MailKey does one thing: when you are on a website that asks for an email verification code, it checks your Gmail for a code that arrived in the last 60 minutes and offers — with one click — to fill it in for you. This policy explains exactly what the extension can see, what it keeps, and what it never does. It is written to be read, not skimmed past.

1. What the extension accesses

Gmail, read-only. When you click “Connect Gmail,” Chrome's own account system (chrome.identity.getAuthToken) asks you to grant the extension Google's read-only Gmail permission (https://www.googleapis.com/auth/gmail.readonly) for the Google account you are signed into in Chrome. The extension uses it to list and read recent messages so it can find verification codes. There is no password, no client secret, and no login form inside the extension — the access token is minted and refreshed by Chrome's identity system, and the extension only ever receives a short-lived read-only token.

Being honest about the permission: Google does not offer a “last-hour-only” Gmail permission. The OAuth grant you approve technically covers reading your whole mailbox. The one-hour limit is self-enforced by the extension: every single request it makes to Gmail includes a filter (after:<one hour ago>) so it only ever asks Google for mail received in the last 60 minutes. This filter lives in one small, auditable function in the source code (src/background/gmail.js), and no request path exists that omits it. If you are not comfortable granting the broader permission even with this self-restriction, do not connect the extension — that caution is reasonable, and this paragraph exists so you can make that call informed.

The page you're on. The extension only runs on websites you allow (either “all websites” or a specific list you build — your choice in settings). On an allowed page, it looks for verification-code input fields so it can anchor the suggestion chip. It does not read, collect, or transmit the page's content.

2. When it accesses Gmail

Only while a verification-code field is present on an allowed site (or when you explicitly press “I'm expecting a code” in the popup). It polls Gmail for a few minutes at most and then stops. It does not scan your mail in the background, on a schedule, or while you browse normally.

3. What is stored, and for how long

Email content is never persisted. Message bodies are parsed in memory to find the code and immediately discarded. No email — not the body, subject, sender, or metadata — is ever written to disk or retained beyond the moment of parsing.

4. What is NEVER done

• No servers. The extension has no backend. Your mail, tokens, and codes never leave your device. All Gmail requests go directly from your browser to Google.
• No analytics, no telemetry, no crash reporting. Nothing phones home.
• No sale or sharing of data. Ever, with anyone, for any purpose.
• No advertising use. Your data is never used for ads of any kind.
• No auto-fill and no auto-submit. A code is only entered into a page when you click “Fill,” and the extension never submits a form for you.
• No reading beyond the last hour. See section 1.
• No human access. There is no mechanism by which the developer (or anyone else) can see your email — the data never reaches us.

5. Google API Services — Limited Use disclosure

MailKey's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Gmail data is used only to provide the extension's single user-facing feature: detecting and offering to fill verification codes you just received.
• Gmail data is not transferred to anyone, except as necessary to comply with applicable law (there is no technical pathway for transfer — the data never leaves your device).
• Gmail data is never used or transferred for advertising, including retargeting, personalized, or interest-based advertising.
• Gmail data is never read by humans. The extension has no server and no data ever reaches the developer.

6. Your controls

• Disconnect: the extension's Options page has a Disconnect button that clears the cached access token from Chrome's identity system.
• Revoke at Google: you can revoke the extension's access at any time at myaccount.google.com/permissions. This immediately invalidates its access regardless of anything on your device.
• Limit where it runs: in Options, switch from “All websites” to “Only these sites” and the extension's content script will exist only on the sites you list.
• Uninstall = everything gone: removing the extension deletes its stored tokens and settings. There is nothing server-side to delete, because nothing was ever sent anywhere. (For completeness, you may also revoke access at the Google link above after uninstalling.)

7. Children

The extension is not directed at children and does not knowingly collect information from children; it collects no personal information at all beyond what is described above, and none of it leaves your device.

8. Changes to this policy

If this policy changes, the updated version will be posted at this URL with a new effective date, and the extension's store listing will link to it. Material changes (anything that would expand what is accessed or stored) will be called out prominently in the extension's release notes. Continued use after a change takes effect constitutes acceptance; if you disagree with a change, disconnect and uninstall — that removes everything.

9. Contact

• Developer: wardkhleif
• Email: [email protected]
• Source code: private / not published (the extension is closed-source; see the notice below)

Questions about this policy or the extension's data handling are welcome at the address above.

All rights reserved. © 2026 wardkhleif. MailKey is proprietary software; no license to copy, modify, or redistribute is granted.

MailKey is not affiliated with or endorsed by Google. Gmail is a trademark of Google LLC.