When the first tab on your website is "Privacy", don't make "Read notifications" the default.

From the http request you're taking all kinds of metadata to your server. I don't want to add my PGP key in here to check, but I assume this is default for PGP messages too?