EmailBlasts.app — Privacy Policy

Decentralized Bulk Emailing & Automation · Chrome & Edge Extension

1. What This Service Does

EmailBlasts.app is a software suite running locally inside your browser (via the Blasts extension) that enables you to compose, pace, and send bulk email campaigns and automated follow-up sequences. All campaigns are routed directly through your own credentials (such as your own AWS SES account or rotating Microsoft 365 / Gmail mailboxes).

This software is decentralized by default. When you compose and send from the desktop browser extension, your contact lists, message content, and API credentials are kept locally on your own device and are never sent to our servers; your email is sent directly from your own browser via OAuth or verified APIs. One exception, which you control: if you choose to send from our optional online portal (blasts.app/portal) on a phone or tablet, some data must reach our servers to send on your behalf — see "Optional Online Portal & Cloud Sync" below. The portal is entirely optional and off unless you turn on cloud sync.

2. Data We Access

We do not collect, store, or monitor your email content or contact lists on our servers. The extension does not read your inbox contents, does not scraping pages you browse, and does not harvest contact details for our own databases.

All data processing, including merging list variables (like {{first_name}}), de-duplicating records, cleaning typos, and tracking campaign reports occurs locally inside your browser window.

3. How Email sending Works

Bring-Your-Own OAuth (PKCE) — Connecting a Microsoft 365 or Gmail mailbox uses secure OAuth. M365 requires only a Client ID. Gmail requires a Client ID and Client Secret. Tokens are stored encrypted locally.
Send-Only by Default — Sending email uses standard send-only scopes (gmail.send or Mail.Send). These scopes only allow sending messages and **do not** require expensive third-party CASA security audits.
Optional Bounce Scanning (Restricted Scope) — If you explicitly opt-in to automatic whitelisting or scan for bounces, the system may request restricted scopes (gmail.readonly or gmail.insert). This is 100% optional, client-configured, and runs through your own registered cloud application.

4. Data Storage & Encryption

Stored Secrets — Stored locally in chrome.storage.local. Secret keys (like your own OpenAI key or ESP API tokens) are encrypted at rest if you set an Encryption Passphrase.
Prepaid Credits — Your credit balance and billing ledger are verified via secure, cryptographic transactions with our serverless Netlify billing endpoint. One prepaid pool is shared with your Screen Blasts messaging.

5. Optional Online Portal & Cloud Sync

By default everything runs on your device. If you want to compose and send Email Blasts from the online portal (blasts.app/portal) on a phone or tablet — where your device's local keys aren't available — you can turn on "Sync sending accounts to secure cloud for mobile portal access" in the desktop extension. This is strictly opt-in and off by default.

When enabled:

What syncs. Your sending-account credentials — OAuth refresh tokens for connected Microsoft 365 / Gmail mailboxes, your bring-your-own OAuth Client ID (and, for Gmail, Client Secret), and any AWS SES keys. You may also optionally push recipient lists so you can pick them on mobile.
Encrypted in transit and at rest. Data is sent over TLS and re-encrypted on our servers using AES-256-GCM envelope encryption. It is decrypted only in memory during an active send, is never exposed through any read interface, and is used solely to send your own campaigns.
You can erase it any time. Turning the toggle off deletes the synced copy from our servers.

6. Google API Services — Restricted Scope Disclosure & Limited Use

If you connect a Gmail/Google Workspace account, and only for the optional features you explicitly enable, the application may request restricted Google API scopes:

https://www.googleapis.com/auth/gmail.send — Used solely to send cold email campaigns on your behalf at your command.
https://www.googleapis.com/auth/gmail.insert — Used solely to place sent blasts or approved incoming forwards in your own inbox.
https://www.googleapis.com/auth/gmail.settings.basic — Used solely to create safe-sender filters to keep your approved partners out of your Spam folder.

EmailBlasts.app's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is used only to provide or improve user-facing bulk emailing features.
We do not sell Google user data, and do not use or transfer it for advertising, profiling, or creditworthiness.
We do not transfer Google user data to third parties except as needed to provide the feature you enabled, to comply with law, or as part of a merger/acquisition with notice.
We do not allow humans to read your Google user data, except with your explicit consent (e.g., support you request), where required for security, or where the data has been aggregated and anonymized.

7. Contact

For privacy questions, contact support@cockpit.bot

Website: EmailBlasts.app

Publisher: Tips Marketing Services, Corp

Last updated: July 6, 2026