Privacy Policy

Effective date: February 19, 2026

PhishGuard is a Chrome extension that analyzes emails on Gmail for phishing threats. This policy explains what data the extension accesses, how it is processed, and your rights as a user.

1. Data We Collect

Standard mode — When you scan an email, PhishGuard reads the following from the currently visible Gmail page:

• Sender address and display name
• Email subject line
• Email body text
• Links (URLs) contained in the email
• Attachment information (file names and types)

Enhanced Protection mode (opt-in, Pro) — If you enable Enhanced Protection and grant Gmail API access via OAuth, PhishGuard additionally reads:

• Email authentication headers (SPF, DKIM, DMARC results)

The Gmail API OAuth scope is used solely to retrieve these authentication headers. No other Gmail API data is accessed.

2. How Data Is Processed

Extracted email data is sent over HTTPS to the PhishGuard backend for real-time phishing analysis.

3. Third-Party Services

During analysis, limited data may be shared with the following services:

• AI Analysis Provider — Email content is sent to an AI provider for phishing analysis. This only occurs for non-whitelisted senders. Our AI provider is configured with Zero Data Retention (ZDR) — input and output data is not logged or stored. Current provider: Groq. This may change; the Zero Data Retention requirement remains in place regardless of provider.
• Google Safe Browsing — URL hash prefixes (not full URLs) are checked against Google's threat database.
• Abuse.ch URLhaus — URLs from emails are checked against a known malware URL database.
• AbuseIPDB — IP addresses extracted from email headers are checked for abuse reports.

Each third-party service is governed by its own privacy policy. Data sent to these services is limited to what is necessary for the specific check.

4. Data Stored Locally

PhishGuard stores the following data locally in your browser using chrome.storage:

• Total scan count and phishing detection count
• Summaries of your last 20 scans (sender, subject, and risk score — not the full email body)
• Your Enhanced Protection toggle preference

This data never leaves your browser and is removed when you uninstall the extension.

5. What We Do NOT Do

• We do not store email content on any server
• We do not sell or share personal data with third parties for marketing
• We do not use tracking, analytics, or profiling
• We do not display advertisements

6. Your Control

• You can disable Enhanced Protection at any time from the extension popup
• You can uninstall PhishGuard to remove all locally stored data
• You can revoke Gmail API access from your Google Account permissions page

7. Changes to This Policy

If this policy is updated, the revised version will be posted at this URL with an updated effective date.

8. Contact

For questions or concerns about this privacy policy, contact: enes.ismaili@gmail.com