Privacy policy

# Privacy Policy — OutReach Pilot

_Last updated: 2026-10-20_

OutReach Pilot ("the Extension") is a Gmail outreach tool that helps you send personalised emails
and see which recipients open or click them. This policy explains what data it accesses, how that
data is stored, and the choices you have.

## 1. How the Extension connects to Gmail

There are two connection modes. The published Chrome Web Store build uses **mode A only**.

| Mode | Credential | Used for |
|---|---|---|
| **A. App password (default)** | A 16-character Gmail app password you create in your Google Account | Sending over `smtp.gmail.com` and reading replies over `imap.gmail.com` |
| B. Google OAuth (optional, self-hosted builds) | OAuth access/refresh tokens | Sending through the Gmail API and reply checks through the Gmail API |

## 2. Data we access

| Data | Why | Where it is processed |
|---|---|---|
| Your Gmail address | Identifies the sending account | Your own backend (`data.json`) |
| Your Gmail app password | Authenticates SMTP (send) and IMAP (reply detection) | Encrypted with AES-256-GCM before it touches disk; never logged, never sent anywhere except Gmail |
| Campaign content you send (subject, body, recipient list, CSV rows) | Builds and sends your campaign | Your own backend |
| Open and click events, including recipient IP address and browser user agent | Distinguishes human opens from provider proxies and security scanners | Your own backend |
| Optional OAuth tokens (mode B) | Sending and reply checks through the Gmail API | Your own backend, encrypted |

**Reply detection** opens an IMAP session and searches only for messages that come **from the
addresses in your own campaign**, within the last 7 days. The Extension reads the sender, subject
and threading headers of those messages to decide whether a recipient replied. It does not read the
rest of your mailbox, and it does not mark messages as read (`BODY.PEEK`).

We do **not** read your contacts, Google Drive files, or calendar.

## 3. Where the data lives

The Extension talks to a backend that **you run** (default `http://localhost:8787`). Campaign data,
contact lists, credentials and tracking events are written to that backend's local storage
(`server/data.json`). We do not operate a shared cloud that receives your data, and no data is sent
to us when you use the Extension.

## 4. Tracking disclosure

Emails sent through the Extension contain a 1×1 tracking pixel and wrapped links. Recipients'
opens and clicks are recorded so you can see campaign statistics. Events are classified as:

- **human** — a mail client loaded the pixel directly (counted as an open)
- **proxy** — provider image proxies (e.g. Apple Mail Privacy Protection) prefetched the pixel;
  shown as "possible opens" and not counted as human opens
- **machine** — security scanners; recorded but not counted

You are responsible for complying with applicable email marketing laws (GDPR, CAN-SPAM, PECR and
similar) in your jurisdiction, including providing an opt-out. Every message includes a one-click
unsubscribe link and a `List-Unsubscribe` header.

## 5. Data retention and deletion

Data stays in your backend until you delete it:

- delete `server/data.json` to remove all campaigns and events;
- remove the app password at <https://myaccount.google.com/apppasswords> (or disconnect it on the
  `/connect` page) to revoke sending and reading immediately;
- with mode B, revoke access at <https://myaccount.google.com/permissions>.

## 6. AI features

If you use "Write with AI", the row data you provide (for example first name, company, role) and
your product description are sent to the AI provider configured by the operator of your backend
(DeepSeek or an OpenAI-compatible endpoint). The provider returns a draft. If no AI key is
configured, a local template is used and nothing leaves your machine.

AI is only called when you explicitly click the button; it is never invoked per recipient.

## 7. Payments

Pro licences are sold through Gumroad (optionally Stripe Checkout). Payment details are collected
and processed by the payment provider. Our backend stores only the purchaser's email, licence hash
and expiry date. Card data never reaches the Extension or its backend.

## 8. Sharing

We do not sell, rent, or share your data. Network calls go only to Gmail (SMTP/IMAP or the Gmail
API), your configured AI provider (only when you invoke AI), your payment provider (only when you
start a purchase), and your own backend.

## 9. Security

- Credentials are encrypted at rest with AES-256-GCM using a key that stays on your machine.
- Passwords and tokens are never written to logs or included in error messages.
- IMAP and SMTP hosts are fixed to `imap.gmail.com` and `smtp.gmail.com`; TLS certificates are
  verified.
- The Extension never asks for your Google account password — only for an app password, which can
  be revoked at any time.

## 10. Changes

Material changes to this policy will be published on this page with a new "Last updated" date.

## 11. Contact

For privacy questions, contact the developer at the address listed on the Chrome Web Store listing,
or open a ticket at <https://pay.trytoolboxpro.com/support>.

Privacy · Terms · Support