Privacy Policy

Last updated: 2026-04-30 · Effective: 2026-04-30

Plain-English summary: Your email content never leaves your device. We collect license info (whether you've paid, which tier) on a Supabase database we operate. Stripe handles payments — they see card info, we don't. You can revoke access anytime at myaccount.google.com → Security → Third-party access.

What Mailbreak collects

From your Google account, via the Gmail API

When you connect your Gmail account, Mailbreak requests three Gmail OAuth scopes:

gmail.readonly — to read message headers and find List-Unsubscribe URLs. Mailbreak does NOT read message bodies during the scan; the Gmail API request explicitly asks only for headers. Pro users may opt-in to a per-sender body fetch for the Email Preview feature; that fetch is user-initiated, one message at a time.
gmail.modify — to apply Gmail labels for the filter-only fallback, and to soft-delete (move to Trash) bounce delivery-failure notifications plus the recent messages from any sender whose mailto-unsubscribe permanently bounced. Bounce Auto-Trash is enabled by default and can be turned off at any time in Settings → Bounce handling. Banking, healthcare, and government senders are auto-flagged Important and never trashed.
gmail.send — to send mailto-style unsubscribe emails when a sender's List-Unsubscribe header offers that path.

This data is processed in your browser memory and on your device only. None of it is transmitted to any Mailbreak-operated server.

Locally on your device

Mailbreak stores the following in your browser's IndexedDB (encrypted at rest with AES-256, key held only in chrome.storage.session for the browser session):

Sender records: sender email, display name, category (newsletter, banking, etc.), first/last seen timestamps, message count, important-sender flag.
Unsubscribe results: sender email, status (confirmed/pending/filtered_only/failed), method used, timestamp, error details. Sensitive fields are encrypted before write.
Audit log: timestamp, action type, actor (you or system), short detail string. Used for transparency and recovery.
OAuth token: held only in chrome.storage.session, wiped when the browser closes.

This data auto-expires per the project's threat model (180 days for senders, 365 days for results, 10 000-entry cap on audit log).

From your Stripe payment, sent to our license server

If you purchase a paid plan, after Stripe confirms payment our backend receives a webhook and writes to our Supabase database:

Your Stripe customer ID
Your Google account email (used to bind license to your extension installation)
The plan you purchased
The Stripe subscription ID (recurring) or charge ID (lifetime)
Purchase timestamp
Founder badge flag (if applicable)

We do NOT receive or store your full credit card number, CVV, or billing address. Stripe holds that.

What Mailbreak does NOT collect

Your email message bodies (except the user-initiated Pro Email Preview).
Attachments, contacts, calendar entries, or any data from any other Google product.
Your email password.
Your IP address (Plausible derives only the country, on the marketing website).
Browser fingerprints.

Where data lives

Data	Location	Encrypted at rest
Email headers (during scan)	Your browser memory	(in-memory only)
Sender records	Your browser's IndexedDB	Yes (AES-256-GCM)
Unsubscribe results	Your browser's IndexedDB	Yes (sensitive fields)
Audit log	Your browser's IndexedDB	No (plaintext for tamper-evidence)
OAuth token	`chrome.storage.session`	(wiped on browser close)
License records	Supabase (US region)	Yes (Supabase-managed)
Stripe customer/transaction	Stripe's servers	(per Stripe's policy)

Who we share data with

Google — to make Gmail API calls on your behalf.
Stripe — for payments. They send us a webhook with non-sensitive metadata (customer ID, plan).
Supabase — our database operator for license records. Supabase DPA.
Plausible — privacy-respecting analytics on the marketing website only (cookie-free, no cross-site tracking).
Nobody else. We do not sell, rent, or share your data with advertisers, data brokers, or any third party not listed above.

Your rights

Anyone (regardless of jurisdiction)

Revoke OAuth access at myaccount.google.com → Security → Third-party access. Mailbreak immediately loses access to your Gmail.
Wipe local data via Settings → "Delete all local data" inside the extension, or by uninstalling.
Cancel a paid subscription via Stripe's customer portal (link inside the extension's Settings).

EU / UK (GDPR)

You have the right to access, rectify, port, and erase the personal data we hold (license records on Supabase). Contact us at the email below — we respond within 30 days.

California (CCPA / CPRA)

You have the right to know what personal information we collect, request deletion, and opt out of any "sale" of your data. We do not sell personal information.

Children

Mailbreak is not directed at children under 13 (US) or 16 (EU). We do not knowingly collect data from anyone in those age groups.

Changes to this policy

We'll post material changes to this URL and update the "Last updated" date. For significant changes we'll also notify users via the extension popup the next time they open it.

Contact

Privacy questions, GDPR/CCPA requests, deletion requests: see the support email in the extension's Settings → About, or message us via the Chrome Web Store listing's Support tab.