Privacy Policy

Effective October 10, 2026. This policy separates the behavior of legacy extension versions, the final maintenance release, and this website.

Important: Spam Likely is a fallible AI-assisted second opinion. It is not a guarantee that a message is safe or malicious, and it should not be your only security control.

1. Extension versions through 1.5.2

Legacy versions may offer optional automatic scanning. Depending on the settings used, they may send visible-message previews to the AI provider selected by the user. They may also store full message bodies, previews, scan details, statistics, costs, safe-list entries, or pending-analysis data in Chrome extension-local storage for up to 30 days.

Users of a legacy version should update to version 1.5.3 when it becomes available, use the extension’s data-clearing control, and revoke provider API keys before uninstalling.

2. Final maintenance release 1.5.3

Version 1.5.3 is manual only. When the user selects Analyze, the extension sends the sender, subject, current-message text, and extracted links to the configured AI provider. Attachments and quoted thread history are excluded, and current-message text is length-limited.

BYOK analysis requests go directly from the extension to the configured provider. They do not pass through a Spam Likely analysis server. The provider’s privacy, retention, billing, and acceptable-use policies apply.

On upgrade, version 1.5.3 removes legacy email-derived caches and history. New local history is limited to a message fingerprint, timestamp, risk category, confidence, provider, and model. It contains no sender, subject, body, preview, links, prompt, provider response, or failed analysis, retains at most 50 entries, and removes entries older than 30 days during normal use.

3. API keys and extension storage

Provider API keys are stored in chrome.storage.local until the user clears them or removes the extension. In version 1.5.3, the popup writes keys and the background worker reads them; Gmail content scripts do not read the keys or contact AI providers directly.

The extension includes a control to clear all keys and scan data. Clearing a key from the browser does not revoke it at the provider. Users should separately revoke provider keys before uninstalling.

4. AI providers

The final release supports one maintained model from each of OpenAI, Anthropic, Google Gemini, and Mistral. Only the provider selected by the user receives the message submitted for manual review. Spam Likely does not control provider retention or further processing.

5. Website analytics

This website uses Plausible Analytics to measure aggregate website traffic. Plausible applies to website visits only; it is not extension telemetry and does not receive Gmail message content or provider API keys. The local /api/data endpoint is a direct proxy to Plausible’s event endpoint.

6. Hosted plans and accounts

Hosted paid plans were never launched. Account registration, login, checkout, billing, and hosted analysis are retired. Their former URLs now display static retirement notices and do not run authentication, payment, token-processing, or account API code.

7. Chrome Web Store Limited Use

Spam Likely’s use and transfer of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Information accessed from Gmail is used only to provide the user-initiated email-review feature described above and is not sold or used for advertising.

8. User choices

Do not select Analyze if you do not want the configured provider to receive the message data described above.
Use “Clear all keys and scan data” to remove extension-local data.
Revoke API keys in each provider’s account console before uninstalling.
Remove the extension through Chrome to delete its remaining extension-local storage.

9. Contact and policy history

Questions may be sent to hello@spamlikely.app. Material policy changes will remain available at this URL while the educational archive is online.