Privacy Policy
Effective date: October 28, 2026
Gmail Sender Info ("the Extension") is a Chrome browser extension that displays sender domain information, brand logos, and email authentication results in Gmail. This policy describes what data the Extension accesses, how it is used, and your rights.
1. Data the Extension Accesses
The Extension reads the following data from the Gmail page you have open. All of it is processed locally in your browser; the Extension has no server of its own and sends nothing to its developer.
- Sender email addresses and display names — read from the Gmail page to look up domain and logo information.
- Email headers — fetched from Gmail's own servers using your existing session to check SPF, DKIM, and DMARC authentication results. The Extension also reads the To, Cc, Bcc, Reply-To, and Delivered-To headers from the same response, to detect when you were BCC'd and when replies would go to a different domain than the sender.
- Sender domain names — derived from email addresses to perform BIMI DNS lookups and favicon resolution.
- Email content for the optional AI check — the subject, up to the first 2,000 characters of the body text of the email you have open, and up to 20 links from the body (link address and the first 100 characters of link text). See Section 2 for details.
The Extension does not read attachments or your contacts, and it does not read emails you have not opened. It does not read the body of an email except for the AI check described in Section 2.
2. Optional On-Device AI Check
In Chrome 138 or later, when the built-in AI model (Gemini Nano, through Chrome's Prompt API) is available on your computer, the Extension uses it to add an advisory Ok / Caution / Reject verdict to the banner shown when you open an email. If the model is not available, this check does not run and the rest of the Extension works normally.
When the check runs, the Extension builds a short prompt and gives it to Chrome's built-in model. The prompt contains:
| What is read | Source |
|---|---|
| Sender display name and sender email address | The open email in Gmail |
| Subject | The open email in Gmail |
| Body text, up to the first 2,000 characters | The open email in Gmail |
| Up to 20 links from the body (link address and up to 100 characters of link text) | The open email in Gmail |
| Whether you were BCC'd, whether the body is empty, and the Reply-To address and domain if they differ from the sender's domain | Email headers and body |
| SPF, DKIM, and DMARC results | Email headers |
The model runs on your device through Chrome. The Extension does not send this prompt, or the model's answer, to the developer or to any server. The prompt and the result are passed between the Extension's two scripts using the browser's window.postMessage inside your Gmail tab, so they are visible to code running in that Gmail page, which can already see the email itself. The result is kept in memory for the life of the Gmail tab and is not written to storage.local. The expanded banner's debug section shows the beginning of the prompt that was used, on your screen only.
If Chrome reports that the model can be downloaded, the Extension shows an "Enable local AI model" button. Clicking it asks Chrome to download the model. Chrome performs that download under its own terms and privacy practices; the Extension does not receive the model or send email data as part of it.
3. External Services
The Extension itself makes requests only to Google-operated services and to your own Gmail session:
| Service | Data Sent | Purpose |
|---|---|---|
Google DNS-over-HTTPS (dns.google) |
Sender domain name (as a default._bimi.<domain> lookup) |
Look up BIMI TXT records to find verified brand logos |
Google Favicon Service (www.google.com/s2/favicons) |
Sender domain name | Retrieve website favicons for sender domains |
gstatic Favicon V2 (t0.gstatic.com) |
Sender domain name | Detect whether a real favicon exists (vs. generic globe icon) |
Gmail (mail.google.com) |
Message ID | Fetch raw email headers for authentication checks using your existing session |
Sender domains can also lead your browser to load images directly from the sender's side. These requests are made by your browser when the image is displayed, the same way any image on a web page is loaded:
- BIMI logo. If a sender's DNS publishes a BIMI record, the logo address in that record is loaded as an image. That address is chosen by the sender's domain and can be on any host.
https://<sender-domain>/favicon.ico. Used when Google's favicon image does not load or is only the generic globe icon, and shown in the expanded details panel.
When your browser loads one of these images, the host serving it can see that an image was requested, along with the usual information in any web request such as your IP address. This tells the sender's host that someone using this Extension displayed that sender's email or its tooltip. The Extension does not add any identifier to these requests.
No data is sent to any analytics, advertising, or tracking service. Apart from the sender-hosted images described above, the Extension does not communicate with any non-Google server.
4. Data Storage
Lookup results (domain names, logo URLs, favicon URLs, and the country name derived from the domain's ending) are cached locally in your browser using Chrome's storage.local API. Each cache entry is stored under the sender's domain (for example, example.com), not the full email address, so no email address is kept in the cache. Cache entries expire after 24 hours and are cleared when the Extension is installed or updated.
The Extension also stores a few small values that are kept across updates so it can decide when to show an occasional request for a Chrome Web Store review: the time of first use, a count of emails viewed, and whether you dismissed or clicked the request.
No data is stored outside your browser.
5. Data Collection
The Extension does not collect or transmit personal data to the developer or to any server operated by the developer. Specifically:
- No analytics or telemetry
- No user accounts or identifiers
- No tracking pixels, beacons, or cookies
- No behavioral data sent anywhere (clicks, page views, interaction patterns)
- No email content or attachments sent anywhere. The email content used by the AI check stays on your device (Section 2).
6. Permissions
| Permission | Why It's Needed |
|---|---|
storage |
Cache BIMI and favicon lookup results locally (24-hour TTL) |
https://dns.google/* |
BIMI DNS-over-HTTPS lookups for verified brand logos |
https://*.gstatic.com/* |
Detect generic globe icons to determine if a real favicon exists |
The Extension does not request access to browsing history, cookies, bookmarks, or any broad host permissions.
7. Data Sharing
The Extension does not sell, trade, or transfer any user data to third parties. The only data that leaves your browser is what is described in Section 3: sender domain names sent to Google services, and image requests that your browser makes to sender-hosted logo and favicon addresses. Email body text and the other AI check inputs stay on your device.
8. Security
- All DOM elements are created programmatically — no untrusted HTML injection.
- Input validation rejects malformed email addresses before processing.
- Header fetches use your existing Gmail session (same-origin); no additional credentials are stored or transmitted.
9. Children's Privacy
The Extension is not directed at children under 13 and does not knowingly collect any personal information from children.
10. Changes to This Policy
If this policy is updated, the revised version will be posted at this URL with an updated effective date. Material changes will be noted in the Extension's update notes on the Chrome Web Store.
11. Contact
If you have questions about this privacy policy, please open an issue on the GitHub repository.