Privacy Policy

Last updated: April 6, 2026

Outlook MailDeck ("the Extension") is a browser extension that helps you triage emails in Outlook Web using a swipe-based interface. Your privacy is important to us. This policy explains what data the Extension accesses and how it is handled.

1. Data We Access

The Extension accesses the following data from your Outlook account via the Microsoft Graph API or Outlook REST API:

• Email metadata: Subject, sender name and address, received date, read status, flag status, and attachment names/sizes.
• Email body content: The body of emails is rendered in swipe cards so you can read them within the Extension.

The Extension does not access your contacts, calendar, files, or any other Microsoft 365 data.

2. How Data Is Processed

All email data is fetched directly from Microsoft's servers to your browser and rendered locally. No email data is ever sent to our servers or any third-party service. The Extension operates entirely within your browser.

3. Authentication

The Extension reads authentication tokens from Outlook Web's existing browser session (MSAL cache in localStorage/sessionStorage). It does not perform its own OAuth flow, prompt you for your Microsoft password, or store your credentials. Tokens are held temporarily in chrome.storage.session, which is cleared when the browser closes.

4. Local Storage

The Extension stores your preferences locally on your device using chrome.storage.local. This includes:

• UI preferences (dark mode, inbox source, timeframe filter)
• Kanban board state and follow-up view mode
• Quick reply templates
• Snooze schedules, email notes, and pinned emails

This data never leaves your device.

5. Subscription & Payments

Subscription management is handled by ExtensionPay, which uses Stripe for payment processing. When you subscribe:

• Your email address is collected by ExtensionPay to manage your subscription.
• Payment details (credit card) are handled entirely by Stripe. We never see or store your payment information.

Please refer to ExtensionPay's Privacy Policy and Stripe's Privacy Policy for details on how they handle your data.

6. Analytics & Tracking

The Extension does not include any analytics, tracking pixels, telemetry, or third-party scripts. We do not collect usage data, crash reports, or behavioral data of any kind.

7. Data Sharing

We do not sell, share, or transfer your data to any third parties, except as described in Section 5 (subscription management via ExtensionPay/Stripe).

8. Data Retention

We do not retain any data on servers. All data processed by the Extension exists only in your browser's local storage and is under your control. You can clear it at any time by removing the Extension or clearing your browser data.

9. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA) and United Kingdom, our legal basis for processing personal data is Legitimate Interest (Article 6(1)(f) GDPR). We process your email metadata solely to provide the email triage functionality you have installed and use. This processing is necessary for the service and does not override your fundamental rights.

For subscription-related processing (email address collected by ExtensionPay/Stripe), the legal basis is Contract performance (Article 6(1)(b) GDPR).

10. Your Rights (GDPR / UK GDPR)

If you are located in the EEA or United Kingdom, you have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you.
• Right to erasure: Request deletion of your personal data ("right to be forgotten").
• Right to rectification: Request correction of inaccurate personal data.
• Right to portability: Receive your data in a structured, machine-readable format.
• Right to restrict processing: Request that we pause processing your data.
• Right to object: Object to processing based on legitimate interests.

To exercise any of these rights, contact us at support@efytab.com. Note: since all email data is processed locally in your browser and never sent to our servers, the primary way to delete this data is to uninstall the Extension or clear your browser storage. For subscription data, contact ExtensionPay/Stripe directly.

11. Governing Law

This Privacy Policy is governed by the laws of Belgium. For EEA users, it is also subject to the General Data Protection Regulation (GDPR). For UK users, it is subject to the UK GDPR and the Data Protection Act 2018.

12. Children's Privacy

The Extension is not intended for use by children under 13. We do not knowingly collect personal information from children.

13. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last updated" date.

14. Contact

If you have questions about this privacy policy, please contact us at support@efytab.com.