Privacy

Last updated 20 August 2026

There are two separate things under this name: a Chrome extension, which collects nothing, and this website, which collects an email address if you ask to be told when there is news. They are covered separately below, because they genuinely are separate.

The extension

It makes no network requests

HaikuMail has no server, no account, no API key and no analytics. It never sends anything anywhere, because it has nowhere to send it to. There is no OAuth screen because it never asks Google for access to your mail.

Instead it runs inside the Gmail tab you already opened, in your browser, and reads the page Gmail has already drawn there. Your mail is read the same way your screen reads it: locally, and only while you are looking at it.

What it can access

The extension asks for one thing: permission to run on https://mail.google.com. It requests no other host and no other capability — no access to your other tabs, your browsing history, your downloads, your cookies, or any other site.

"host_permissions": ["https://mail.google.com/*"]

While you have a Gmail tab open, the extension can read the subjects, senders, dates and message bodies that Gmail has rendered in it — that is what makes searching and reading possible. It holds them in memory long enough to show them to you, and does not write them anywhere.

What it stores, and where

Four values are kept in your browser’s localStorage, under Gmail’s own origin. Nothing else is stored, and none of it leaves your machine:

• haikumail:last-haiku — a number, so the same poem is not drawn twice in a row.
• haikumail:view — whether you last read a message as plain text or in the sender’s own markup.
• haikumail:sender-tags — any labels you have put on a sender, which include that sender’s email address.
• haikumail:favorite-senders — a cached list of addresses worked out from mail you have starred, so the list does not have to be rebuilt on every visit.

The last two contain email addresses of people who have written to you. They are held locally, in the same place a website holds your preferences, and are readable only by that origin in your browser.

Because they belong to the origin rather than to the extension, removing the extension does not by itself erase them. To clear them, remove Gmail’s site data in your browser settings, or run Object.keys(localStorage).filter(k => k.startsWith('haikumail:')).forEach(k => localStorage.removeItem(k)) in the console on a Gmail tab.

What it does not do

• No data is transmitted, sold, shared, or transferred to anyone.
• No advertising, profiling, or interest-based targeting of any kind.
• No tracking of your browsing, on Gmail or anywhere else.
• No human ever sees your mail. Nobody could: it never leaves your browser.
• Tracking pixels embedded in the mail you read are removed before the message is displayed, so opening a message here does not tell the sender you opened it.

Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. HaikuMail does not in fact use any Google API — it reads only the page already rendered in your own tab — but the commitment stands.

This website

The waitlist

If you enter your email address to hear about the hosted version, we store your address, the date you gave it, and whether you confirmed it. Nothing else — no name, no company, no tracking of what you looked at before you typed it.

You will be sent one message asking you to confirm, and after that only when there is genuinely something to say. Every email carries an unsubscribe link, and unsubscribing deletes the address rather than merely flagging it.

The list is held by Buttondown, which acts as our processor and does not use the addresses for anything of its own. The legal basis is your consent, under Article 6(1)(a) of the UK GDPR and the EU GDPR, and you may withdraw it at any time.

Abuse prevention

To stop the signup form being used to send confirmation mail to people who did not ask for it, requests to it are rate limited by our host at the network edge, before they reach any code of ours. We neither see nor store an IP address for this. The form also carries a hidden field that a person never fills in and a great many automated scripts do.

Confirmation is why this matters: an address that has not been confirmed is never sent anything at all, so the form cannot be used to mail somebody who did not ask for it.

Analytics

The site uses Vercel Web Analytics, which counts page views without cookies, without a device fingerprint, and without following anyone between sites. That is also why there is no cookie banner: there are no cookies to ask you about.

Hosting

The site is hosted by Vercel, which keeps short-lived server logs including IP addresses as an ordinary part of serving and protecting a website. We do not use those logs to build any profile.

Your rights

You can ask for a copy of what is held about you, ask for it corrected, or ask for it deleted, and we will act within 30 days. For the waitlist, the unsubscribe link in any email does it immediately and without asking anyone. For anything else, write to hello@haikumail.app.

There is nothing to request about the extension, because there is nothing held about you — what it stores is on your own machine and under your control.

Children

HaikuMail is not directed at children under 13, and we do not knowingly collect anything from them.

Changes

If what is collected ever changes, this page changes first and the date at the top moves. Anything that would alter how your data is handled will be said plainly rather than absorbed quietly into a new version — and if the extension itself ever starts collecting anything, that will be announced in the extension, not only here.

Questions: hello@haikumail.app. See also the terms.