Gmail Extension Privacy Policy
Last updated: October 2026
Who We Are
The BA | Stamp for Gmail browser extension is operated by Aletheia Tech Ltd, a company registered in the United Kingdom (128 City Road, London, EC1V 2NX). We are committed to protecting your privacy in compliance with the UK GDPR, the UK Data Protection Act 2018, and the EU General Data Protection Regulation (GDPR).
The Core Privacy Promise
The email never leaves your device. When you stamp a received email, the extension reads it and computes its SHA-256 hash entirely in your browser. Only that 64-character fingerprint, plus the email's subject line and your API key, is transmitted to our servers. The email body, headers, senders, recipients and attachments are never uploaded, never seen, never stored by us.
What the Extension Does
BA | Stamp for Gmail lets you timestamp a received email by anchoring a hash of it on the Polygon and Bitcoin public blockchains, and download a self-verifiable proof file. All capture and hashing happens locally in your browser.
Data Sent to Our Servers (bastamp.com)
When you choose to stamp or anchor an email, the extension sends to the bastamp.com API only:
• The SHA-256 hash of the raw email
• The email's subject line — used as a file name so you can recognise the record in your account
• A fixed content type (message/rfc822)
• Your API key — to authenticate your bastamp.com account
We do not receive the email body, the sender or recipient addresses, the headers, or any attachments. To check the status of an existing stamp, only the hash is sent.
Data Processed Only on Your Device
• The raw email (.eml, including body, headers and authentication results) is read locally, solely to compute its hash and to assemble the downloadable proof file.
• A screenshot of the open email is captured locally to include a one-page visual PDF inside your proof file. This image is processed on your device and is not sent to our servers.
Blockchain Anchoring
The hash is anchored on the Polygon and Bitcoin public blockchains. Once anchored, the hash is public and permanent. A hash does not reveal the contents of your email, but the fact that a record was anchored at a given time is public.
Local Storage of Your Settings
Your API key and preferences are stored using the browser's extension storage. If you are signed in to your browser, these settings may sync across your own browsers through your browser account. They are used only to authenticate your requests to bastamp.com.
Data We Do NOT Collect
• Your email body, attachments, headers, or recipients — never transmitted
• Third-party tracking data — no analytics, advertising or trackers of any kind
• Marketing cookies — not used
We never sell your personal data to third parties, and we do not use or transfer it for any purpose unrelated to the extension's core function of stamping and verifying emails.
Permissions
• Access to mail.google.com — to read the open email on your device
• Access to bastamp.com — to submit the hash and retrieve the proof and verification
• Downloads — to save the proof file to your Downloads folder
• Storage — to store your API key and preferences
• Active tab / tabs — to identify the open email tab and capture its visible image for the PDF
Your Rights and Data Retention
Your stamp records (the hash, subject, timestamp and anchoring transaction) are retained in your bastamp.com account as part of the service. Under UK GDPR and EU GDPR you have the right to access, rectify, erase, port and object to the processing of your account data, and to withdraw consent.
Important note on blockchain data: Hashes anchored to the blockchain cannot be deleted, as they are part of the public ledger. Without the original email, a hash alone reveals nothing about its contents.
The handling of your bastamp.com account data is covered in full by our main Privacy Policy.
Contact
For privacy-related questions:
Email: privacy@blockchainanalysis.io
Aletheia Tech Ltd, 128 City Road, London, EC1V 2NX, United Kingdom
We aim to respond to all privacy inquiries within 30 days.