EmailBlasts.app — Privacy Policy

Decentralized Bulk Emailing & Automation · Chrome & Edge Extension

1. What This Service Does

EmailBlasts.app is a software suite running locally inside your browser (via the Blasts extension) that enables you to compose, pace, and send bulk email campaigns and automated follow-up sequences. All campaigns are routed directly through your own credentials (such as your own AWS SES account or rotating Microsoft 365 / Gmail mailboxes).

This software is decentralized. Your contact lists, message content, and API credentials are kept locally on your own device and are never sent to our servers. We provide the control interface; your email is sent directly from your own browser via OAuth or verified APIs.

2. Data We Access

We do not collect, store, or monitor your email content or contact lists on our servers. The extension does not read your inbox contents, does not scraping pages you browse, and does not harvest contact details for our own databases.

All data processing, including merging list variables (like {{first_name}}), de-duplicating records, cleaning typos, and tracking campaign reports occurs locally inside your browser window.

3. How Email sending Works

Bring-Your-Own OAuth (PKCE) — Connecting a Microsoft 365 or Gmail mailbox uses secure OAuth. M365 requires only a Client ID. Gmail requires a Client ID and Client Secret. Tokens are stored encrypted locally.
Send-Only by Default — Sending email uses standard send-only scopes (gmail.send or Mail.Send). These scopes only allow sending messages and **do not** require expensive third-party CASA security audits.
Optional Bounce Scanning (Restricted Scope) — If you explicitly opt-in to automatic whitelisting or scan for bounces, the system may request restricted scopes (gmail.readonly or gmail.insert). This is 100% optional, client-configured, and runs through your own registered cloud application.

4. Data Storage & Encryption

Stored Secrets — Stored locally in chrome.storage.local. Secret keys (like your own OpenAI key or ESP API tokens) are encrypted at rest if you set an Encryption Passphrase.
Prepaid Credits — Your credit balance and billing ledger are verified via secure, cryptographic transactions with our serverless Netlify billing endpoint. One prepaid pool is shared with your Screen Blasts messaging.

5. Google API Services — Restricted Scope Disclosure & Limited Use

If you connect a Gmail/Google Workspace account, and only for the optional features you explicitly enable, the application may request restricted Google API scopes:

https://www.googleapis.com/auth/gmail.send — Used solely to send cold email campaigns on your behalf at your command.
https://www.googleapis.com/auth/gmail.insert — Used solely to place sent blasts or approved incoming forwards in your own inbox.
https://www.googleapis.com/auth/gmail.settings.basic — Used solely to create safe-sender filters to keep your approved partners out of your Spam folder.

EmailBlasts.app's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is used only to provide or improve user-facing bulk emailing features.
We do not sell Google user data, and do not use or transfer it for advertising, profiling, or creditworthiness.
We do not transfer Google user data to third parties except as needed to provide the feature you enabled, to comply with law, or as part of a merger/acquisition with notice.
We do not allow humans to read your Google user data, except with your explicit consent (e.g., support you request), where required for security, or where the data has been aggregated and anonymized.

6. Contact

For privacy questions, contact support@cockpit.bot

Website: EmailBlasts.app

Publisher: Tips Marketing Services, Corp

Last updated: July 5, 2026