Privacy Policy — PhishingNet

Last updated: August 2026

PhishingNet (the “Extension”) is a browser extension that checks the email you are viewing in Gmail — and, if you choose to turn it on, in Outlook on the web — for signs of phishing, and shows an inline verdict with the reasons behind it. This policy explains exactly what the Extension does and does not do with your data.

What the Extension accesses

When you open an email in Gmail — or in Outlook on the web, if you have turned that on — the Extension reads that single email as shown on the page: its sender, subject, body text, and the links it contains. It sends that text to the PhishingNet analysis service to be checked. It does this only for the email you are currently viewing.

In Gmail only, the Extension also reads the sender-authentication result that Gmail itself displays for that message (the “mailed-by” and “signed-by” values shown under Show details), and sends it along with the text. This is Gmail’s own verification of whether the message genuinely came from the domain it claims, and it lets the analyzer avoid wrongly flagging legitimate mail from banks, retailers, and other services. It is read from Gmail’s own interface — the Extension does not perform any authentication check of its own, and does not access your account to obtain it.

In Outlook on the web the Extension reads no authentication data of any kind. It sends the visible message text only.

The Extension also stores your settings (whether automatic scanning is on, and the analyzer address) in your browser’s extension storage.

Team pilot metrics (off by default)

The Extension has an optional team pilot code setting, used when an organisation evaluates PhishingNet across a small group. It is off unless someone types a code into the Extension’s popup, and clearing that box turns it off immediately.

While a code is set, the analysis service records — for each email you open — the verdict and risk score it just produced, which detection signals fired, the classifier’s probability, the sender’s domain (for example atlassian.net, never the full address), which webmail client you used, a timestamp, the team code, and a random participant identifier your browser generates for itself.

It does not record the subject, the message text, any link, any attachment or filename, any email address, or your name. The service also stores a one-way, salted, truncated hash of the message, used only to tell whether the same message also reached someone else on the team; the message it was computed from is not kept and cannot be recovered from it.

If a code is set, the banner also shows “Was this right?” buttons. Pressing one records only your answer (correct / wrong, and if wrong, whether the email was actually safe or actually a scam) against that analysis. You are never required to press them.

Where this data is stored depends on who runs the analysis service for your pilot — ask whoever gave you the code. The public PhishingNet service has this feature turned off and records nothing.

What the Extension does NOT do

• It does not sign in to your Google or Microsoft account, and it does not use your Google or Microsoft credentials.
• It does not read, download, or scan your whole mailbox — only the message currently open on screen.
• It does not track your browsing, and it contains no advertising or analytics.
• It does not collect your name, contacts, or any personal profile.

How your data is used

The email text is sent to the PhishingNet analysis service (https://phishing-analyzer-api-wq1v.onrender.com) solely to compute a phishing verdict, a risk score, and the supporting evidence, which are returned to the Extension and displayed to you.

• Email content is analyzed in memory to produce the verdict and is not stored, logged, or retained after the response is returned.
• Your data is never sold, rented, or shared with any third party.
• The analysis is used only to provide the Extension’s core function (phishing detection) and for no other purpose.

Permissions and why they are needed

• storage — to save your settings (scanning on/off, analyzer address).
• Access to mail.google.com (content script) — to read the email you have open and to display the safety banner inside Gmail. This access is granted when you install the Extension.
• Optional access to outlook.live.com, outlook.office.com and outlook.office365.com — the same reading and banner display inside Outlook on the web. This access is optional and off by default. It is requested only when you press Enable next to Outlook on the web in the Extension’s popup and approve Chrome’s own prompt, and you can withdraw it at any time from that same button or from chrome://extensions → PhishingNet → Site access. Until you grant it, the Extension does not run on, and reads nothing from, any Outlook page.
• scripting — to install the reader into Outlook pages after you have granted that optional access. It gives the Extension no access to any site it does not already have your permission for.
• Access to the analyzer service host — to send the email text for analysis and receive the verdict.

Your choices

You can turn automatic scanning off at any time from the Extension’s popup, turn Outlook support off (which withdraws the Outlook permission entirely), change the analyzer address, or remove the Extension from your browser to stop all processing.

Children

The Extension is not directed to children under 13 and does not knowingly collect data from them.

Changes to this policy

This policy may be updated from time to time; the “Last updated” date above will change accordingly.

Contact

Questions about this policy can be sent to guptadevesh@hotmail.com.