SendLockPrivacy Policy
1. What We Collect
SendLock keeps as little as it can and still work. This is all of it:
- Your account. When you sign in with Google we receive your email address and your name. We keep your email address, the date you signed up, and when you last signed in.
- A few numbers about each held email. The delay you had set, how much time was left, when it happened, and whether you stopped or cancelled it. These numbers contain no email content. They are kept for 60 days.
- How the extension is used. Events such as installed, settings opened, delay changed, paused or resumed, sent with a random ID to Google Analytics. No email content and no email address.
- If you are on a SendLock Team. The team’s name and email domain, the email addresses of its admins and members, and for each member: when they last signed in, the extension version, whether they are protected, and running counts of emails held, edited, cancelled and sent early. Team admins can see this for the people on their team.
- If you buy SendLock Team. Payment is taken by Stripe. We never see or store your card number. We keep a record of the subscription: the number of people, its status and its renewal date.
2. What We Never Collect
SendLock never sends the content of your emails to our servers and never stores it. That covers email bodies, subject lines, attachments and recipient addresses. To hold an email and to check it for mistakes, the extension works with your draft inside your own browser and your own Gmail account.
We also never collect:
- Your contacts’ names or email addresses
- Anything about the emails in your inbox
- Your Google password
3. Where Your Data Lives
Your settings are stored in Chrome on your own computer. The account, activity and team information in section 1 is stored in Google Cloud (Firebase), in a database only SendLock’s own service can reach.
4. Why We Need Permissions
Some Chrome permissions sound alarming. Here is exactly why we use each one:
- Storage — so your delay setting persists when you close Chrome.
- Identity — only for secure sign-in with your Google account.
- Host permission (https://mail.google.com/*) — so we can step between you and the Send button, give you the customizable delay safety net, and show you the cancel or confirm banner.
We do not request any permission we do not need.
5. What We Share
We do not sell, rent or trade your information. We use four services to run SendLock, and each receives only what it needs:
- Google Cloud (Firebase) stores the information in section 1.
- Stripe takes payment for SendLock Team.
- Resend delivers the emails we send you, such as the welcome email.
- Google Analytics receives the usage events in section 1. This website also uses Google Analytics and Google Ads to measure visits.
Beyond that, the only exception is a court order that legally requires us to hand something over, in which case there is no email content to provide, because we do not store it.
6. SendLock AI (Optional Feature)
SendLock is developing an optional SendLock AI feature that analyzes email tone, emotion, and potential mistakes before sending. This feature is opt-in only and is not yet active. When it launches, here is exactly how it will work:
- You choose to enable it. It will never be on by default. You can turn it off at any time.
- Your email is encrypted before it leaves your browser. The content is transmitted securely to Anthropic's API for analysis.
- Analysis takes approximately one second. The AI evaluates tone, emotional signals, and potential mistakes.
- Only the warning returns. The API returns a signal — for example, "this email reads as frustrated" — and nothing else. Your full email content is never stored or retained.
- Nothing is stored by SendLock. We retain zero email content from AI analysis. Not a word.
About Anthropic's API: SendLock uses Anthropic's commercial Claude API — not the consumer Claude.ai product. Under Anthropic's commercial API terms, your data is never used to train AI models, and API logs are retained by Anthropic for a maximum of 7 days before being permanently deleted. You can review Anthropic's API data policy at anthropic.com/legal/privacy.
Enabling SendLock AI will require separate explicit consent and agreement to additional terms specific to this feature.
7. Security
SendLock passed Google’s Cloud Application Security Assessment (CASA) on the first attempt. The assessment was carried out by TAC Security, an independent authorized lab. Information is encrypted in transit and at rest.
8. Data Retention and Deletion
SendLock does not store Gmail message content on its servers. All email processing occurs locally within your browser.
The numbers about each held email are deleted after 60 days. When an admin removes someone from a team, that person’s team record and counts are deleted. Your account record is kept until you ask us to delete it: email support@sendlock.com from the address on the account.
If you uninstall SendLock, the settings stored in Chrome are removed with it. You can revoke SendLock’s access to your Google account at any time at: myaccount.google.com/permissions
9. Changes to This Policy
If we change what we collect or how we handle your data, we will update this page and the "Last updated" date at the top. No hidden changes. Ever.
Questions about this policy? Email us at support@sendlock.com. We are based in Milwaukee, WI, USA.