Why Sending Files Over Email Is Less Private Than You Think

Email feels private. You're typing to a specific person, it goes to their inbox, and that seems like a controlled transfer. The reality is that an email attachment travels through more infrastructure, gets stored in more places, and persists for longer than almost any other file transfer method. Let me walk through what actually happens.

The Journey of an Email Attachment

When you send an email with a file attached, here's what actually happens:

Also readSafe Alternative to Sharing Files Over Email →

1. Your email client packages the attachment using MIME encoding and sends it to your email provider's outgoing mail server (SMTP)
2. Your provider's server stores the message — including the full attachment — in their infrastructure
3. The server looks up the recipient's mail server (MX record lookup) and transmits the email via SMTP
4. The message traverses potentially several relay servers depending on routing, each of which may log the connection
5. The recipient's mail provider receives and stores the message — full attachment — in their infrastructure
6. The recipient downloads it to their client — but the copy on the server remains

The result: your file now exists in at least two completely separate organizations' infrastructure (your mail provider and theirs). Gmail imposes a 25MB attachment limit, meaning larger files require an additional workaround., and depending on relay routing, potentially more. Both copies persist until someone actively deletes them — often indefinitely, because email providers typically keep messages until the user deletes them, and deleted messages go to Trash, which auto-empties after 30 days by default on Gmail.

What Email Providers Do With Your Attachments

Gmail

Google scans Gmail content — including attachments — for malware, spam classification, and historically for ad targeting (Google stopped using Gmail content for ad targeting in 2017, but still scans for safety and Smart Reply features). Your file attachment is processed by Google's systems. Google also retains the right to analyze content to improve their services per their Terms of Service.

Outlook / Microsoft 365

Microsoft scans email content and attachments for malware and policy violations. Enterprise accounts with Microsoft Purview have extensive email retention and compliance features — which means your sent attachments may be retained in compliance archives even if you delete them, depending on your organization's settings.

Free Email Services Generally

Free email services are funded by advertising. Even if they no longer scan content for ad targeting, the behavioral data around email (who you communicate with, how frequently, what kinds of attachments) informs targeting profiles. Your email metadata is a rich behavioral dataset even without reading the content.

The Forwarding Problem

Once you send an email attachment, you have zero control over what happens to it. The recipient can forward it to anyone, attach it to another email chain, save it to a shared folder, or accidentally include it in a reply-all. You have no way of knowing any of this happened, no way to revoke access, and no way to know how many people ultimately have a copy.

For truly sensitive files, this forwarding problem is significant. A confidential document shared via email can propagate through an organization — or beyond it — without any visibility to the original sender. The EFF's Surveillance Self-Defense guide explains how email's architecture makes it a particularly weak channel for sensitive communications.

Email Encryption: Better but Not the Whole Story

TLS encryption between mail servers protects the message in transit from eavesdropping. But most people use "email encryption" to mean this transit encryption — which doesn't address the storage problem. Your file still sits, decryptable, on both providers' servers.

📧Related guideHow to Send Files Privately Online→

True end-to-end email encryption (PGP/GPG, S/MIME) encrypts the message so only the recipient's private key can decrypt it. This is significantly stronger — the provider stores ciphertext they can't read. But PGP has notoriously poor usability, and S/MIME requires certificate management that's beyond most users. In practice, almost no casual email communication uses true E2E encryption.

How encrypted File Transfer Compares

When you use Zapfile instead of email for sending a file, the architecture is fundamentally different:

• No persistent storage: The file is staged temporarily on Cloudflare R2 and permanently deleted the moment the recipient downloads it. No copy remains on any server after the transfer completes.
• Automatic expiry: When the download completes, the link is gone. There's no persistent copy sitting in a sent folder and a received folder on two different servers.
• No forwarding: There's no attachment to forward. Once the recipient downloads the file, the transfer is complete — they have a file on their device, not an email they can forward with the attachment.
• No scanning after delivery: Files deleted immediately after download can't be scanned afterward — the content is gone before any analysis could run.

Email is the right tool for communication. For actually transferring files — especially sensitive ones — it has structural privacy weaknesses that purpose-built transfer tools don't share. That's not a criticism of email; it was designed for messages, not for confidential document delivery.

Also readHow to Avoid Cloud Leaks When Sharing Files →

When Email Is Fine for Files

To be fair: for non-sensitive files, the email attachment model is convenient and good enough. Sending a dinner party invitation PDF, a resume to a recruiter, a photo of your dog — the privacy considerations above don't materially matter for these.

Where it matters: contracts, financial documents, personal medical information, unreleased designs, proprietary business data, anything you'd be uncomfortable seeing screenshotted and shared publicly. For those, the combination of multiple server copies, no expiry, and no forwarding control is a genuine problem worth solving differently.