Privacy Policy — Mail Reply AI

Last updated: 2026-03-02

1. Overview

Mail Reply AI ("the Extension") is a Chrome browser extension that rewrites selected text in Gmail compose windows using an AI language model. This policy describes what data is collected, what is explicitly not collected, and how data is handled.

2. Data We Collect

Data Point	Description	Purpose
Rewrite latency	Time in milliseconds from request to response	Performance monitoring
Token count	Number of tokens consumed per rewrite request	Cost tracking and quota management
Outcome	Success or error code (e.g., ok, rate_limited)	Error rate monitoring
Goal type	The rewrite goal selected (e.g., formalize)	Feature usage analytics

All telemetry records are aggregated counts and durations only. No telemetry record contains email content, personal identifiers, or any information that can be linked to an individual user.

3. Data We Do NOT Collect

The following data is never collected, transmitted, logged, or stored by the Extension or its backend:

Email body content, subject lines, or recipient addresses
Gmail account identifiers, email addresses, or usernames
IP addresses in association with user identity
Browser history, cookies, or session tokens
Style profile training samples (processed in memory only; not persisted server-side)
Any other personally identifiable information (PII)

The backend API is stateless: each rewrite request is processed and immediately discarded.

4. How Data Flows

User selects text in Gmail compose
        |
        v
PII masking in browser (names, phone numbers, email addresses stripped)
        |
        v
Rewrite request sent to backend API (text + goal + optional style descriptor)
        |
        v
Backend forwards to LLM provider (Anthropic Claude or OpenAI GPT)
        |
        v
Rewritten text returned to browser — backend logs telemetry only (no content)

5. KVKK Compliance (Turkey — Law No. 6698)

The Extension does not process kişisel veri (personal data) as defined by KVKK Article 3(d) because email content is not retained, and telemetry contains no identifying information. Rewrite requests are forwarded to third-party LLM providers (Anthropic, Inc. — USA; OpenAI, Inc. — USA), limited to the text fragment selected by the user.

6. Chrome Web Store "Limited Use" Disclosure

activeTab — used solely to read and modify text in Gmail compose upon explicit user action.
scripting — used only to inject the compose toolbar UI into mail.google.com.
storage — used only to persist style profile descriptors on the user's local device.

Data obtained from Chrome APIs is not sold, not used for advertising, and not transferred to third parties except as necessary to perform the rewrite operation.

7. Third-Party Services

Anthropic, Inc. — anthropic.com/privacy
OpenAI, Inc. — openai.com/policies/privacy-policy

8. Data Retention

Data Type	Retention Period
Rewrite payload	Not retained — discarded immediately after LLM response
Telemetry records	Aggregated form, up to 90 days
Style profile	Stored on user's device only; deleted when Extension is removed

9. Security

All communication between the Extension and the backend API uses HTTPS.
PII masking is applied client-side before any data leaves the browser.
The backend enforces per-IP rate limiting to prevent abuse.
No API keys or credentials are stored in the extension itself.

10. Children's Privacy

The Extension is not directed to children under the age of 13. Gmail requires users to be at least 13 years of age.

11. Changes to This Policy

If this policy changes materially, the updated policy will be published at the same URL and the "Last updated" date will be revised.

12. Contact

For privacy-related questions, please open an issue at github.com/Kutluhankurt/Email-Reply-Copilot.