Privacy Policy
Last updated: 18 August 2026
The short version
- Exporting and notes happen entirely in your browser. Your email content is not sent anywhere.
- Only when you click an AI button does that one conversation's text go to our server, and on to our AI provider.
- We do not store email content and we do not use it to train any model.
What the extension reads
The extension runs only on mail.google.com. When you ask it to export, summarize or annotate a conversation, it reads that conversation through Gmail's own print view, using the browser session you are already signed in with. It does not use the Gmail API, does not request Google OAuth permissions, and cannot access your mailbox when your browser is closed.
AI features
AI features are off unless you sign in and click one. When you do, the text of that single conversation is sent over HTTPS to our server, which forwards it to our AI provider (OpenRouter, and through it the model provider) to generate the result. We do not write the conversation text to our database. We keep only metadata about the run: which task, which model, how many credits, how long it took, and how many characters were sent — never the content itself. Our AI provider processes the request to produce your result and does not use it for model training.
Notes
Notes are stored in your browser's local storage and never leave your device on the Free plan. On paid plans you can enable cloud sync, which stores the note text on our servers so your other devices can see it. You can delete a note at any time; deletions sync too.
Account data
If you create an account we store your email address, a hashed password (or your Google or GitHub account identifier if you sign in with one of those), your plan, and your credit ledger. If you subscribe, payment is handled by Paddle, who act as merchant of record. We never see or store your card details.
How long we keep things
Account data is kept while your account exists. AI run metadata is kept for 90 days for troubleshooting and billing accuracy, then deleted. Deleting your account removes your account record, notes and ledger.
Who else is involved
Vercel (hosting), Neon (database), OpenRouter and the model providers it routes to (AI processing), and Paddle (payments). Each receives only what it needs to do its job.
Your rights
You can access, export or delete your account data at any time from your account page, or by writing to us. If you are in the EEA or UK, you have the rights granted by the GDPR, including the right to complain to your local supervisory authority.
Contact
Questions about this policy: privacy@xeviora.com