Privacy

The short version

• Your mail is read to decide whether it is cold outreach. That is the whole job.
• Nothing is deleted, ever. Cold mail is labelled and archived; it stays in All Mail.
• Decisions live in your browser. A billing account is linked to your verified Google identity. The extension itself has no tracking and no analytics. The dashboard website counts visits with Google Analytics — never your mail — and in the EU/EEA, the UK and Switzerland only if you accept.
• Checked messages are sent to the classification service to be scored. Message content is not stored by that service during routine checks. Separately, you can choose to share a report; those reports are stored as described below.

Subscriptions and payments

We use your verified Google identity to link one subscription to one mailbox. Our service stores a hashed account identifier, your verified email address, account creation and last activity dates, your trial dates, and Stripe customer and subscription identifiers. Authorized administrators can view account, subscription, and service status to operate and support the product. Your billing email is sent to Stripe when you choose a paid plan. This billing record is separate from your mailbox history; clearing extension data does not restart a trial or cancel a subscription.

Stripe hosts checkout and the billing portal and processes your payment information. We do not receive or store your full card number. We retain billing records as needed to provide your subscription, prevent repeated trials, and meet applicable accounting requirements. See Stripe’s privacy policy. Manage or cancel your subscription in Billing; contact privacy@nocold.email about deletion.

What the extension reads

Through the Gmail API, with the single scope gmail.modify, and only for mail arriving in your inbox:

• the message itself — headers, text, HTML, links and images — because that is what the rules read;
• the labels on messages in a candidate's thread, to see whether you already replied;
• whether you have ever sent mail to a sender, which is only ever counted, never read;
• your own address, aliases and display name, so the rules know which names are yours.

It does not read Spam, Trash, Drafts or your calendar. If you grant the optional Google Contacts permissions, it reads contact names and email addresses to recognise people you know. That contact list is cached in your browser and is not sent to the classification service. The Gmail scope cannot permanently delete mail; that needs a broader scope this extension never requests.

What is stored, and where

In your browser profile, in chrome.storage.local, which Chrome never syncs:

• Decisions — the verdict, score, the signals that fired, the sender and the subject. The newest 3,000.
• Memory — counters per sender and domain, so a repeat offender is recognised.
• Settings — your allow and block lists, thresholds, and any keys you paste in.
• Copies of checked mail — on by default, so you can export and tune. Turn it off in Settings → Your data, and nothing but the decision is kept.

Removing the extension deletes all of it. Signing out revokes access at Google and erases everything derived from your mailbox, keeping only your own choices.

What leaves your computer

The extension has no telemetry, no update ping, no third-party analytics and no remote configuration. The dashboard website uses Google Analytics, described next.

Analytics on the dashboard website

The dashboard website uses Google Analytics 4, provided by Google LLC (Google Ireland Limited for visitors in the EU/EEA, the UK and Switzerland) as our processor, to measure in aggregate how the dashboard is used. The extension and this privacy page do not load it.

• Cookies — _ga and _ga_*, kept for up to 2 years. Where you are asked, nocold_consent remembers your answer for 180 days.
• Retention — Google Analytics keeps the data for 14 months.
• IP addresses — Google Analytics 4 does not store them.
• Advertising — advertising features are off; nothing is used for ads.
• Consent — in the EU/EEA, the UK and Switzerland, Google Analytics does not load until you accept it in the banner.
• Changing your mind — Cookie settings on the dashboard reopens the banner; Reject stops it and deletes its cookies. Anywhere, you can also opt out with Google’s browser add-on.

Reports: examples you choose to share

The filter gets better by seeing real examples. There are two ways to give one, and both are things you do on purpose:

• Forward a message — with Gmail's Forward as attachment — to cold@nocold.email (this got through) or notcold@nocold.email (this was flagged wrongly).
• Click Report on a row in the dashboard. The first time, it asks; you can withdraw that in Settings at any time.

What a report contains

The complete original message, exactly as it arrived: every header, the text, the HTML and any tracking pixels. Also which of the two labels you gave it, the address you sent from, and what our engine thought of the message at that moment.

Reports marked “not cold” are your ordinary mail — from clients, colleagues and friends. Please only send ones you are comfortable sharing. If you send something by mistake, ask us to delete it and we will.

How reports are handled

• They are stored to measure and improve the filter. Nothing else.
• They are never sold, never shared with anyone else, and never used to contact the people in them.
• Links in them are never followed and images are never loaded, so reporting a message cannot confirm your address to a sender.
• They are kept for at most 365 days and then deleted automatically.
• You can delete any report at any time, or ask us to delete all of them, at privacy@nocold.email. If you use the API directly, DELETE /v1/report/<id> removes one immediately.

Sending nothing is a perfectly good way to use this. The filter works without your reports; they only make it better.

Text messages (SMS)

If you give us your mobile number to receive a verification code or a message you asked for, we never sell it or your SMS opt-in consent, and we never share them with third parties or affiliates for their marketing purposes. We share them only with the service providers that deliver our messages, such as Twilio, and only for that purpose. Reply STOP to opt out at any time. See our SMS Terms.

Google API Services: Limited Use

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Gmail data is used only to provide and improve the cold-email filtering you asked for. It is not transferred to anyone except as you direct, is never used for advertising, and is never read by a human except with your explicit permission, to resolve a problem you have reported, or where the law requires it.

A message you forward or report is data you send us directly, and is handled as described above.

Getting rid of everything

• In the extension — Settings → Your data → Erase history, or Sign out, which also revokes access at Google.
• At Google — revoke access at myaccount.google.com/permissions.
• Reports — delete them yourself, or write to privacy@nocold.email and we will remove every report you have sent.