On: I've spent the last two years building a new email client

[alimbada]

You can do the same in your browser by opening the developer tools and in fact it comes built in to the browser whereas on a desktop you'd have to install another app like Wireshark/Fiddler to see those requests.

[stephenr → alimbada]

That only tells you what your browser sends to their server. It doesn't tell you what connections their server makes.

[crystaln → stephenr]

Nothing will. The vulnerability of what happens to your data after it is sent to a third party is the same for any app, web or native.

The biggest difference is that it's way easier to see where you're data is being sent in a browser, since it has built in tools. It's very hard to monitor native app traffic that is sent over SSL.

[stephenr → crystaln]

When the app is native there no requirement for a third party server.

You, Your mail (provider) server.

Vs

You, the server hosting the web app, your mail (provider) server.