Privacy Policy — OutReach Pilot

Last updated: 2026-10-20

OutReach Pilot ("the Extension") is a Gmail outreach tool that helps you send personalised emails and see which recipients open or click them. This policy explains what data it accesses, how that data is stored, and the choices you have.

1. How the Extension connects to Gmail

There are two connection modes. The published Chrome Web Store build uses mode A only.

Mode	Credential	Used for
A. App password (default)	A 16-character Gmail app password you create in your Google Account	Sending over `smtp.gmail.com` and reading replies over `imap.gmail.com`
B. Google OAuth (optional, self-hosted builds)	OAuth access/refresh tokens	Sending through the Gmail API and reply checks through the Gmail API

2. Data we access

Data	Why	Where it is processed
Your Gmail address	Identifies the sending account	Your own backend (`data.json`)
Your Gmail app password	Authenticates SMTP (send) and IMAP (reply detection)	Encrypted with AES-256-GCM before it touches disk; never logged, never sent anywhere except Gmail
Campaign content you send (subject, body, recipient list, CSV rows)	Builds and sends your campaign	Your own backend
Open and click events, including recipient IP address and browser user agent	Distinguishes human opens from provider proxies and security scanners	Your own backend
Optional OAuth tokens (mode B)	Sending and reply checks through the Gmail API	Your own backend, encrypted

Reply detection opens an IMAP session and searches only for messages that come from the addresses in your own campaign, within the last 7 days. The Extension reads the sender, subject and threading headers of those messages to decide whether a recipient replied. It does not read the rest of your mailbox, and it does not mark messages as read (BODY.PEEK).

We do not read your contacts, Google Drive files, or calendar.

3. Where the data lives

The Extension talks to a backend that you run (default http://localhost:8787). Campaign data, contact lists, credentials and tracking events are written to that backend's local storage (server/data.json). We do not operate a shared cloud that receives your data, and no data is sent to us when you use the Extension.

4. Tracking disclosure

Emails sent through the Extension contain a 1×1 tracking pixel and wrapped links. Recipients' opens and clicks are recorded so you can see campaign statistics. Events are classified as:

human — a mail client loaded the pixel directly (counted as an open)
proxy — provider image proxies (e.g. Apple Mail Privacy Protection) prefetched the pixel;

shown as "possible opens" and not counted as human opens

machine — security scanners; recorded but not counted

You are responsible for complying with applicable email marketing laws (GDPR, CAN-SPAM, PECR and similar) in your jurisdiction, including providing an opt-out. Every message includes a one-click unsubscribe link and a List-Unsubscribe header.

5. Data retention and deletion

Data stays in your backend until you delete it:

delete server/data.json to remove all campaigns and events;
remove the app password at <https://myaccount.google.com/apppasswords> (or disconnect it on the

/connect page) to revoke sending and reading immediately;

with mode B, revoke access at <https://myaccount.google.com/permissions>.

6. AI features

If you use "Write with AI", the row data you provide (for example first name, company, role) and your product description are sent to the AI provider configured by the operator of your backend (DeepSeek or an OpenAI-compatible endpoint). The provider returns a draft. If no AI key is configured, a local template is used and nothing leaves your machine.

AI is only called when you explicitly click the button; it is never invoked per recipient.

7. Payments

Pro licences are sold through Gumroad (optionally Stripe Checkout). Payment details are collected and processed by the payment provider. Our backend stores only the purchaser's email, licence hash and expiry date. Card data never reaches the Extension or its backend.

8. Sharing

We do not sell, rent, or share your data. Network calls go only to Gmail (SMTP/IMAP or the Gmail API), your configured AI provider (only when you invoke AI), your payment provider (only when you start a purchase), and your own backend.

9. Security

Credentials are encrypted at rest with AES-256-GCM using a key that stays on your machine.
Passwords and tokens are never written to logs or included in error messages.
IMAP and SMTP hosts are fixed to imap.gmail.com and smtp.gmail.com; TLS certificates are

verified.

The Extension never asks for your Google account password — only for an app password, which can

be revoked at any time.

10. Changes

Material changes to this policy will be published on this page with a new "Last updated" date.

11. Contact

For privacy questions, contact the developer at the address listed on the Chrome Web Store listing, or open a ticket at <https://pay.trytoolboxpro.com/support>.