Privacy policy.

Copyboy uses Google sign-in with the openid and email scopes only. It asks for no Gmail or other Google API permissions.

Your Google account email and ID travel inside the sign-in token, which is verified on each request. The token is never logged or stored on our server. The server keeps only a salted hash of your account ID, in memory, to apply rate limits. Nothing about you is written to disk.

The extension reads the subject and text of the Gmail email you open. By default (Automatic), it checks emails as you open them. Switch to On selection at any time, and Copyboy checks only the emails you pick.

The email’s subject and text, and the sender’s domain, are sent securely to Copyboy’s server for checking. The sender’s domain is used only for the proof score.

For the AI check, emails of 150 words or more are sent to our AI-detection provider, Sapling, with its zero-retention setting on. Only the subject and body text are sent. Sender, recipients, message IDs, headers and attachments are not.

With zero retention on, Sapling doesn’t cache the text, keep it in usage records or save it to history. It keeps a hash for billing.

Copyboy never stores or logs the text of your emails. We keep only scores, for up to 24 hours, and the answers you give to “Was this right?”, none of which include email text.

The extension stores your mode setting, your sign-in session (cleared when Chrome closes), and a local cache of verdicts keyed by hashed thread ID for inbox badges. No email text.

We do not sell or transfer your data to third parties, outside of the approved use cases. Sapling is a service provider processing the text to deliver the feature. We do not use your data for purposes unrelated to Copyboy’s single purpose.

Questions about this policy: [support email TBD]