The short version. Stonephish makes no network requests of any kind. There is no server, no account, no sign-in, no analytics and no ads. Every judgement it makes happens inside your own browser and is then forgotten. We hold no database of your data because we never receive any.
You do not have to take our word for this. The extension’s
manifest.json declares no host permissions, which means
Chrome will not let it contact any server even if it tried. You can confirm it yourself
in a few seconds: open your webmail, press F12 for developer tools, choose the
Network tab, and reload. Stonephish makes no requests.
To tell you whether a message is safe, Stonephish has to look at the message you have open. Inside that message, and only that message, it reads:
It reads only the message on screen. It does not scan your mailbox, your other messages, your contacts, your calendar, or anything outside the page you are on. All of this happens in the browser tab you already have open, and none of it is copied, uploaded or transmitted.
Only on these eleven sites, which are named explicitly in the extension’s manifest:
mail.google.com · outlook.live.com · outlook.office.com · outlook.office365.com · mail.yahoo.com · mail.aol.com · mail.proton.me · account.proton.me · www.icloud.com · mail.zoho.com · app.fastmail.com
It holds no permission to run on any other website, and cannot be granted one without a new version and a new install prompt that you would have to accept.
| Stored | Where | Why |
|---|---|---|
| Recent link and sender verdicts | Your browser, expires after 30 minutes | So the same link isn’t re-checked as you scroll |
| Newsletters it has seen | Your browser | So the “Clean up inbox” tab can list them |
Both live in your browser’s local storage, on your device. Neither is synced to
a Google account — chrome.storage.sync is deliberately not used.
Uninstalling Stonephish deletes everything, and you can clear the newsletter list at any
time with the Empty list button in the popup.
| Permission | Reason |
|---|---|
| Access to the eleven mail sites listed above | To read the open message and show the warning above it. This is the extension’s entire function. |
| Storage | To cache verdicts and remember your newsletter list, on your device only |
That is the complete list. Version 1.0 deliberately does not request access
to all websites, the scripting permission, or the tabs
permission. An earlier internal build used broad site access to press the confirm button
on unsubscribe pages for you; we removed it, because holding the most powerful permission
in the browser to save you one click is not a trade worth making. Stonephish now opens
each unsubscribe page and leaves the click to you.
Stonephish bundles one third-party library, jsQR (MIT licence), which decodes QR codes from images. It runs locally and makes no network requests. No other third-party code is included, and no code is loaded remotely.
Stonephish is not directed at children under 13 and does not knowingly collect information from them. Since it collects no personal information from anyone, this is a statement of design rather than of policy.
If this policy ever changes materially — in particular, if Stonephish ever begins sending data to a server we operate — we will update this page and say so plainly in the release notes before that version ships, and the new version will require your consent through Chrome’s own permission prompt. We will not quietly broaden what is collected.
Questions about this policy: [email protected]
Stonephish