Privacy Policy

Effective date: 10 September 2026 · Last updated: 7 October 2026 · Products: Email Tracking Chrome extension and SentCue Email Assistant for ChatGPT · Works with Gmail on the web, extension version 1.3.2 · Chrome extension hosted by SentCue

For a short product summary (local history, no account, no footer), see privacy-first email tracking. This policy is the legal text.

Not legal advice. A signal is not proof that a particular person read a message.

Contents

1. Who we are
2. Who is controller and who is processor
3. How email tracking works
4. Data we process as controller (you, the sender)
5. Local history, reminders, and notifications
6. Data we process as processor (recipients)
7. Problem reports and uninstall feedback
8. Activation metrics
9. Optional setup diagnostics
10. Google, Chrome, and Limited Use
11. SentCue Email Assistant for ChatGPT
12. How we use information
13. Service providers
14. Retention, deletion, and your controls
15. Your rights (senders)
16. If you received a tracked email
17. Security
18. This website and cookies
19. Waitlist and feature requests
20. Children and prohibited uses
21. International processing
22. What this version does not do yet
23. Changes
24. Contact

1. Who we are

SentCue operates Email Tracking, a Chrome extension that can insert a 1×1 tracking image into messages you choose to track from Gmail on the web, then show you an activity signal in Sent. The current version (1.2) also keeps a local history and optional reminders on this Chrome install. We do not provide Gmail, we are not affiliated with Google, and we do not use the Gmail API or Google OAuth in this version.

Privacy contact: privacy@sentcue.com. Website: https://sentcue.com. The data controller for data we process as controller is the operator of Email Tracking. You can contact the operator at privacy@sentcue.com.

2. Who is controller and who is processor

Under some privacy laws, you decide why recipient data is processed. SentCue processes only the tracking ID and timestamps needed to provide activity signals. Applied to this version of Email Tracking:

• You (the sender) decide whether to track, whom you email, and for what purpose. For personal data relating to your recipients and to tracking those messages, you are the data controller (or equivalent under applicable law).
• SentCue provides the technical feature. For token, timestamps, and coarse client class created when a tracking image is requested, we act as a data processor on your instructions, only to show you the disclosed activity-signal feature and to operate and secure the service.
• For our own records of your install (settings, disclosure acknowledgement, install identifier, support email you send us) and for this website, SentCue is the controller.

We do not currently offer a signed enterprise Data Processing Agreement. This policy is not a claim of “100% GDPR compliance.”

3. How email tracking works

If you accept the in-product disclosure and turn tracking On, the extension may add a small image whose URL contains a random token, for example on https://pixel.sentcue.com/p/{token}. When a mail client, image proxy, or scanner requests that image, our origin may record that the token was requested after the Gmail Undo window.

You can turn tracking off for one message in Gmail compose (“Track this message”). Global Off in the toolbar popup always wins: if activity detection is off there, no tracking image is added, even if the compose checkbox is on.

We treat that request as an activity signal, not as proof that a named person read the mail. Providers (including Google Image Proxy), security scanners, caching, disabled images, and you opening your own Sent copy can all produce or hide a signal. Signals while Gmail can still undo the send are not counted. Scheduled Send is not supported.

Unlike some trackers, we do not store recipient location, and do not persist recipient IP or raw User-Agent in the application database, and do not do link-click tracking in this version.

4. Data we process as controller (you, the sender)

• Install-scoped random identifiers and a hashed secret used to authenticate API calls from your Chrome install (no Google account is required for SentCue).
• Coarse activation receipts (once per install): whether Gmail was opened, whether the tracking disclosure was shown / accepted / snoozed, whether a compose window was seen, whether tracking was enabled, and whether a tracked send was attempted — together with the extension version and your existing random install identifier. No message content, addresses, or identifiers. See activation metrics.
• If you separately opt in to Help improve setup, the additional diagnostics marker described in the optional diagnostics section.
• Extension settings: disclosure accepted, tracking On/Off, cached kill-switch / pixel_base.
• Locally in Chrome only (not sent to our backend in this version): Gmail To, subject, a derived fingerprint, Gmail thread/message identifiers so the circle can sit on the correct Sent row, plus the history and reminder records described below.
• If you email us: the content of that message and the address you use.

We do not collect message bodies, attachments, passwords, authentication cookies, or Gmail request bodies.

5. Local history, reminders, and notifications

Starting in version 1.1, Email Tracking keeps a local history of messages you sent with tracking on: subject, recipient address, send time, Gmail route identifiers, activity-signal count, and any reminder you set. Version 1.2 adds search, filters, and simple follow-up / done labels on that same local history. This history is stored only in your browser (chrome.storage.local). It is never sent to our server, and we cannot see it.

History is cleared when you remove the extension or use Delete tracking data for this install in the popup. Old rows are pruned automatically after 90 days or once you exceed 500 stored messages. Rows with an active reminder are kept longer; active reminders are never silently dropped. You can have at most 100 active reminders, and a reminder cannot be set more than 90 days ahead.

From History you can ask to be reminded about a sent message — at a specific time, or only if no activity signal has appeared yet. Reminder times stay on this device. Chrome alarms are used to wake the extension for status checks and due reminders.

With your permission (a separate, optional Chrome notifications permission you grant explicitly), the extension can show a desktop notification: once, the first time we detect a qualifying activity signal on a message you sent, and once when a reminder you set becomes due. You can revoke this permission in Chrome’s extension settings. In the popup you can also turn first-signal notifications off without turning off reminders you set. Tracking and history continue without desktop notifications; you simply will not see them.

What still never leaves your browser: recipient address, subject line, and Gmail thread/account identifiers. For tracking, our server receives a random per-message token, a compose id, and send time — used only to detect and count activity signals. Optional setup diagnostics are a separate, explicit choice described below and are not required for tracking.

6. Data we process as processor (recipients)

Recipients do not install Email Tracking. If a tracked image is requested, we may store:

• the random token;
• send / arm / cancel timestamps and qualifying image-request timestamps;
• a coarse client class only: google_image_proxy, sender_chrome, scanner, or other.

Network infrastructure (Cloudflare) necessarily sees IP address, User-Agent, and basic HTTP metadata to serve the image. The SentCue application is designed not to persist recipient IP, raw User-Agent, or full HTTP headers. Origin access logs redact tokens (/p/[token]).

Recipient email address, subject, and Gmail thread id stay in the sender’s browser in this version. They are not written to the SentCue backend.

We do not use recipient activity data for advertising, profiling, credit decisions, or sale to data brokers. We do not build a marketing profile of people who did not install the product.

7. Problem reports and uninstall feedback

The extension offers a “Report a problem” form (from the popup and from the history page) and, if you remove the extension, an optional short survey that the browser opens automatically. Both submit to POST /feedback on pixel.sentcue.com. Neither ever sends a message subject, recipient address, message body, Gmail thread id, or tracking token — the form warns you not to paste message content into the optional description field.

• Problem reports (authenticated, from the extension): a problem type from a fixed list, the extension version, a coarse browser version, an optional free-text description you write yourself, and your install identifier, sent only after you give explicit consent in the form.
• Uninstall feedback (anonymous, from the uninstall page): your free-text answer to “Why did you remove Email Tracking?” (up to 1,000 characters) and the extension version. Answers given before 5 October 2026 may instead hold a reason from a fixed list and its row number. It carries no install identifier, account, or other identifier linking it back to you, and answering is optional. Please do not type email addresses or other personal details into the answer.
• Install, update and uninstall events (from version 1.2.9): when the extension is installed or updated it sends the event type and extension version with your install identifier, and receives a random uninstall token. If you remove the extension, the browser opens a link with that token, and the service marks the install as removed before showing the survey page. These records are used only for aggregate counts (installs, active installs, removals) and are never linked to message data or to the survey answer.

We do not persist the IP address, raw User-Agent, or request headers of either submission. Stored feedback rows are kept under the same 90-day retention as other operational data (see §11) and are then deleted automatically. Delete tracking data for this install (POST /delete-install) removes problem reports tied to your install identifier. Anonymous uninstall feedback carries no install identifier to delete by, so it is not affected by that control and simply expires with the rest of the retention window.

Activation metrics

From extension 1.3.4, the extension sends authenticated POST /onboarding receipts for these coarse stages so we can see where setup stops: gmail_opened, disclosure_shown, disclosure_accepted, disclosure_snoozed, compose_seen, extension_ready, tracking_enabled, and send_detected, plus the extension version and your existing random install identifier. Each stage is recorded at most once per install. This is product reliability telemetry, not advertising. It contains no email content, addresses, account details, thread or message identifiers, IP, or raw User-Agent. Rows are deleted by Delete tracking data for this install and by the normal 90-day retention job.

Optional setup diagnostics

The extension also offers a separate, optional setting called Help improve setup (in the popup under Settings). It is independent of the tracking On/Off control and is off by default. When enabled, it sends an additional diagnostics_enabled marker via the same authenticated endpoint. Disabling it stops that marker from being queued and clears any unsent diagnostic-only receipts from local storage; activation metrics above continue.

The optional marker is recorded at most once per install together with the extension version. The server records when it received the receipt; it does not receive an offline click time.

A send_detected receipt means only that a tracked send attempt was observed; it may still be undone in Gmail. A server-accepted receipt may also occur before Undo and only confirms that the activation check found a non-cancelled tracking token. It is not a claim that a message was delivered, opened, or read. Diagnostics never include Gmail To, subject, body, attachments, account URL, thread or message identifiers, IP address, or raw User-Agent, and are not joined to tracking events for marketing or advertising. There are no automated analytics or marketing integrations for this collection.

Declining, or later turning the setting off, does not change tracking. Turning it off stops future receipts and clears unsent diagnostic receipts; receipts already stored remain only until you use Delete tracking data for this install or the 90-day retention limit. No diagnostics are sent retroactively for activity that happened before opt-in. The diagnostics rows are deleted by the same install-deletion control and by the normal 90-day retention job.

8. Google, Chrome, and Limited Use

This version does not call Google Workspace APIs, does not use Gmail OAuth, and does not receive Gmail data through Google’s API. The extension uses:

• a content script on https://mail.google.com/*;
• storage — settings, local history, reminders, and Sent row binds;
• alarms — status polling and due reminders;
• optional notifications — desktop alerts you grant separately;
• host access to our pixel origin.

Any user data the extension handles is used only to provide or improve its disclosed single purpose (activity signals for mail you send from Gmail on the web, plus local history and reminders on this install), for security and operations, or where required by law, consistent with the Chrome Web Store Limited Use requirements. We do not use that data to train generalized AI/ML models. Details: Google and Chrome disclosure.

9. SentCue Email Assistant for ChatGPT

SentCue Email Assistant for ChatGPT is a skills-only ChatGPT plugin. It does not connect to Gmail, access your inbox, send email, install or control the Email Tracking Chrome extension, or provide live email analytics. It operates only on text or redacted activity information that you voluntarily provide in your ChatGPT conversation.

SentCue does not receive, transmit to its servers, or store that conversation content. OpenAI handles conversation data under its applicable terms and privacy policy. SentCue does not control or direct OpenAI’s processing of conversation data.

A link to the Email Tracking Chrome extension is shown only after you explicitly request it or opt in. Showing that link does not install or control the extension.

10. How we use information

• Provide the activity-signal feature you enabled;
• Hide signals during the Undo window and honour cancel;
• Deduplicate repeats within 10 minutes;
• Show Recent and History only on this Chrome install;
• Fire optional desktop notifications for a first qualifying signal and for reminders you set;
• Operate the kill switch, rate limits, and deletion;
• Comply with law and valid legal process.

Where data-protection law requires a legal basis for processing we control, the basis depends on the activity: contract for providing the extension you installed, legitimate interests for security, abuse prevention, and basic site operation, and consent where we explicitly ask you to approve an optional activity. The in-product disclosure is your choice to enable tracking; it is not consent from a recipient.

You must determine whether you have a lawful basis for tracking recipients and whether notice or prior consent is required in your circumstances. Rules differ by jurisdiction and context. For example, ePrivacy and PECR-style rules may apply to tracking pixels in addition to general data-protection and electronic-marketing rules. We do not automatically geo-block recipients in any region.

11. Service providers

We use infrastructure needed to serve the site and the tracking image. Their policies apply to data they process as our providers.

No advertising networks. Google Analytics and Amplitude measure visits to this site. Neither receives email content.

12. Retention, deletion, and your controls

Token and event rows on the server are kept at most 90 days from send_at, then deleted by the retention job. Cancelled tokens never count as a qualifying signal. Tracking is Off until you accept disclosure. Global Off stops new pixels. Per-message Off in compose stops a pixel for that send. Kill switch fail-closed: no successful remote config → no pixel.

Local history on this install is also capped at 90 days / 500 rows, as described in Local history, reminders, and notifications.

Delete server rows and local history for this Chrome install from the popup: Delete tracking data for this install (POST /delete-install). Local Sent marks and history on this computer are cleared. Email privacy@sentcue.com if the control fails.

Backups. When external backups are enabled, an encrypted snapshot of the token database is created daily. The current rotation keeps the 7 most recent daily snapshots and up to 4 additional weekly snapshots. Deletion removes matching rows from the live database immediately; existing backup snapshots are not edited row by row and age out under that rotation. Backups are access-limited and used only for disaster recovery.

13. Your rights (senders)

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing of personal data we hold as controller, and to complain to a supervisory authority. Contact privacy@sentcue.com with subject “Data deletion request” or “Access request”. We do not operate a SentCue user account; install deletion is the primary self-serve path.

We do not sell personal information and we do not share it for cross-context behavioural advertising.

14. If you received a tracked email

Contact the person who emailed you. They chose to use tracking. We do not decide who is emailed and we usually cannot map a token back to your identity (we do not store your address on the server).

You can reduce image requests by disabling remote images in your mail client. You can also object to the sender. If you write privacy@sentcue.com, we will try to help the sender if we can identify an install; we cannot promise to fulfil a recipient request ourselves the way the sender can.

More: Support — how tracking works.

15. Security

HTTPS between the extension, pixel hostname, and origin. Random tokens instead of putting subject or To in the image URL. Install bearer tokens hashed at rest. No method of transmission is completely secure. We do not claim ISO 27001 or a named EU data-centre exclusive to SentCue.

16. This website and cookies

sentcue.com is static documentation. Google Analytics and Amplitude may set analytics cookies to measure visits. We do not set advertising cookies. On first install, the extension may open the welcome page once. That is a normal page load; we do not add a separate install-tracking pixel. Cloudflare may process connection data as described in their policy.

17. Waitlist and feature requests

The free plan page includes an optional feedback form. If you submit it, we may receive the feature ideas you selected, any note you typed, and an email address only if you choose to leave one. We use that to decide what to build next and, if you left an email, to follow up about those ideas. We do not sell the list or use it for unrelated marketing. Email is not required.

The form is delivered by Formsubmit to privacy@sentcue.com. Formsubmit’s policy applies to that transmission. You can write us directly instead of using the form.

Submitting the form is not a purchase. Paid plans are not for sale.

18. Children and prohibited uses

Not directed at children. Do not use SentCue to monitor children, covertly monitor employees without a lawful basis and required notice, stalk, harass, or treat medical or similarly sensitive mail as a surveillance tool. See Terms.

19. International processing

Traffic may be processed on Cloudflare’s global network and on the origin host. We do not automatically geo-block any region. Questions about processing: privacy@sentcue.com.

20. What this version does not do yet

The items below are product plans, not current data practices. We will update this policy and, where Chrome Web Store rules require it, the in-product disclosure before any of them collect new data.

Search, filters, follow-up / done labels, the split notification control, the in-product “report a problem” form, and the uninstall feedback page are already in this version. Their data practices are described in §5 and §7. They are not future plans.

Not shipped or not enabled. Each future feature would get its own privacy update before enablement:

• A paid plan with longer or synced history, export, or a SentCue account. Cloud copies of history would be created only after you opt in. Google OAuth would be requested only for a paid feature that needs it, not for free tracking.
• Link-click tracking, geolocation, IP profiles, CRM, or reading the rest of your mailbox. Those are not part of this version.

21. Changes

We may update this policy when the product, infrastructure, or law changes. Material new data practices require in-product disclosure again before pixels are added, consistent with Chrome Web Store rules.

22. Contact

Privacy: privacy@sentcue.com
Website: https://sentcue.com
Operator: the operator of Email Tracking