and attachments

How FOLD displays HTML mail, blocks tracking content, checks links before opening them, and marks saved attachments.

HTML mail can carry scripts, tracking pixels and disguised links. FOLD treats every message as untrusted.

How HTML is displayed

Before display, FOLD cleans the HTML and keeps only known, harmless elements and attributes. The result is shown in a restricted web view:

  • JavaScript from the message never runs.
  • A content security policy blocks every external resource: images, stylesheets, fonts, frames and form submissions.
  • Link previews on long press or force click are off, because they would load the page in the background.
  • Media does not play automatically.
  • Nothing persists: no cookies, no cache, no local storage.

Images embedded in the message itself are shown.

External images

External images are blocked by default, because loading them tells the sender whether and when you opened the message. A bar tells you that external images were blocked; on the Mac it also shows how many.

  • Load images loads them for this message only. Only images are allowed then; all other restrictions stay.
  • On the Mac, FOLD then asks Always load images from this sender? Choose Load automatically or Just this time. For senders on this list, a note Images loaded automatically appears, with Turn off to undo it.

Clicking a link opens Open link? with the full, real address, so a link text cannot hide where it leads. FOLD checks the address on the device and names what looks suspicious:

  • an unencrypted connection (http),
  • an IP address instead of a domain,
  • credentials in the address,
  • a domain with special characters that can imitate another,
  • an unusual number of subdomains.

Open in browser passes the link to your default browser; Copy address copies it. Links to javascript:, data:, file: or vbscript: are never opened. Links to email addresses open FOLD’s own compose window.

FOLD can also compare links with a blocklist stored on the device, without any network request. It does not ship or download such a list yet, so today the warnings come from the checks above.

On the Mac you can turn off the confirmation under Settings (⌘,) > Security > Link protection; dangerous link types stay blocked. On iPhone and iPad the confirmation is always on.

Attachments

On the Mac, attachments you save are marked as downloaded from the internet. macOS Gatekeeper then checks apps and scripts among them before they run for the first time.