diff --git a/server.js b/server.js
index fcb4872..931f3b3 100644
--- a/server.js
+++ b/server.js
@@ -79,7 +79,7 @@ app.use(function(req, res, next) {
     res.set('Strict-Transport-Security', 'max-age=16070400; includeSubDomains');
     // CSP
     var iframe = development ? "http://" + req.hostname + ":" + port : "https://" + req.hostname; // allow iframe to load assets
-    res.set('Content-Security-Policy', "default-src 'self' " + iframe + "; object-src 'none'; connect-src *; style-src 'self' 'unsafe-inline' " + iframe + "; img-src 'self' data:");
+    res.set('Content-Security-Policy', "default-src 'self' " + iframe + "; object-src 'none'; connect-src *; style-src 'self' 'unsafe-inline' " + iframe + "; img-src *");
     // set Cache-control Header (for AppCache)
     res.set('Cache-control', 'public, max-age=0');
     next();
diff --git a/src/index.html b/src/index.html
index 0771090..d0a577f 100644
--- a/src/index.html
+++ b/src/index.html
@@ -5,7 +5,7 @@
     <title>Whiteout Mail</title>
 
     <!-- Theses CSP rules are used as a fallback in runtimes such as Cordova -->
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self' chrome-extension: file: gap:; object-src 'none'; script-src 'self' 'unsafe-eval' chrome-extension: file: gap:; connect-src *; style-src 'self' 'unsafe-inline' chrome-extension: file: gap:; img-src 'self' chrome-extension: file: gap: data:">
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self' chrome-extension: file: gap:; object-src 'none'; script-src 'self' 'unsafe-eval' chrome-extension: file: gap:; connect-src *; style-src 'self' 'unsafe-inline' chrome-extension: file: gap:; img-src *">
 
     <!-- iOS homescreen link -->
     <meta name="apple-mobile-web-app-capable" content="yes">