Checker for Gmail™ Chrome extension security report

Checker for Gmail™ is a privacy-first, pure Chrome extension for monitoring and managing Gmail. There is no developer-operated backend in the Gmail data path. Gmail messages, account information, search results, and OAuth tokens are never transmitted to or stored on SafeX servers. Gmail access happens directly between the extension, Chrome, and Google. Why it is safer: • No backend server receives or relays your Gmail data • No developer database stores messages, account details, or OAuth tokens • No telemetry, analytics, advertising, or behavioral tracking • Google OAuth access is managed by Chrome Identity • The extension never stores Gmail refresh tokens • Short-lived access tokens remain in Chrome’s managed identity cache • Mail cache and queued actions remain inside the extension’s local storage • Settings export never includes messages, Gmail content, cookies, or OAuth tokens • Remote images can be disabled to reduce sender tracking risk • Disconnect Account revokes access and clears associated local extension data Features: • View unread Gmail messages from the toolbar popup or side panel • See sender, subject, snippet, time, and unread count • Receive desktop notifications, optional sounds, and text-to-speech alerts • Read full message content inside the extension • Search Gmail messages • Mark messages as read or unread • Archive, star, mark important, report spam, or move messages to trash • Compose new messages and send replies • Open conversations directly in Gmail • Switch between available Gmail web accounts • Customize polling, notifications, theme, accent color, and remote-image behavior How authorization works: Basic unread information can be read from Gmail’s Atom feed using your existing Gmail web session, without OAuth. Full messages, search, changes, composing, and replies require a one-time Google OAuth authorization because Gmail’s basic Atom feed does not provide those capabilities. Authorization is handled by Chrome Identity. The extension receives only the access needed to perform the Gmail features you choose to use. Data flow: • Basic unread data: Gmail → extension • Authorized Gmail API data: Google → extension • User actions: extension → Google • Developer backend: not involved • SafeX servers: privacy policy, terms, and user-initiated feedback only Checker for Gmail™ is an independent extension and is not affiliated with, endorsed by, or sponsored by Google LLC. Gmail is a trademark of Google LLC.