Privacy Policy for Email Path Tracer

Effective Date: October 20, 2026

Last Updated: October 20, 2026

This Privacy Policy explains how AMDG Labs (“we,” “us,” or “our”) handles your information when you use the Email Path Tracer Chrome Extension (the “Extension”). We are committed to protecting your privacy and ensuring transparency regarding data processing.

1. Overview & Core Privacy Commitment

Email Path Tracer operates on a zero-tracking, direct-access architecture. We do not operate external servers to store, process, or transmit your email data. All operational requests occur directly between your web browser and your own authenticated Gmail or Outlook session.

2. Information Accessed and Used

A. Gmail and Outlook Message Data

• Scope of Access (activeTab permission): The activeTab permission is used to detect when you are actively viewing a Gmail or Outlook message page in your browser. This allows the Extension to read the original message envelope only when you choose to use it on that tab.
• Content Script Execution (scripting permission): The scripting permission is required to execute lightweight content scripts inside the active Gmail or Outlook tab. These scripts extract the original message from the page to evaluate the path the mail envelope took to the intended recipient, and run a local, on-device phishing-risk check on the message's headers, links, and sender information.
• No External Transmission: No message content, headers, credentials, or session cookies are ever sent, saved, or exposed to any third-party server, analytics provider, or external database. The phishing-risk check runs entirely as local heuristics inside your browser and does not call any external threat-intelligence or reputation service. Any request to retrieve a message's original source is sent directly to your own authenticated Gmail session using your existing browser credentials, never to AMDG Labs or any other party.

B. Local Storage Usage (chrome.storage.local)

• Scope & Purpose: The Extension uses the chrome.storage.local API strictly as an ephemeral, in-memory buffer to pass structured tree data between internal extension contexts (such as between the background service worker and the popup or side-panel view) within the active session.
• Retention: Data stored in chrome.storage.local is immediately deleted and cleared as soon as it is read by the receiving context. No data is persisted or synced externally, nor is it synced to your Google account (chrome.storage.sync is not used).

C. Host Permissions

• Domains: The Extension requests host permissions limited to the mail providers it supports:
  • https://mail.google.com/*
  • https://outlook.office.com/*
  • https://outlook.office365.com/*
  • https://outlook.live.com/*
  • https://outlook.cloud.microsoft/*
• Purpose: Host permissions are required to fetch the original mail message directly within your own authenticated session on these domains, without routing it through any external server.

3. Data Sharing and Third Parties

• No Third-Party Analytics: We do not track user behavior, usage metrics, or telemetry using third-party analytics tools (e.g., Google Analytics).
• No Selling or Transferring of Data: We do not buy, sell, rent, or transfer your personal data or message data to any third parties for marketing, advertising, or any other commercial purpose.

4. Google API Service User Data Policy (Limited Use)

The Extension's use and transfer to any other app of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

5. Security

Because all communications occur directly inside your browser session and pass through your existing Gmail or Outlook authentication and SSL/TLS encryption, your data benefits directly from your mail provider's inherent security controls.

6. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect functional updates to the Extension or legal requirements. Any revisions will be published on this page with an updated “Last Updated” date.

7. Contact Us

If you have any questions or concerns regarding this Privacy Policy, please contact us at:

• Developer Email: admin@amdglabs.dev
• Website: https://www.amdglabs.dev