Décodeur d'arnaques par e-mail

Privacy policy — Email scam decoder

Dated 8 August 2026. This page is the reference for the Chrome Web Store listing. Version française : politique de confidentialité.

In one sentence

The extension reads the message you have open in Gmail, analyses it on your own machine, and sends nothing to anyone — not to its author, not to a third-party service, not to an analysis server. There is no server behind this extension.

What the extension reads

The full content of the Gmail message currently open: technical headers, sender, subject, body, links, and the list of attachments with their content.

This is what the job requires. An extension that explains that a displayed link does not lead where it claims has to read that link, and an extension that explains that SPF authentication failed has to read the headers Gmail does not show.

Only the open message is analysed, and only on https://mail.google.com. The extension does not go through your mailbox, does not read closed messages, and has no access to any other tab or any other site.

It reads a file on your computer in one case only, and only the one you hand it: the options page lets you drop a saved message (.eml) to examine it. Nothing is scanned, nothing is opened on the extension’s own initiative, and the dropped file is not kept — it disappears with the tab.

One precision, because it is verifiable in the code and glossing over it would be dishonest: to locate Gmail’s session token, the extension may scan the text of the whole page. It looks for three precise patterns, keeps only that token, and retains nothing else.

What leaves your browser: nothing

No message content is transmitted, to any recipient, at any time. There is no account, no sign-up, no identifier, no analytics, no usage statistics, and no remote error reporting. The code contains no library capable of making such a request.

One single network request is made, and it deserves to be described precisely rather than glossed over:

• it goes to https://mail.google.com, that is, to Gmail itself, never anywhere else;
• it is exactly the request your browser already makes when you click “Show original” in a message’s menu;
• it retrieves the raw message, which Gmail does not expose in its page;
• it sends nothing but the identifier of the open message, the session token Gmail places in its own page, and the cookies of your current session. That token is never stored: it lives for the duration of the request;
• it is triggered by opening a message, and the cache described below means a given message is usually fetched once. A message reopened after the cache expired, or too large to fit in it, is fetched again.

Saying “no network requests” would be shorter, and untrue.

A message you drop yourself on the options page makes no request at all: it is already on your machine, and the extension has nothing to ask anyone in order to read it.

What is kept on your machine

Everything is stored through storage.local, the extension’s local area, on your computer. storage.sync — which would relay data through your browser vendor’s servers — is deliberately avoided: a list of senders is a list of the people you correspond with.

Data	Exact content	Limit
Raw message cache	The complete content of recently analysed messages: headers, body, and encoded attachments	50 messages, 7 days, 4 MB in total, and 512 KB per message — beyond which the message is not cached at all
Learned contact book	For each correspondent: address, display name, authentication domain, date first seen, number of messages received	500 correspondents and 500 domains; the least seen are forgotten first
Excluded senders	The senders you have yourself marked as legitimate	500; the oldest exclusions are forgotten beyond that
Preferences	The chosen language	none

A message you drop yourself enters none of those four rows. It is not cached — the cache exists to avoid a network request, and there is none here — and it does not feed the contact book: people usually drop a message they distrust, and recording its sender as a known correspondent would silence the extension on that sender’s next message.

Two points the brevity of that table might hide:

• The raw cache holds real emails. It is the most sensitive data the extension handles. It exists so that reopening a message does not ask Gmail for it again. An entry stops being used after seven days; it is erased from disk at the next analysis, or sooner if newer messages have pushed it out. If you stop opening messages, it waits for that next analysis — or for uninstalling, which erases everything at once. A large message — a big attachment — is never placed there at all.
• The contact book builds itself by observing the messages you open. It is what lets the extension notice that a familiar sender is suddenly writing from a different domain. It does not contain message content.

Erasing this data

• The “Erase local data” button on the options page erases everything above: the cache, the contact book, the exclusions and the language. It asks for confirmation, and it leaves nothing behind.
• Uninstalling the extension achieves the same.
• Excluded senders can also be removed one by one, if you would rather not erase everything.
• Clearing Gmail’s site data in Chrome’s settings changes nothing here: this data belongs to the extension, not to the site.

Permissions requested

Permission	What it is for
Access to https://mail.google.com	Show the analysis inside the page and read the open message. This is the only site the extension can reach.
storage	Keep the cache, contact book, exclusions and language locally.

The extension does not request access to your tabs, history, bookmarks, downloads, or any other site. Dropping an .eml file requires no permission either: you hand over the file yourself, as in any file upload form.

What the extension never does

It does not act on your mail: no deleting, no blocking, no moving, no automatic replies, no reporting. It displays nothing outside Gmail and its own options page. And it never states that a message is safe — at most that no known signal was detected, which is not the same claim.

It monitors no other mailbox. Dropping an .eml is a one-off examination of a file you saved yourself; it grants access to no account, and it should not be read as protecting the mailbox the file came from.

Selling, sharing, training

Since no data is transmitted, no data is sold, shared with third parties, used for advertising, or used to train any model. None of that would be possible without infrastructure that does not exist.

Verify rather than trust

The source code is public, and on a page like this one that is the only argument worth anything. Two places to start reading:

• src/adapters/gmail/view-om-source.ts — the project’s single network call;
• src/adapters/cache/raw-cache.ts and src/adapters/storage/ — everything written to disk.

Changes

Any change to this policy will be published on this page, with its date. Should a future version ever transmit anything outside your browser, it would be announced here beforehand and would remain subject to your consent.

Contact

Through an issue on the project’s public repository.

This site is open source. Improve this page.