EmailAuthCheck - Privacy Policy

The short version

EmailAuthCheck verifies email authentication headers (SPF, DKIM, DMARC) directly in your webmail. It runs only on Gmail and Outlook Web and can contribute anonymized authentication statistics to help improve email security for everyone.

What EmailAuthCheck does

EmailAuthCheck reads the authentication headers of emails in your Gmail or Outlook Web inbox and displays the SPF, DKIM, and DMARC verification results in a clear, visual format. It helps you spot spoofed or unauthenticated emails before you trust them.

Data collection

EmailAuthCheck does not collect your name, email address, email content, or any personally identifiable information. There is no account and no registration.

The extension reads only email authentication headers (SPF, DKIM, DMARC results). It does not read email bodies, subject lines, sender names, or attachments.

When you opt in to crowdsourced protection, EmailAuthCheck contributes anonymized authentication statistics to a shared database. This includes aggregated pass/fail rates for SPF, DKIM, and DMARC across sending domains. It never includes email content, sender or recipient addresses, or anything tied to you personally.

Network activity

EmailAuthCheck makes network requests only when crowdsourced contributions are enabled (opt-in). In that case, it sends anonymized authentication statistics to the Excalion API.

All header parsing and verification display runs entirely in your browser.

Permissions

• activeTab: to access the current email page and read authentication headers
• storage: to save your preferences locally
• content script on Gmail and Outlook Web domains only: to inject authentication result badges into the email interface. The content script runs exclusively on mail.google.com and outlook.live.com / outlook.office.com domains.

Where your data lives

Your preferences are stored locally in chrome.storage.local. This data never leaves your device. If you uninstall the extension, this data is deleted automatically by Chrome.

Third-party services

None. EmailAuthCheck does not share any data with third parties. Crowdsourced contributions go only to the Excalion API and are fully anonymized.

Cookies and tracking

EmailAuthCheck does not use cookies and does not track you in any way.

Supported browsers

EmailAuthCheck works on Chrome, Edge, and Brave. This privacy policy applies equally to all supported browsers.

Changes to this policy

Any changes will be reflected in extension updates. The date at the top of this page will be updated accordingly.

Contact

For questions about this privacy policy: hello@excalion.io