Privacy Policy

Last updated: July 28, 2026

Everything that can run locally, runs locally — for everyone, forever. Folder sorting, rules, suggestions, smart folders, snooze, analytics, and the network graph all execute entirely inside your browser. Your emails are read via Google's Gmail API with the read-only scope, cached only in your browser's local extension storage, and never sent to us or anyone else.

Exactly two optional Premium features use an Email Elysium server, because they cannot work without one: open tracking and meeting scheduling. Both are off by default, require your explicit opt-in, and are described precisely below. If you never enable them, this extension makes no network connections other than to Google.

What runs 100% locally (free and premium alike)

Email metadata sync (Gmail API, gmail.readonly scope only — the extension cannot send, modify, delete, or label your mail; Google rejects write calls at the API level)
Folder classification, rules, rule suggestions, smart folders (Urgent / Needs reply / Awaiting reply), snooze, unsubscribe surfacing, analytics dashboard, network graph
All of the above store data only in chrome.storage.local on your device. Uninstalling the extension deletes it.

Payments (Premium)

Payments are processed by ExtensionPay (extensionpay.com) and Stripe. We never see your card details. The extension contacts extensionpay.com only after you click "Upgrade" or "Restore purchase" — a free install that never clicks those buttons makes zero requests to it. What ExtensionPay stores about you is governed by their privacy policy.

Optional server features (Premium + explicit opt-in, off by default)

If — and only if — you enable them, these features talk to our server (a Cloudflare Worker):

Open tracking. When you switch "Track opens" on for a specific email, an invisible tracking pixel is added to that email. When a recipient's mail client loads the pixel, our server records: the pixel's random token, the time, the user-agent string, and a keyed cryptographic hash of the IP address (never the raw IP). We never receive the email's content, subject, or recipient list — only a random token and, where available, a Gmail thread identifier. Tracking is per-email: nothing is tracked unless you switch it on for that message.

Meeting scheduling. If you set up a booking page, our server stores your display name, chosen page handle, weekly availability window, and timezone. When someone books a slot, it stores the time, their name, the email address they enter, and an optional note — the minimum needed to hold the booking.

Both features are keyed by a random installation identifier that contains no personal information. Disabling a feature stops all associated network activity immediately.

What we never do

No analytics, telemetry, fingerprinting, or usage tracking of you
No AI/model calls; no email content ever leaves your browser
No selling, sharing, or transferring of data to third parties
No Gmail write scopes — ever

Google user data we access, and what we do with it

What we access. Using the gmail.readonly scope we read message metadata only — every Gmail API call is made with format=metadata, requesting exactly these headers: From, To, Subject, Date, List-Unsubscribe and List-Unsubscribe-Post — plus Gmail's message id, thread id, label ids, internal date and the short preview snippet Gmail returns. We also read your own email address once, via the Gmail profile endpoint, so the extension can tell which messages you sent. We never request message bodies or attachments.

How it is used. Solely to provide the user-facing features you can see: sorting messages into your folder tree, running your rules, generating rule suggestions, computing the Urgent / Needs-reply / Awaiting-reply smart folders, snooze, unsubscribe surfacing, the local analytics dashboard and the network graph. All of this computation happens inside your browser.

Aggregated and derived data. The folder assignments, counts, charts and graph layouts the extension derives from your mail are also stored only on your device and are never transmitted anywhere.

Transfer. Neither raw nor aggregated/anonymized Google user data is ever transmitted to Email Elysium's servers, sold, or shared with any third party — including advertisers, data brokers, or AI/ML providers. It does not leave your browser.

How your data is protected

Gmail data is stored in chrome.storage.local, inside Chrome's extension sandbox on your own device — not on our servers.
Your Google OAuth token is held only in the extension's service-worker context. It is never exposed to the Gmail web page, to content scripts, or to any third-party script, and it is never transmitted to us.
All Gmail API traffic goes directly from your browser to Google over HTTPS/TLS.
The extension has a strict, exhaustive network allowlist enforced in its manifest: Google's APIs, and — only for the two opt-in Premium features — extensionpay.com and our own Cloudflare Worker. It cannot contact anything else.
The optional Premium server (Cloudflare Worker + D1) never receives Gmail content, subjects, or recipient lists. Requests are authenticated with a random 128-bit install key, served over TLS, and visitor IPs are stored only as a keyed cryptographic hash, never in raw form.
You can revoke the extension's access at any time from the Disconnect button in the extension's toolbar popup, or from your Google Account permissions page; the cached token is discarded immediately.

Data retention & deletion

The local email index is capped at your most recent 1,000 messages — older entries are dropped automatically as new mail arrives.
All local data is erased when you uninstall the extension, and can be erased at any time from the in-app Full wipe control.
Revoking access (above) stops all further Gmail data collection immediately.
Server-side data exists only if you opted into a Premium server feature. Email us at [email protected] with your booking-page handle or the email used at purchase and we will delete it within 30 days.

Limited Use disclosure

Email Elysium's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

AI/ML. Email Elysium contains no AI or machine-learning models and makes no calls to any AI service. Rule suggestions and smart-folder flags are produced by local pattern matching in your browser. Raw or derived Google user data is never used to develop, improve or train any AI/ML model, and is never transferred to any third-party AI/ML service.

Contact

Questions or deletion requests: [email protected], or open an issue at github.com/AP-1120/email-elysium.