Legal

Remote content in a message -- the images and other media its body references -- now has a stated rule. A message body loads nothing from the network while it is blocked, which is how every message starts. When the user allows remote content for one message, or for every message from a sender's domain, the app fetches the referenced assets itself over HTTPS and inlines them into the reading view, so that view holds no network reference of its own. The server that serves an asset sees the user's IP address, and the sender learns that the message was opened. A vector image, an image the size of a tracking pixel and an asset above the size ceiling are refused and shown as a placeholder; no redirect to a private or local network is followed; a request gives up after 10 seconds; what was fetched stays in memory for the session. Section 6.2(c) states all of it. Nothing else in either master changed.