NadeemiBeta

Link Previews and Privacy: Who Actually Opens the Link You Send in a Chat?

By The Nadeemi team · Checked on

Part of: Encryption basics, without the jargon

Checked against Signal's own blog, the 2020 Mysk research and press coverage, 6 November 2026. Apps change; check the date.

You paste a news link into a chat and a neat card appears: headline, photo, site name. It looks harmless. But to build that card, some computer has to open the link. Which one it is decides who learns what, and this week's news is a reminder that links are watched: in late October 2026 Bluesky began blocking links to the DDoSecrets site that hosted leaked US government staff data, which shows that platforms inspect the links people share.

Short answer: There are three ways to make a link preview. The sender's phone fetches it (the site sees the sender's IP address). The app's servers fetch it (the company sees every link you share, and the site sees the company). The receiver's phone fetches it (anyone can learn your IP address just by sending you a link). The most private designs fetch through a proxy and carry the finished preview inside the encrypted message, so the receiver never fetches anything.

The three designs, and what each one leaks

Who fetches the pageWhat leaksWho does it (as reported)
The sender's device, directlyThe site sees the sender's IP address and device; nothing leaks about the receiverWhatsApp, iMessage (sender side, per the Mysk research)
The sender's device, through a proxyThe site sees the proxy, not the sender; the proxy operator may or may not see the linkSignal (TLS through a proxy, so Signal never sees the URL)
The company's serversThe company sees every link you share, including links in "private" chats; the site sees the companyInstagram, Facebook Messenger, LinkedIn, Slack, Discord, X (2020 research)
The receiver's deviceAnyone can send you a link to a server they control and learn your IP address (roughly where you are)Some apps in 2020; a known anti-pattern

Sources: Signal blog, "I link therefore I am" (6 Feb 2019), MacRumors on the Mysk research (26 Oct 2020), The Hacker News on the same research.

Why the receiver must never fetch

If the person you message opens the link automatically to draw a card, then sending someone a link to a page you control is enough to see their IP address. That is roughly their city and their internet provider. The 2020 research by Talal Haj Bakry and Tommy Mysk showed this kind of leak and also found that some company servers downloaded huge files (Instagram reportedly pulled 2.6 GB for one preview) or even ran JavaScript from the link. After that report, Facebook stopped generating link previews in Messenger and Instagram for users in Europe (MacRumors, 9 Feb 2021).

What Signal does

Signal's design (2019) is the strictest we know. Your phone opens a connection through a privacy proxy, so the site does not see your IP address; the TLS session goes directly from your phone to the site, so Signal's servers never see the URL. Previews are made only for HTTPS links, you can turn them off in Privacy settings, and you can remove a single preview with the X before sending. When the feature launched, it covered a short list of sites (Imgur, Instagram, Reddit, YouTube); Signal said it might add more.

Server-side previews are convenient: the card appears even if your phone is slow. The cost is that the company learns every link you share in chats, which, for news, health or legal links, says a lot about you. And because the server opens anything you paste, it has to be protected against tricks such as links that point at the company's own internal network (a class of attack called server-side request forgery, or SSRF).

Nadeemi is the app we build, so weigh this section accordingly. We wanted previews without the two worst leaks, so:

  1. Turn previews off where you can (Signal: Settings > Privacy > Generate link previews).
  2. Remove the preview before sending sensitive links (most apps show an X on the card).
  3. Be careful with links from strangers, even in message requests: opening them, not just the preview, reveals your IP address to the site.
  4. For very sensitive links, send the address without "https://" or with a space, so no app turns it into a card.

FAQ

Can someone get my IP address by sending me a link? Only if your app fetches link previews on the receiver's side, or if you open the link. Signal, WhatsApp and Nadeemi do not fetch previews for links you receive.

Does WhatsApp see the links I send? WhatsApp messages are end-to-end encrypted. According to the 2020 research, WhatsApp's preview is generated on the sender's phone, so the site you link to sees the sender's IP address.

Are link previews dangerous? They are a small privacy leak, not malware by themselves. The risk depends on who fetches the page: the sender, a proxy, the company's server or the receiver.

Can I turn off link previews in Nadeemi? Yes: Settings > "Link previews for links I send". You can also tap "No preview" under the message box for a single message.

Sources (checked 6 November 2026)

Names of other apps are trademarks of their owners, used only for comparison. Nadeemi is not affiliated with any of them.

Drafted with AI help and checked by a person on the date above.

Keep reading

Try Nadeemi freeNo ads · no phone number