Privacy Policy

This Privacy Policy describes how Supermail ("Company," "we," "us," or "our") collects, uses, and protects information when you use our browser extension and related services (the "Service"). We designed Supermail with privacy as a foundational principle. This policy explains our data practices in detail.

1. Our Privacy-First Architecture

Supermail operates on a client-side architecture. This means:

• Local Processing: Your email data is fetched directly from Google's servers to your browser and processed locally. Email content does not pass through Supermail servers.
• No Email Storage: We do not store copies of your emails on our servers. All email data remains within your browser session and Google's infrastructure.
• Minimal Permissions: The Chrome extension requests only the permissions necessary for functionality: identity (for OAuth), storage (for local preferences), and activeTab.

2. Information We Collect

2.1 Information You Provide Directly

Data Type	Purpose	Storage Location
Email address (for account)	Account identification and communication	Our servers (encrypted)
Subscription information	Billing and service tier management	Payment processor (Stripe)
Support communications	Customer service and issue resolution	Our support systems
Feedback and surveys	Product improvement	Our servers

2.2 Information Collected Automatically

Data Type	Purpose	Storage Location
Usage analytics (anonymized)	Product improvement, feature usage patterns	Analytics provider
Error logs	Debugging and service reliability	Error tracking service
Feature usage counts	Credit tracking, rate limiting	Our servers

2.3 Information Stored Locally in Your Browser

The following data is stored in your browser's local storage and Chrome extension storage. This data never leaves your device:

• User preferences and settings (theme, keyboard shortcuts, display options)
• Cached contact information for autocomplete functionality
• Trusted contacts and domains list
• Draft email content (auto-saved locally)
• Reminder and snooze schedules
• OAuth access tokens (managed by Chrome)

2.4 Information We Do Not Collect

• Email content, subject lines, or attachments
• Email metadata (sender addresses, recipient addresses, timestamps) beyond what is needed for feature functionality
• Your Google account password
• Contacts not cached locally for your autocomplete
• Calendar event contents (processed locally)

3. How We Use Information

3.1 Service Operation

• Authenticating your access to the Service via Google OAuth
• Managing your subscription and billing
• Tracking feature usage for credit-based features
• Sending transactional communications (receipts, subscription updates)

3.2 Service Improvement

• Analyzing anonymized usage patterns to improve features
• Identifying and fixing bugs through error logging
• Understanding which features are most valuable to users

3.3 Security

• Detecting and preventing fraudulent or unauthorized use
• Monitoring for abuse of the Service
• Protecting the security and integrity of the Service

4. AI Features and Data Processing

4.1 How AI Features Work

Supermail offers optional AI-powered features including email composition assistance, reply suggestions, threat analysis, and promise tracking. These features utilize Anthropic's Claude AI for processing.

4.2 Data Transmitted for AI Features

When you use an AI feature, the following may be transmitted to Anthropic:

• Relevant portions of email content (subject, body text)
• Your custom instructions or prompts
• Selected tone preferences
• Thread context (if you opt to include it)

4.3 AI Provider Data Practices

Supermail uses Anthropic's Claude AI exclusively. Your data transmitted to Claude is subject to Anthropic's usage policies and data handling practices. We recommend reviewing Anthropic's Privacy Policy for details on how they handle data.

4.4 Security Scanning and AI

The Service includes a tiered security system:

• Quick Scan (Local): Heuristic-based scanning runs entirely in your browser without transmitting data externally.
• Deep Scan (AI-Assisted): When you request a deep scan, or when auto-scan is enabled for premium users, email content is analyzed using Claude AI. This requires transmitting relevant email content to Anthropic.

5. Third-Party Services

5.1 Google APIs

The Service integrates with Google APIs (Gmail API, Calendar API) to provide core functionality. Your use of these integrations is subject to Google's Terms of Service and Privacy Policy. We access your Google data only to provide the Service's features and in accordance with Google's API Services User Data Policy.

5.2 Payment Processing

Subscription payments are processed by Stripe. We do not store complete credit card numbers on our servers. Stripe's handling of payment information is subject to Stripe's Privacy Policy.

5.3 Analytics

We use analytics services to understand how the Service is used. Analytics data is aggregated and anonymized. We use Google Analytics for website analytics, which is subject to Google's Privacy Policy.

6. Data Security

6.1 Security Measures

We implement technical and organizational measures to protect information, including:

• HTTPS encryption for all data transmission
• OAuth 2.0 for secure authentication (no password storage)
• Encryption of sensitive data at rest
• Regular security assessments
• Access controls limiting employee access to user data
• Secure coding practices

6.2 Client-Side Security

Because email processing occurs in your browser:

• Email data benefits from Chrome's sandboxing and security features
• Tokens are managed by Chrome's identity API
• Local storage is protected by browser security mechanisms

6.3 Incident Response

In the event of a data security incident affecting your personal information, we will notify affected users in accordance with applicable law.

7. Data Retention

7.1 Account Data

We retain account information for as long as your account is active. Upon account deletion, we will remove your personal information from our systems within 30 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention, legal claims).

7.2 Local Data

Data stored locally in your browser (preferences, cached contacts, drafts) persists until you clear browser data, uninstall the extension, or explicitly delete it through the Service's settings.

7.3 Analytics Data

Anonymized analytics data may be retained indefinitely as it cannot be linked to individual users.

8. Your Rights and Choices

8.1 Access and Portability

You may request a copy of the personal information we hold about you by contacting us at the address below.

8.2 Correction

You may update your account information through the Service or by contacting us.

8.3 Deletion

You may request deletion of your account and associated personal data. Note that this does not affect data stored locally in your browser or data held by third parties (Google, AI providers, payment processors).

8.4 Revoke Google Access

You may revoke the Service's access to your Google account at any time through your Google Account security settings. This will prevent the Service from accessing your Gmail and Calendar data.

8.5 AI Feature Opt-Out

You may disable AI features entirely through the extension settings. When disabled, no email content is transmitted to Anthropic.

8.6 Analytics Opt-Out

You may opt out of analytics tracking through browser settings or by using browser extensions that block analytics scripts.

9. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

10. International Data Transfers

If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. By using the Service, you consent to such transfers. We ensure appropriate safeguards are in place for international transfers in compliance with applicable data protection laws.

11. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected.
• Right to Delete: You may request deletion of your personal information.
• Right to Opt-Out: We do not sell personal information. If this changes, you will have the right to opt out.
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact us at the address below.

12. European Privacy Rights

If you are located in the European Economic Area (EEA) or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis: We process your data based on consent (for AI features), contract performance (to provide the Service), and legitimate interests (for security and improvement).
• Right to Object: You may object to processing based on legitimate interests.
• Right to Restrict: You may request restriction of processing in certain circumstances.
• Right to Lodge a Complaint: You may file a complaint with your local data protection authority.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by email. Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated policy.

14. Google API Services User Data Policy

Supermail's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Back to Home