Privacy policy

Last updated: 25 September 2026

What every heyyoshi extension promises

heyyoshi makes a growing set of small browser extensions. They do not share code, but they share one posture, and this single policy covers all of them, including any that have not shipped yet:

• No account with us, no heyyoshi server, no analytics, no telemetry, no advertising, no remote code. There is nothing to sign up for with heyyoshi, and nothing of yours running on a machine we control, because we do not run one.
• Each extension talks only to the service it is built to work with, using the login already in your browser, and to nowhere else. Depot and Intact only read; Mailplate is a mail merge that also sends, through your own Gmail. Chrome enforces the list of hosts each one may contact from its manifest, which is a stronger promise than a policy document can make on its own.
• Anything an extension keeps stays on your own device. Templates, the people on your lists, backups and exports are written to your own computer and uploaded to no server of ours. They are not synced between your devices and not visible to anyone but you.
• You get nothing back from us, because we receive nothing. No mail from us, no dashboard, and no report on who opened or clicked what, because none of that is ever collected.

What each tool touches

Each extension reads only what it needs, in memory and only while you are using it, and Mailplate sends only what you tell it to. Here is what that is, tool by tool:

Mailplate is the one tool here that sends, so it is worth being exact. It is a mail merge: you write one message, and it sends a personalised copy to each person on your list from your own Gmail. When it sends, that message, the address it is going to, and a Google access token go to Google's Gmail API, which is the same path any mail takes when it leaves Gmail. They go there and nowhere else: not to a heyyoshi server, because there is none, and not to any third party. Your list of people is kept in your browser and is never uploaded as a list; only the individual messages you choose to send are handed to Gmail, one at a time, exactly as if you had typed and sent each one yourself.

Between connecting an account and sending, Mailplate talks to four Google hosts and nothing else: Gmail itself, to add the compose button and read the message you are writing; Gmail's send API, to send each message; Google's userinfo endpoint, to read the address of the account you connect so a send can never claim to come from an address you did not authorise; and Google's token endpoint, to revoke the token when you disconnect. The access token comes from Google when you connect and is stored on your device. It lets Mailplate send as you, and, because of the scope it asks for, it cannot read your mail.

Depot writes to your Claude account only when you explicitly confirm an action: duplicating a project, restoring from a backup, synchronizing a Shared Library group, or saving an edited document. For project duplication and restoration, it shows a pre-flight dry run of precisely what it will create first, writing nothing until you confirm. Your original projects are never modified without confirmation.

One honest limit, worth stating because it is not obvious: claude.ai only exposes a downscaled webp preview of an uploaded image, not the original file. Depot saves those previews, clearly labelled as previews, because the original is not something it can reach. That is a claude.ai limit, not a Depot one.

Intact is not released yet. When it ships it follows the same rules, and this policy already covers it.

What they read

Each extension reads only what its job needs, in memory and only while you are using it, and nothing else on the page. Mailplate reads the message you are composing, and, once you connect an account, that account's email address so it can show you which address a message will send from; Depot reads your Claude Projects list and a chosen project's instructions and text documents; Intact reads the one conversation you ask it to save.

None of them reads anything else. Not your other messages, your inbox, your other projects, your contacts, or your account details. Mailplate's send permission can send but cannot read a single message in your mailbox. None of what any tool reads is logged by us, and none of it remains once you close the page or finish the task.

What they store

Everything these extensions save is written to your own device and to no server of ours. Mailplate keeps your templates, your lists of people, your saved messages and the pace and settings of each send in your browser local extension storage (chrome.storage.local) on that device, along with the record that your Google account is connected. Depot writes backups as zip files on your computer. Intact writes each conversation as a file on your computer.

None of it is synced between your devices, backed up anywhere, or visible to anyone but you. For anything kept in extension storage, uninstalling the extension deletes it, so if a saved template or a list matters to you, copy it out first. Files you have already saved to disk, like a Depot zip or an Intact export, are ordinary files and stay where you put them.

What they send

Depot and Intact send nothing. They read from claude.ai or ChatGPT using your own login and write to your own disk; they contain no code that contacts a heyyoshi server, because there is none, and you can watch the Network tab stay empty of anything but the site you are already on.

Mailplate sends, because sending is its job. When you send, the message, the address it is going to, and a Google access token go to Google's Gmail API over HTTPS, and to nowhere else. That is the same path any email takes when it leaves Gmail. Nothing goes to a heyyoshi server, and there is no analytics, telemetry or crash reporting in any of these tools.

You do not have to take our word for it. Open your browser developer tools, switch to the Network tab, and use the tool. With Depot or Intact it stays empty. With Mailplate you will see requests to Google when you send, and to no one else, which is exactly what a tool that sends your mail through your own Gmail and reports to nobody should look like. The source ships readable as well, because the Chrome Web Store forbids obfuscated code.

One consequence worth stating plainly: if a message you preview or send links to an image hosted somewhere else, your browser or your recipient's fetches that image from its host while showing it, exactly as on any web page. That request goes to whoever hosts the image, not to heyyoshi.

Permissions, and why each is needed

Every permission an extension requests is there to do the job, and nothing wider. For Mailplate:

The two Google scopes are the narrow pair gmail.send and userinfo.email, and nothing else. gmail.send can send and cannot read a single message in your mailbox; userinfo.email reads the address of the account you connect. You can see both on Google's consent screen when you connect.

Depot asks for access to claude.ai to read your own projects and create a duplicate when you confirm one, a side panel for its interface, and scripting so the first click connects even on a tab opened before you installed it. Between them these extensions ask for no broad host access and no remote code. Intact is still in development; when it ships, its permissions will be listed here in the same way.

How Mailplate uses Google user data

Mailplate's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms, and for the avoidance of any doubt:

• Used only to provide the feature you can see. Google user data is used for one thing: sending your mail merge from your own Gmail account, which is the feature in front of you in the interface. It is used for nothing else.
• Never transferred. It goes to no third party, and there is no heyyoshi server for it to go to. It is never sold, rented, licensed or shared.
• Never read by a human. Not as a promise you have to take on trust: with no server and no logging, there is nothing anywhere for anyone to read.
• Never used for advertising of any kind, including personalised, retargeted or interest based advertising.
• Never used to train a model. It is not used to develop, train, improve or evaluate any artificial intelligence or machine learning model, generalised or personalised. Mailplate contains no AI or machine learning model of any kind. Stated in the form Google asks for: the use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

For Mailplate, Google user data means exactly two things: the access token Google issues when you connect an account, and the email address of that account. Everything above applies to both. The templates you write and the lists you import are your own content rather than Google user data, and what happens to those is described under What they store.

How Google user data is protected

Mailplate holds very little, and this is what protects what it does hold:

• In transit. Every request to Google goes over HTTPS with TLS. Chrome enforces the list of hosts the extension may contact from its manifest, so there is no route to an unlisted destination even if the code tried to take one.
• At rest, on your device. The access token and the connected address are written to chrome.storage.local. Chrome isolates that storage to this one extension: no website you visit and no other extension you have installed can read it. It is not synced to any account and it does not leave the machine.
• No shared secret to steal. Mailplate uses an OAuth flow that needs no client secret, so there is no credential inside the extension package that could be extracted and used against your account.
• The narrowest scope that works. The token is limited to gmail.send and userinfo.email. Even in the worst case, a token taken from your device cannot read a single message in your mailbox, because the scope it carries cannot.
• Short lived. Access tokens expire about an hour after Google issues them, and Mailplate stores no refresh token, so an expired token is worthless and a new one means Google authenticating you again.
• No server to breach. The largest risk to data in most products is the company's own database. There is no heyyoshi database, no backup of your data and no employee access, because none of it exists.

One limit stated plainly, because a list of strengths with no limit in it is not worth reading: the token is protected by Chrome and by your operating system account, not by a passphrase only you know. Anyone with your unlocked computer and your browser profile could reach it, exactly as they could reach your signed-in Gmail itself. Disconnecting revokes it at Google immediately, which is why the next section exists.

How long Google user data is kept, and how to delete it

Mailplate keeps Google user data only while it is needed for the send you asked for, and you can remove all of it at any time.

That is the whole list. Nothing else derived from your Google account is kept, because nothing else is ever read: Mailplate does not copy, index or archive your mailbox, and holds no permission that would let it.

Any one of these three deletes it, and none of them depends on us:

• In Mailplate, use Disconnect account. That calls Google's revocation endpoint, so the token stops working at Google's end as well, and removes it from your device.
• In your Google account, at myaccount.google.com/connections, find Mailplate and remove its access.
• Uninstall the extension. Chrome deletes its storage, and everything Mailplate kept lived in that storage.

Because there is no heyyoshi server, there is no copy held anywhere else for you to request the deletion of, and no retention clock running on a machine you cannot reach. Gone from your device and revoked at Google is gone.

Disconnecting your Google account

Mailplate only sends after you connect a Google account, and you can disconnect it at any time. Either of these is enough on its own:

• In Mailplate. Use Disconnect account. That revokes the token with Google and removes it from your device.
• In your Google account. Go to your Google Account, Security, then the third-party apps with account access, at myaccount.google.com/connections. Find Mailplate and remove its access.

Uninstalling Mailplate also removes the token and everything else it kept, because all of it lived in the extension's own storage on your device.

Children

These are general purpose tools and are not directed at children. Since they collect no personal information from anyone, they collect none from children either.

Changes to this policy

If any heyyoshi extension ever changes in a way that affects this policy, the policy is updated here and the date at the top revised. Should a future version, or a future tool, ever send somewhere new, or collect anything for us, it would be disclosed here first, and would not be switched on without asking you.

Contact

Questions about this policy, or about anything one of these extensions does, can go to the Support tab on that tool's Chrome Web Store listing, which reaches the developer directly, or to the developer email address shown there. The studio is heyyoshi, built by Yoshi Bansal.