Privacy Policy
Last updated: 2026-08-27
EmailKnow is privacy-first by construction. This policy states plainly what we access, what we store, and what we never touch. The wording matches our Google OAuth verification exactly.
What we access
To detect replies and send follow-ups on your behalf, EmailKnow requests only two sensitive Gmail scopes: gmail.send (send email) and gmail.metadata (read message headers — sender, subject, thread ID, timestamps). Sign-in uses openid, email, and profile only.
The explicit AI boundary
Default tracking and automated follow-ups do not read message bodies. Only after you click AI Follow-up and complete the two confirmations for that request does the extension temporarily read selected text, or the currently visible message when nothing is selected. The notice identifies the processor, content scope, estimated Credits, sensitive-data risks, and human-review requirement. We do not request gmail.readonly or gmail.modify.
What we store
We store account details, header-level message metadata, recipient addresses, aggregate tracking statistics, follow-up workflow state, recipient suppression choices, AI token usage, Credit ledger entries, and limited Stripe customer/subscription identifiers. AI inputs, generated drafts, attachments, and complete provider responses are never stored in D1, KV, or persistent logs.
Tracking consent and recipient choices
Open/click tracking and automatic follow-ups are off by default. A sender must enable tracking for each one-recipient message and confirm that the recipient gave prior consent. We do not enable recipient-level tracking for group messages. A visible link in tracked mail lets the recipient stop tracking, or stop both tracking and future automatic follow-ups from that sender, without creating an account. Automatic follow-ups also contain a confirmation-based link that stops the current conversation; merely loading that link does not change a preference.
How we handle IP addresses and links
We do not persist recipient IP addresses, recipient IP hashes, or user-agent strings for opens or clicks. To exclude a sender's own opens, we temporarily derive and store a one-way HMAC scoped to that single message, which cannot be used to link the sender across messages. Click destinations are stored only as origin and path; query strings and fragments are discarded from analytics, while the recipient is still redirected to the complete destination.
Honest signals
Open detection is inherently imperfect (Apple Mail Privacy Protection preloads images). We label every signal by confidence — human / apple / unknown / self — and never claim 100% accuracy.
Your control
Your data lives under your account. The extension lets you export it in JSON and permanently delete the account. An active Stripe subscription must be canceled first so billing does not continue after deletion. We never sell personal data. Disconnecting Gmail clears the stored refresh token immediately and asks Google to revoke it; local deletion still completes if Google is temporarily unavailable. Depending on applicable law, you may also request access, correction, restriction, objection, portability, or erasure by contacting us.
Retention
Tracking and follow-up workflow records are automatically deleted 180 days after the message was sent. Account, suppression, AI-usage, and Credit records remain while the account exists unless a shorter period is required. On account deletion we remove the account data held in EmailKnow. Stripe or other providers may retain limited transaction records when required by tax, accounting, fraud-prevention, or other law.
Token security
Refresh tokens are encrypted at rest (AES-256-GCM) and never stored in plaintext. The Google client secret lives only on our server and is never sent to the extension.
AI and payment providers
When you explicitly use an AI draft, the minimum text needed for that request is temporarily sent to the Cloudflare Workers AI-hosted DeepSeek V4 Flash model; EmailKnow does not call DeepSeek's China-hosted API. Cloudflare states that it does not use Workers AI Customer Content to train models. Subscriptions and Credit-pack payments are hosted by Stripe; EmailKnow never receives or stores your card number.
Sensitive information and data minimization
Before submission, the extension warns about possible passwords, tokens, card/identity/medical information, or trade secrets. The server also masks common email addresses, API keys, access tokens, and password fields. You must confirm that you have authority to process the submitted content and remove sensitive information that is unnecessary for the draft. Do not submit passwords, verification codes, payment-card data, medical records, identity documents, protected secrets, or third-party information without a lawful basis.
International processing and Google user data
Cloudflare operates global infrastructure, so data may be processed temporarily outside your country or region. We use applicable data-processing and cross-border safeguards where required. Google user data is used only for user-facing EmailKnow features; it is not sold, used for advertising, or used to train general-purpose AI models.
Roles, purposes, and legal bases
EmailKnow acts as controller for account, security, billing, and product-operation data. For recipient data a sender enters and uses through the service, the sender is responsible for deciding the lawful purpose and is generally the controller, while EmailKnow processes that data to provide the requested service. Depending on location and context, our bases include performing the service contract, recipient consent for tracking, legitimate interests in security and abuse prevention, and legal obligations for billing records.
Service providers
Cloudflare provides hosting, D1, KV, network delivery, and—only when requested—Workers AI processing. Google provides sign-in and Gmail APIs. Stripe provides hosted payment and subscription services. Each provider processes data under its own terms and applicable data-protection commitments.
Contact
Questions about this policy: privacy@emailknow.com