Privacy Policy

Last updated: 18 June 2026

Brise (internally SuperLight for Gmail) is designed to keep your data local by default. There is one exception: the optional read-tracking feature, which can be turned off. This policy describes both, honestly and in full.

Summary

  • Everything the extension does — restyling Gmail, the command palette, keyboard shortcuts — happens locally in your browser and sends nothing anywhere.
  • The only time data leaves your browser is when read tracking is active for an outbound email. In that case a tracking pixel is added so we can tell you when the recipient opens the message.
  • We use no analytics, no advertising, no fingerprinting, no third-party SDKs, and no remote code.
  • Your settings are stored in Chrome's built-in storage and never sent elsewhere.

Local-only behaviour (everything except read tracking)

Brise is a content script that runs only on https://mail.google.com/. It restyles the page and reads its on-screen structure (email rows, toolbar buttons, the current view) in order to apply a decluttered, keyboard-first interface and trigger Gmail's own native actions (archive, snooze, reply, etc.) on your behalf.

This reading and acting happens entirely within your browser tab, in real time. No email content, metadata, recipients, subjects, or message bodies are copied, logged, transmitted, or persisted by these features.

Read tracking (read receipts) — what leaves your browser

When read tracking is active for an outbound email, the extension:

  • Injects an invisible 1×1 tracking pixel into the email you send, hosted on a Brise backend running as a Supabase Edge Function in the EU region.
  • When the recipient's mail client loads that image, the backend records an open event: an opaque random token and the timestamp it was opened.
  • The extension reads those open events back to show you a status (sent vs. opened) and the first-open time.

The backend only ever receives opaque random tokens and timestamps. It does not receive the recipient's address, subject, thread, or any message content. The mapping of token → recipient / subject / thread stays local in your browser (chrome.storage.local) and never leaves your device.

Turning read tracking off

  • Globally — turn off the "Read tracking" setting in the extension popup.
  • Per email — use the read-tracking toggle in the compose window before sending.

What we store

  • Your settings (theme, density, which UI elements to hide, and the read-tracking flag) via the Chrome storage API. These contain no email content.
  • The local token map for read tracking, in chrome.storage.local on your device only.
  • On our backend: for tracked emails only, rows of token + opened_at.

What we do not do

  • No analytics, advertising, fingerprinting, or any third-party SDK.
  • No remote code is fetched or executed.
  • No access to your tabs, browsing history, or any host other than Gmail and our own backend.
  • We do not store or surface recipient IP addresses or User-Agents.

Permissions

  • storage — to save the settings and the local token map.
  • Content script on https://mail.google.com/* — to read the Gmail page and apply the UI, palette, and shortcuts locally.
  • A single host permission to our Supabase backend — solely to serve the tracking pixel and read back open events for read tracking.

We request no tabs and no scripting permission.

GDPR / ePrivacy note

Read tracking detects when an email recipient opens your message. Those recipients have not consented to being tracked. Depending on your jurisdiction, read receipts may require a lawful basis or prior consent. You, the sender, are responsible for using this feature lawfully. We recommend disabling read tracking for recipients in the EU/EEA (and similar regions) unless you have a valid lawful basis.

Data retention & deletion

Settings and the local token map persist until you change them or uninstall the extension. Open events (token + opened_at) on our backend are retained only to power the read-receipt display. To request deletion, contact tech@claap.io.

Contact

Questions about privacy, or data-deletion requests: tech@claap.io.