Mail Arbiter

Privacy Policy

Last updated
Published by
Cranfill Enterprises LLC
§ I

Overview

Mail Arbiter checks an email that you choose for signs of phishing, social engineering, and suspicious content. It has two parts, and you install both:

  • A Chrome extension. It adds an "Analyze with Mail Arbiter" action to Gmail and to Outlook on the web.
  • A companion app for macOS (macOS 13 or later). It runs the analysis on your own computer.

This policy describes what data Mail Arbiter accesses, how it is used, and with whom it is shared.

Mail Arbiter is designed around a principle of minimal data exposure. Cranfill Enterprises LLC operates no server that receives your email: the analysis runs on your computer, and no email content is collected, stored remotely, or shared beyond what is strictly necessary to perform the analysis you request.

§ II

The Two Parts

The extension

The extension runs in your browser. It reads an email only when you click "Analyze with Mail Arbiter", sends it to the companion app on your own computer, and shows you the result in a side panel.

The companion app

The companion app is a menu bar app and a background analysis service. The service listens only on your own computer (the loopback address 127.0.0.1, port 7741 by default), so nothing outside your computer can reach it. It starts only after you press Start in the app. Once started, it is registered with macOS as a background item (shown in System Settings > General > Login Items & Extensions) and starts again each time you log in, until you press Stop in the app. Opening the app itself at login is a separate setting you control.

§ III

Data We Access

Email content

When you choose to analyze a message (via the "Analyze with Mail Arbiter" action), the extension reads the raw content of that message (headers, body, and metadata) solely to perform phishing analysis. This happens only on explicit user request. Mail Arbiter does not read email content passively or in the background.

How the message is retrieved: Gmail

In Google Chrome, Mail Arbiter retrieves the message using Google's official Gmail API. An OAuth access token is obtained through Chrome's identity APIs, with the read-only scope gmail.readonly, and used to fetch the raw message from Google's gmail.googleapis.com endpoint. Mail Arbiter does not store this token. See "Google API Data" below for how this use adheres to Google's Chrome Web Store User Data Policy.

If that request cannot complete (for example, if a Gmail API token can't be obtained), when you use a browser other than Google Chrome (where Mail Arbiter does not request a Gmail API token at all), or when running a development or sideloaded build that doesn't have a Chrome Web Store-assigned extension ID, Mail Arbiter falls back to reading the message directly from Gmail's own web interface, using the Gmail session you're already logged into in your browser. It reads a short-lived internal session identifier that Gmail's own page already uses (not a password, API key, or credential Mail Arbiter creates or manages), and uses it, together with your browser's existing Gmail session cookies, to fetch the raw message directly from mail.google.com. That identifier is used only in your browser, for that single request, and is never transmitted to the companion app, to Anthropic, or to any other party.

How the message is retrieved: Outlook on the web

For Outlook.com and Microsoft 365 (work or school) accounts, Mail Arbiter signs you in through the Microsoft identity platform, using the OAuth 2.0 authorization code flow with PKCE, and asks for the read-only permission Mail.Read. It then uses Microsoft Graph in two steps:

  1. Finding the message. The address of the open Outlook page contains an ID for the message or its conversation. The extension sends that ID to Microsoft Graph to find the message (for a message ID, a lookup of that one message; for a conversation ID, a lookup of the messages in that conversation). Graph returns the ID, subject, sender address, and received time of the one message, or of up to 10 in the conversation, and the extension compares them with the open message. If the address has no usable ID, the extension instead asks Microsoft Graph to search your mailbox for messages whose subject matches the open message, and Graph returns the same four fields for up to 10 of them. This metadata is used only to pick the right message, is held only in your browser's memory while the request runs, and is not stored or sent anywhere.
  2. Fetching the message. The extension downloads the one matching message from Microsoft Graph (graph.microsoft.com) and sends it to the companion app on your computer.

Mail Arbiter does not store the Microsoft access token, and does not use refresh tokens. See "Microsoft API Data" below.

Email metadata and domain lookups

Headers including the From address, subject line, sending domain, authentication results (SPF, DKIM, DMARC), and links are extracted from the email by the companion app and used for signal scoring. To assess the sender, the companion app looks up public information about:

  • the sender's domain and the message's envelope (Return-Path) domain, through WHOIS/RDAP lookup services, to determine domain age and registrar; and
  • those domains and the domains of links in the message, through DNS lookups made by your computer's normal DNS resolver.

Only domain names are submitted to these services. No email content is.

Sender's website

When you tick the "coherence check" box for a message (see "Anthropic Claude API" below), the companion app also fetches the sender's public website, or a Wayback Machine snapshot of it. Only the domain name and public website content are accessed, and no email content is transmitted in this step. As with any web request, the sender's website or the Internet Archive can see a request from your computer's network address.

Settings kept in your browser

The extension stores a few preferences (the daemon port number, a coherence-check preference, and an auto-indexing preference, see "Corpus indexing" below) locally using chrome.storage. These settings are never transmitted outside your device.

What the companion app keeps on your computer

  • Your Anthropic API key, only if you choose to enter one. It is kept in your macOS login Keychain, never in a plain file, and is used only to make the optional coherence check described below.
  • A log file at ~/Library/Logs/MailArbiter/, holding operational messages from the analysis service. These can include domain names (for example, "lookup failed for example.com") but never the text of a message.
  • A small preference recording that the welcome window has been shown.
  • The sender-history database described under "Corpus indexing" below. It is switched off and unused in this version.
§ IV

How Data Is Used

Email content and metadata are used for one purpose only: detecting phishing and social engineering in the email you have chosen to analyze. Mail Arbiter does not use email data for advertising, profiling, analytics, or any purpose unrelated to phishing detection. Mail Arbiter does not collect analytics, telemetry, or usage statistics of any kind.

§ V

Data Sharing and Third Parties

Mail Arbiter shares data with the following third parties, and no others:

Your mail provider (Google or Microsoft)

To fetch the message you chose, as described above. This is your own account with your own provider.

Anthropic Claude API (optional, off by default)

Each message has a "Perform a coherence check" box, unticked by default. If you tick it, two text excerpts are sent to the Anthropic Claude API for semantic analysis: the email body (maximum 1,500 characters) and, if available, text extracted from the sender's website or Wayback Machine snapshot (maximum 4,000 characters). The request is made by the companion app on your computer, using your own Anthropic API key, and only at the time of analysis. Anthropic's own terms and data handling policy apply to what you send. If you never tick the box, or never enter a key, nothing is sent to Anthropic.

WHOIS/RDAP services

The sender's domain and the envelope domain (for example, example.com) are submitted to RDAP/WHOIS lookup services to determine domain registration age and registrar. No email content, personal information, or message body is transmitted. If you configure a paid WHOIS provider with your own key, the same domain names go to that provider instead.

Wayback Machine and the sender's website

The sender's domain is used to fetch publicly available website content for the coherence check, as described above. No email content is transmitted.

§ VI

Data We Do Not Collect

Cranfill Enterprises LLC does not receive, collect, store, or transmit:

  • Email content, to any server we operate (we operate none for this)
  • Your Gmail or Microsoft access tokens, your passwords, or your Anthropic API key. Tokens go only to Google or Microsoft; the key stays in your Keychain and goes only to Anthropic
  • Browsing history or activity outside of Gmail and Outlook on the web
  • Analytics, telemetry, or usage statistics
  • Any personally identifiable information beyond what is incidentally present in the email being analyzed
§ VII

Local Processing and Security

The core analysis engine runs on your own computer. Email content is sent from the extension to the companion app over localhost only, and never leaves your device except as described above (Claude API excerpts when you tick the coherence check).

The extension and the app authenticate each other with a bearer token that the app generates fresh each time its service starts. The extension obtains that token from the app through Chrome's native messaging (the nativeMessaging permission), which reads it over a private channel that only your own user account can open, and keeps it in the browser's memory. The token is never written to disk. No email content passes through native messaging.

All communication with Google, Microsoft, Anthropic, and the domain lookup services uses encrypted HTTPS (TLS) connections. Your Anthropic API key is stored encrypted in the macOS login Keychain, protected by your macOS account.

§ VIII

Data Retention

Mail Arbiter does not retain email content beyond the duration of a single analysis session. The message is held in memory while it is analyzed and is not stored by the extension or by the companion app.

What does persist on your computer is limited to the items listed under "What the companion app keeps on your computer" above.

Corpus indexing

The software includes a feature for sender-history indexing, stored locally on your own computer. This feature is switched off, and the companion app refuses to use it, in this version. No email content or metadata is being indexed today, and the "auto-index" preference stored by the extension has no effect.

If and when this feature becomes active, this policy will be updated to describe what is stored (locally only: sender address, subject-line and body keyword fingerprints, link domains, and detected brand names, never raw email content) and how consent is obtained, before it is enabled by default for any user.

§ IX

Google API Data

Mail Arbiter's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and to the Chrome Web Store User Data Policy.

  • What is accessed. Only the one Gmail message you choose to analyze, through the read-only scope gmail.readonly. Mail Arbiter does not list, search, or read other messages in your account.
  • How it is used. Only to produce the phishing analysis you asked for, which is shown to you in the side panel. This is the app's user-facing feature.
  • Where it goes. The message is sent from your browser to the companion app on your own computer, and nowhere else. The one exception is the optional coherence check: if you tick that box for a message, an excerpt of up to 1,500 characters of the email body is sent from your computer to the Anthropic Claude API, using your own Anthropic key. It happens only for that message and only because you ticked the box.
  • No human reading. Cranfill Enterprises LLC cannot read your Gmail data. It never reaches a server we operate, and no one at the company has access to it.
  • No advertising, sale, or credit use. The data is never used for advertising, never sold or transferred to data brokers, and never used to decide creditworthiness or lending.
  • No storage. Mail Arbiter does not store Gmail data or the access token. The message is held in memory only while it is analyzed. Chrome may keep the token it issued until the token expires.
  • No model training. Mail Arbiter does not use data obtained through Google APIs to develop, improve, or train generalized or non-personalized artificial intelligence or machine learning models, and the excerpt sent to Anthropic is not transferred for that or any other purpose.

The session-based fallback described under "How the message is retrieved: Gmail" above (used when a Gmail API token can't be obtained, in a browser other than Google Chrome, or when running a non-Chrome-Web-Store build) is held to the same standard: it reads only the specific message you've chosen to analyze, and the session identifier it uses is never transmitted anywhere or retained.

§ X

Microsoft API Data

Information received from Microsoft Graph is held to the same standard. It is used only to perform phishing analysis on the message you have chosen to analyze. It is not used for advertising, is not transferred to data brokers, and is not used for any purpose unrelated to phishing detection. The subjects and sender addresses that Graph returns while the extension looks for your message are used only to identify it, as described above. Microsoft access tokens are used only for the duration of the request and are never stored by Mail Arbiter.

§ XI

Your Choices

  • The coherence check is optional and unticked by default for every message. If you do not tick it, or do not enter an Anthropic key, no data is sent to the Anthropic Claude API.
  • Start and Stop. Press Stop in the Mail Arbiter menu to stop the analysis service and remove its background item. It stays stopped, including after you log in, until you press Start.
  • Uninstalling. Remove the extension from your browser to delete its settings. To remove the app, press Stop in its menu first, quit it, and drag it to the Trash. To delete what it leaves behind, remove the folder ~/Library/Logs/MailArbiter and, if you entered an Anthropic key, the Keychain item named com.cranfillenterprises.mailarbiter.secrets (in the Keychain Access app).
  • Revoking access. You can revoke Mail Arbiter's access at any time in your Google Account (under third-party apps with account access) and in your Microsoft account's privacy settings, or through your organization's administrator for a work or school account.
§ XII

Contact

For questions about this privacy policy or Mail Arbiter's data practices, contact:

Cranfill Enterprises LLC mailarbiter@cranfillenterprises.com
§ XIII

Changes to This Policy

We will update this policy when Mail Arbiter's data practices change. The "Last updated" date at the top of this page reflects the most recent revision.