Media
2 items
Description
Gmail alerts, unread badge and quick actions. Mail stays in the extension; web OAuth is encrypted through SafeX without storage. Checker for Gmail™ is a privacy-first browser extension for monitoring and managing Gmail in Google Chrome and supported Chromium browsers. Privacy boundary: There is no developer-operated backend in the Gmail mail-data path. Gmail messages, account information, message bodies, and search results are processed inside the extension and sent directly between the extension and Google—not through SafeX. Supported non-Chrome Chromium browsers use SafeX only as a stateless OAuth exchange and refresh proxy. The extension encrypts OAuth authentication values with a SafeX server public key pinned in the extension and a fresh per-request key. The proxy decrypts them only in process memory to exchange or refresh with Google, and SafeX does not store or log them. Gmail mail data is never sent to this proxy. Why it is safer: • No backend server receives or relays your Gmail mail data • No developer database stores messages, account details, or OAuth credentials • No telemetry, analytics, advertising, or behavioral tracking • In Google Chrome, Chrome Identity manages the access token; the extension does not persist it • In supported non-Chrome browsers, each authorized account has a separate OAuth grant in extension-local chrome.storage.local • Authorization codes, PKCE verifiers, and OAuth tokens are application-layer encrypted in both directions during SafeX exchange and refresh • TLS/CDN intermediaries can see connection metadata such as source, destination, timing, and size, but not the authenticated OAuth content • SafeX decrypts OAuth values only in proxy process memory to forward them to Google, without storage or logging; this is not end-to-end encryption from the extension to Google • Mail cache and queued action intents remain in the extension’s local storage • Settings exports never include messages, Gmail content, account emails, cookies, or OAuth tokens • Explicit remote images are shown by default and can be disabled to reduce sender tracking risk • Disconnect account clears the selected account’s associated local extension data; the Chrome path clears Chrome Identity state, while the non-Chrome path clears that account’s local grant and requests Google revocation Features: • View unread Gmail messages from the toolbar popup or side panel • See sender, subject, snippet, time, and unread count • Receive desktop notifications, optional sounds, and text-to-speech alerts • Read full Gmail conversations inside the extension • Search Gmail messages • Mark conversations as read or unread • Archive, star, mark important, report spam, or move conversations to trash • Compose new messages and send replies • Open conversations directly in Gmail • Switch between available Gmail accounts • Customize polling, notifications, theme, accent color, and remote-image behavior How authorization works: Basic unread information can be read from Gmail’s Atom feed using your existing Gmail website session, without OAuth. Full messages, search, changes, composing, and replies require Google OAuth because Gmail’s Atom feed does not provide those capabilities. Google may request authorization again if access expires or is revoked. In Google Chrome, authorization uses Chrome Identity. In supported non-Chrome Chromium browsers, authorization uses Google web OAuth with authorization code, PKCE, and state. The resulting per-account grant stays in extension-local storage. For every exchange or refresh, the extension creates a fresh ephemeral X25519 key and nonce, encrypts the OAuth request to the pinned SafeX X25519 public key, and accepts only a valid encrypted response to that ephemeral key. Plaintext or unauthenticated responses are rejected. Data flow: • Basic unread data: Gmail Atom → extension • Gmail API data and actions: extension ↔ Google • Chrome OAuth: extension ↔ Chrome Identity ↔ Google • Supported non-Chrome OAuth authentication values: extension ↔ encrypted SafeX stateless proxy transit; SafeX decrypts only in process memory ↔ Google • Gmail mail data: never sent to SafeX • SafeX website services: privacy policy, terms, and user-initiated feedback Checker for Gmail™ is an independent extension and is not affiliated with, endorsed by, or sponsored by Google LLC. Gmail is a trademark of Google LLC.