Data architecture
Your inbox stays in Gmail.
Sidekick Log reads conversation context to find what needs attention. Here is what stays on your device, what leaves it, and why.
The local path
Read-only access to thread metadata and message snippets.
Detects conversation state. Keeps a local cache and compares scans.
Open the original conversation. Decide what to do in Gmail.
The extension cannot send, delete, archive or label your email. Checks run while Chrome is running, your device is awake and Gmail is connected.
When AI is on (the default)
Sender, subject, snippets and relevant context for the requested analysis or draft.
Routes the request to an inference provider. Account verification is separate from the prompt.
Generates a result that returns to your extension. You review it before acting.
AI enrichment can be disabled in settings. AI-assisted analysis and drafting require the remote service; local signal detection does not. Attachments are not part of this flow.
What is stored where
- Google / Gmail
- Your mailbox remains the source of truth.
- Your Chrome profile
- Thread metadata and snippets, signal history, preferences, feedback, cached drafts and authentication/session data. Stored in
chrome.storage.local, separately by account where supported. - AI services
- Selected context is transmitted for inference. Sidekick Log does not intentionally persist prompt bodies or create a cloud replica of your inbox. Provider processing is external to your device.
- Polar / account services
- Checkout email, subscription and payment records support billing and access checks. Card details are handled by Polar.
- PostHog EU
- Usage events and diagnostics, with an installation ID or hashed account identifier. Message bodies and thread subjects are not intended analytics properties. Extension analytics can be disabled in settings.
Technical details and controls
AI enrichment is enabled unless switched off in extension settings.
OAuth scope: gmail.readonly. Scanning uses the Gmail API; core discovery checks inbox threads, not every archived or sent-only conversation.
The extension removes raw message arrays from its persistent thread cache. Derived records can still contain snippets and email addresses; “local” does not mean “contains no personal data.”
Authentication requests may send a Google access token to the Sidekick Log server for verification. That credential is not intended for the AI prompt. Operational logs and rate-limit records may contain account identifiers, IP addresses, request metadata and status.
Turn off AI enrichment or analytics in settings. Revoke Gmail access through your Google Account. Uninstalling removes extension-local storage; contact hi@screate.co for server-side account-data requests.
This explains the implementation and its data boundaries. It is not a claim of independent security certification. See the Privacy Policy for the full terms of data handling.