SpamGate Privacy Policy
SpamGate — Privacy Policy
Version 1.0 · Effective July 2026
This Privacy Policy explains how Heuristicworks LLC ("we", "us", "our") collects, uses, stores, and protects personal data when you install and use the SpamGate Chrome browser extension ("Extension").
Please read this policy carefully. By installing the Extension, you acknowledge that you have read and understood it.
2. Data We Collect
2.1 Data Stored Locally on Your Device
The following data is stored in your browser using Chrome's chrome.storage.local API. It stays on your device and is never transmitted to our servers:
| Data | Purpose |
|---|---|
| Filter rules you have created (email addresses and domains) | Lets the Extension show your existing rules and apply them to your inbox |
| Your subscription plan status cache (free or pro) | Avoids repeated server calls to check plan eligibility |
| Your Google OAuth access token | Authenticates Gmail API requests on your behalf |
2.2 Data the Extension Reads in Your Browser (Not Stored or Transmitted)
To determine which sender to filter, the Extension's content script reads the sender's name and email address from Gmail's message list in your browser when you right-click a message. This information:
- Is used only to construct a Gmail API filter request
- Is never transmitted to our servers
- Is never stored beyond the duration of the right-click action
We do not access, read, transmit, or store:
- The content (body or subject line) of any email message
- Your full email address book or contacts
- Any emails other than the specific sender you have right-clicked
2.3 Account and Subscription Data
If you sign in to connect to our backend for plan management, we store the following in our Cloudflare-hosted database:
| Data | Purpose |
|---|---|
| Your Google account email address | Identifies your subscription account |
| Subscription plan (free / pro) | Determines which features are available |
| Subscription start date and renewal date | Billing management |
| Stripe customer ID and subscription ID | Links your account to Stripe payment records |
2.4 Payment Data (Stripe — Pro Plan Only)
If you upgrade to the Pro plan, payment is processed by Stripe. We receive and store only:
- Stripe customer ID
- Stripe subscription ID and status
- Subscription plan type
We never receive, transmit, or store raw card numbers or full card details. All payment card data is handled exclusively by Stripe. See stripe.com/privacy.
3. Gmail API Scopes
This Extension requests the following Google API scopes. These are the minimum scopes required to provide the service:
| Scope | Why it is needed |
|---|---|
https://www.googleapis.com/auth/gmail.settings.basic |
To create and manage Gmail filters (rules) in your account |
https://www.googleapis.com/auth/gmail.modify |
To apply filters retroactively — moving existing matching messages to Trash or applying labels |
The gmail.modify scope is required because gmail.settings.basic alone does not allow the Extension to move messages. Without it, creating a Trash or Spam rule would not clean up messages already in your inbox.
These scopes do not grant, and the Extension does not use, the ability to:
- Read, compose, send, or delete email messages (beyond moving messages you have explicitly acted on)
- Access any other Google service or account data
Google's use of data received from the Extension is governed by the Google API Services User Data Policy, including the Limited Use requirements.
4. How We Use Your Data
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Creating Gmail filters on your behalf | Sender email / domain (in-browser only), OAuth token | Contract |
| Applying filters to existing inbox messages | Gmail API token, message IDs (not content) | Contract |
| Managing your account and subscription | Account email, plan status, subscription dates | Contract |
| Processing subscription payments | Stripe IDs, plan status | Contract |
| Preventing abuse and enforcing usage limits | Account email, request counts | Legitimate interests |
We do not sell your personal data. We do not use your personal data or any data derived from your use of the Extension to train AI models.
5. Data Sharing and Third-Party Processors
5.1 Google LLC (Gmail API)
- What is shared: Your Google OAuth access token (used only to authenticate API calls to Gmail)
- Purpose: Creating Gmail filters and modifying message labels in your account on your behalf
- Location: United States
- Their policy: policies.google.com/privacy
Your OAuth token is stored locally on your device. It is transmitted directly from your browser to Google's API servers; it is never sent to or stored on our servers.
5.2 Cloudflare, Inc. (Backend and Database)
- What is shared: Your account email address, subscription plan data, HTTP request metadata
- Purpose: Hosting the Extension's backend API and subscription database (Cloudflare Workers + D1)
- Location: United States (global edge network)
- Their policy: cloudflare.com/privacypolicy
All traffic to our backend passes through Cloudflare's global edge network. Cloudflare processes request metadata (including IP addresses) per its own privacy policy. IP addresses are not retained by us beyond what Cloudflare logs at the edge.
5.3 Stripe, Inc. (Payment Processing — Pro Plan Only)
- What is shared: Email address, subscription plan metadata
- Purpose: Subscription billing and payment processing
- Location: United States
- Their policy: stripe.com/privacy
We never receive or store raw card numbers. Stripe is a PCI DSS Level 1 certified payment processor.
5.4 Law Enforcement and Legal Authorities
We may disclose personal data to law enforcement, courts, regulators, or other public authorities where required by law or where we have a good-faith belief that disclosure is necessary to prevent harm, comply with legal process, or enforce our rights.
6. International Data Transfers
Heuristicworks LLC is based in the United States. If you use the Extension from the European Economic Area (EEA), United Kingdom, or Switzerland, your account data will be transferred to and processed in the United States.
Where we transfer personal data from the EEA or UK to the US, we rely on Standard Contractual Clauses (SCCs) with our sub-processors where required. A copy of applicable transfer mechanisms is available on request at legal@heuristicworks.com.
7. Data Retention
| Data Category | Retention Period |
|---|---|
Filter rules (local chrome.storage.local) |
Until you clear the Extension's storage or uninstall it |
OAuth token (local chrome.storage.local) |
Until you sign out of the Extension or revoke access in Google Account settings |
| Account email and subscription data (Cloudflare D1) | Duration of subscription + 90 days after cancellation |
| Stripe payment metadata | 7 years (tax and accounting compliance) |
When you uninstall the Extension, Chrome removes all locally stored data. To remove your account from our backend database, email privacy@heuristicworks.com.
8. Security
We implement the following measures to protect your data:
- Encryption in transit: All requests between the Extension and our backend use TLS 1.3 via Cloudflare
- Local data isolation: Chrome's
chrome.storage.localis scoped to the Extension and inaccessible to other extensions or websites - OAuth token handling: Your Google OAuth token is stored only on your device and transmitted only to Google's API servers — it is never sent to our backend
- No email content: Our backend never receives email content; the Extension reads the sender address in your browser and uses it locally to construct a Gmail API request
- Access controls: Our Cloudflare Workers and D1 database are accessible only to authorised Heuristicworks personnel
No system is completely secure. If you discover a security vulnerability in the Extension, please report it responsibly to security@heuristicworks.com.
9. Your Rights
9.1 Rights Under GDPR (EEA, UK, Switzerland)
If you are located in the EEA, UK, or Switzerland, you have the following rights regarding your personal data:
- Right of access: Request a copy of the personal data we hold about you
- Right to rectification: Request correction of inaccurate or incomplete data
- Right to erasure: Request deletion of your account and associated data
- Right to restrict processing: Request limits on how we use your data in certain circumstances
- Right to data portability: Receive your personal data in a structured, machine-readable format
- Right to object: Object to processing based on legitimate interests
To exercise any of these rights, email legal@heuristicworks.com with subject line "Data Rights Request — SpamGate". We will respond within 30 days.
You may also lodge a complaint with your local supervisory authority. In the UK: the Information Commissioner's Office (ico.org.uk).
9.2 Rights Under CCPA / CPRA (California Residents)
California residents have the right to know what personal information we collect, request its deletion, and opt out of any sale or sharing for cross-context behavioural advertising. We do not sell personal information. To submit a request, email legal@heuristicworks.com.
9.3 Revoking Google Permissions
You can revoke the Extension's access to your Gmail account at any time via your Google Account settings at myaccount.google.com/permissions. Revoking access prevents the Extension from creating or applying Gmail filters until you sign in again.
9.4 Uninstalling the Extension
Uninstalling the Extension from Chrome removes all locally stored filter rules and authentication tokens. To remove your backend account and subscription data, email privacy@heuristicworks.com.
10. Children's Privacy
The Extension is intended for users aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe we have inadvertently collected such data, contact legal@heuristicworks.com and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will update the "Effective" date at the top of this policy when changes are made. For material changes, we will use reasonable means to notify you, such as a notice within the Extension. Continued use of the Extension after the effective date of a revised policy constitutes acceptance.
12. Contact
For privacy-related questions, rights requests, or complaints:
- Email: legal@heuristicworks.com
- Subject line: "Privacy — SpamGate"
- Response time: Within 30 days for standard requests
Mailing address:
Heuristicworks LLC
Spring City, PA, USA
Heuristicworks LLC · Spring City, PA, USA