Privacy Policy
Peekat has no server. It talks only to Google, keeps the mail it shows you in your own browser, and never sends your data to us or to anyone else. There is no account with us, no analytics and no advertising.
Who we are
Peekat Email (“Peekat”, “we”) is a browser extension made by Felix Lyu. Contact: hi@felixlyu.com.
What Peekat accesses
Peekat reaches your Gmail in one of two ways, which you choose when you select Connect Gmail:
- With your permission through Google. Google shows its consent screen, and Peekat asks only for these permissions:
openid— Google describes it as “Associate you with your personal info on Google”.email— Google describes it as “See your primary Google Account email address”.https://www.googleapis.com/auth/gmail.modify— Google describes it as “Read, compose, and send emails from your Gmail account”.
- Through the Gmail account signed in to your browser, if you skip that step. Peekat then reads the same information from Gmail’s web pages that your browser can already open.
Either way, Peekat accesses:
- your Google Account email address and, if Google provides it, your name;
- the number of unread messages in your inbox and in Gmail’s inbox categories;
- for recent unread messages: the sender, subject, a short preview, the date and the labels;
- the full content of a message, only when you open it in Peekat.
How Peekat uses it
Only to provide the features you see in Peekat:
- showing your unread mail, the counts on the toolbar icon, and notifications for new mail. To do this, Peekat checks for new mail about once a minute while your browser is open; you can turn any account off at any time;
- showing a message when you open it;
- finding sign-in codes in new messages, on your device, so you can copy them;
- changing a message in Gmail when you ask: opening it marks it read, and the Mark as read, Archive and Delete buttons do what they say. Delete moves the message to Gmail’s Trash; Peekat never deletes mail permanently.
Peekat does not send email. Writing and replying open Gmail’s own compose window.
Where your data is stored
- Peekat stores the list of recent unread messages (sender, subject, preview, date, labels), your counts, your settings and your choices (for example messages you marked done) only in your browser’s storage on your device. Message content you open is shown and not kept.
- Access tokens Peekat receives from Google are kept in memory for the browser session (at most about one hour each) and are never written to disk by Peekat. On Chrome, the token for the Google account signed in to your Chrome profile is kept by Chrome itself. On Safari, the Peekat app keeps Google’s sign-in token in your macOS Keychain.
- Sign-in codes are deleted when they expire.
- When you open a message, Peekat shows only images served by Google’s image servers; other remote images are not loaded, so senders cannot tell that you opened it.
Sharing
Peekat does not share, sell or transfer your data. It has no server of its own: all of its network requests go to Google (Gmail, Google sign-in and Google’s APIs) and, for updates, to your browser’s extension store. We cannot see your mail. Peekat contains no analytics, tracking, advertising or crash-reporting code, and does not use your data to train AI or machine-learning models.
Your browser and operating system may keep their own copies, for example of notifications shown in your system’s notification center.
People reading your data
No one at Peekat can open your mailbox or read your mail; it never reaches us. If you email support and paste part of a message yourself, we use only what you sent to answer you, and delete it when your request is closed.
Google API Services User Data Policy
The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.
In particular, Peekat uses Google user data only to provide and improve the user-facing features described above, does not transfer it to anyone, does not use it for advertising, and does not allow humans to read it.
How long data is kept
- A message stays in Peekat’s list while it is unread in your inbox, and leaves Peekat’s storage about 15 minutes after it is read, archived or deleted.
- Your choices about individual messages are kept for up to 30 days.
- Settings are kept until you change them or remove Peekat.
Removing your data and revoking access
- Turn an account off in Peekat’s Accounts settings to stop Peekat from checking it.
- Revoke access at Google: open myaccount.google.com/connections, choose Peekat Email, and select “Delete all connections you have with Peekat Email”. Peekat can no longer reach your Gmail through Google.
- Remove Peekat from your browser to delete everything it stored. On Safari, also delete the Peekat app; its sign-in item can be removed in Keychain Access (search for “Peekat Google sign-in”).
- If Peekat uses the Gmail account signed in to your browser, signing out of Gmail stops its access.
Because we hold no copy of your data, there is nothing for us to delete on our side. Write to us if you need help.
Security
All connections use HTTPS. Peekat requests only the permissions listed above, shows message content in an isolated frame with scripts disabled, and never logs tokens or message content.
Children
Peekat is not directed to children under 13.
Changes to this policy
We will post changes on this page and update the date above. If we ever want to use your data in a new way, we will ask for your consent first.