Privacy Policy — Fastmail Masked Email

Last updated: 2 June 2026

Fastmail Masked Email ("the extension") is a browser extension that creates
Fastmail Masked Email addresses and inserts them
into the field you are typing in. This policy explains exactly what data the
extension handles.

Short version

The extension does not collect, sell, share, or transmit any of your data to
the developer or any third party. There are no analytics, trackers, or external
servers operated by the developer. Everything happens locally in your browser
and directly between your browser and Fastmail.

What the extension stores

The following settings are stored locally in your browser
(chrome.storage.local) and never leave your device except as described below:

• Fastmail API token — used to authenticate requests to Fastmail.
• Optional email prefix — used when generating an address.
• "Create as enabled" preference and language preference.

You can clear the stored token at any time via the extension's settings
("Clear token").

What the extension sends, and to whom

The extension communicates only with Fastmail's official API at
https://api.fastmail.com, using your own API token. Specifically it:

1. Reads the origin and hostname of the active tab when you trigger it, so it
   can label the generated address (forDomain / description). This value is
   sent only to Fastmail as part of creating the address.
2. Calls the Fastmail JMAP API to create a Masked Email address and returns that
   address to the page.

No browsing history, page content, keystrokes, or personal data are collected or
sent anywhere else.

Permissions and why they are needed

• storage — save your settings locally.
• scripting / activeTab — read the current tab's origin and insert the
  generated address into the focused field, only when you trigger the extension.
• contextMenus / menus — add the right-click "Insert masked email" option.
• notifications — show a small confirmation when an address is created.
• host permission https://api.fastmail.com/* — talk to the Fastmail API.

Data collection declaration

Per Mozilla's data-consent requirements, this extension declares
data_collection_permissions: { required: ["none"] } — it does not collect any
data on behalf of the developer.

Your data, your control

Your Fastmail account and the Masked Email addresses you create are governed by
Fastmail's own Privacy Policy. To
revoke the extension's access, delete the API token in the extension settings
and/or revoke the token in your Fastmail account settings.