Privacy Policy

Effective date: April 17, 2026 · Last updated: April 17, 2026

1. Who we are

Inbox Extractor ("we", "our", "the extension") is a Chrome browser extension that extracts hyperlinks and their surrounding metadata from Facebook Messenger conversations at the user's explicit request. It is a one-person independent project. Contact: support@inboxextractor.xyz.

Inbox Extractor is not affiliated with, endorsed by, or sponsored by Meta Platforms, Inc., Facebook, or Messenger.

2. What data the extension touches

2.1 messenger.com page content (processed locally)

When you click the extension icon and start an extraction, the extension reads the Document Object Model (DOM) of the Messenger conversation you are viewing. Specifically, it extracts:

• Hyperlink URLs found in messages
• The sender's name next to each message
• The timestamp of each message (converted from Messenger's relative format, e.g. "Today at 3:45 PM", into an absolute date)
• The text content of each message that contains a link, up to 500 characters
• The title text of any link preview card, when available
• The name of the conversation (contact or group name)

This processing happens entirely inside your browser. The extension reads only what's already rendered in your Messenger tab — the same information you can see with your own eyes.

2.2 Google account (optional, only when you choose Sheets export)

If you choose "New Google Sheet", "Existing Sheet", or "Master Sheet" as your export destination, the extension requests an OAuth 2.0 token from Google using Chrome's built-in identity service. You authorize this through Google's standard consent flow. The scopes requested are:

• https://www.googleapis.com/auth/spreadsheets — to create new spreadsheets in your Drive and write/append rows to sheets you specify
• https://www.googleapis.com/auth/drive.readonly — to list the names and IDs of your existing spreadsheets, so you can pick one in the "Existing Sheet" picker. The extension does not read the contents of sheets other than those you select as a destination.

You can revoke this access at any time at myaccount.google.com/permissions.

2.3 Local browser storage (configuration only)

Inside Chrome's chrome.storage.local API (which stores data only on your own device), the extension saves:

• Your scheduled extraction jobs (conversation name, interval, last-run timestamp, export destination) — if you choose to create any
• The Google Sheet ID of your "Master Sheet" if you use that export method

These are settings, not content. They never include the text of any message or the content of any link you've extracted.

3. What data we do not collect

Inbox Extractor does not operate any remote server. We therefore cannot and do not collect, transmit, receive, or store the following on our side:

• Your Messenger messages or the content of your conversations
• The hyperlinks you extract
• Your Facebook or Messenger login credentials (the extension has no access to them)
• Your Google account credentials (Google handles OAuth entirely on Google's infrastructure)
• Your name, email, IP address, device identifiers, location, or any other personal identifier
• Usage analytics, event tracking, crash reports, or telemetry
• Advertising identifiers or tracking pixels

There is no backend. There are no third-party analytics libraries embedded in the extension. There is no crash-reporting service.

4. Where your extracted data goes

When an extraction completes, the collected links and metadata travel directly from your browser to the destination you chose. They do not pass through any server we operate.

5. Chrome permission justifications

The extension requests the following Chrome permissions. Each is used only for the purpose described, and no data collected via these permissions is transmitted off-device except as described in Section 4.

• activeTab — Grants access to the currently active Messenger tab only when you click the extension icon. Used to read the conversation DOM during extraction.
• identity — Allows the extension to request a Google OAuth token via Chrome's built-in flow. Used only when you choose a Google Sheets export.
• storage — Saves configuration (export preferences, scheduled jobs) in your browser's local storage.
• alarms — Schedules periodic extractions you explicitly configure (every 6h, 12h, or daily).
• notifications — Shows system notifications when a scheduled extraction cannot run because your Messenger tab isn't open.
• scripting — Injects the content script into Messenger when it wasn't auto-loaded (e.g., after installing the extension into an already-open tab).
• host_permissions: https://www.messenger.com/* and https://messenger.com/* — Limits the extension's page-content access to Messenger alone. The extension has no permission to read any other website.

6. Third parties

Inbox Extractor interacts with two third-party services, both of which are optional and only triggered by your explicit actions:

• Google (Sheets & Drive APIs) — used only when you choose a Google Sheets export. Your interaction with Google is governed by Google's own Privacy Policy at policies.google.com/privacy.
• Stripe — used only when you purchase a license on our website (inboxextractor.xyz). Payment processing and card data handling are performed entirely by Stripe on their infrastructure. We never receive or store your card details. Stripe's Privacy Policy: stripe.com/privacy.

7. Data retention and deletion

Because the extension does not send data to any server we operate, there is nothing for us to retain. Settings the extension keeps in local browser storage (Section 2.3) stay on your device until:

• You remove a scheduled job from the "Scheduled" tab in the extension popup
• You uninstall the extension — which automatically wipes all stored settings
• You clear your browser's storage for the extension

Data you exported to Google Sheets remains in your Google account and is under your control. You can delete it at any time from Google Drive.

8. Security

Because your data does not travel through our servers, the primary security boundaries are the browser itself and Google's OAuth infrastructure. We rely on:

• Chrome's extension sandbox and permission model
• HTTPS for all Google API requests
• OAuth 2.0 tokens managed by Chrome's identity service (tokens are never stored in extension-accessible memory beyond the request's lifetime)

If you believe you have found a security issue, please email support@inboxextractor.xyz.

9. Your rights

Because we do not collect or store personal data, most data-subject rights requests (access, portability, rectification, erasure under GDPR/CCPA) have no material data for us to act on. That said, you always have the right to:

• Stop using the extension at any time (uninstall from chrome://extensions)
• Revoke Google OAuth access at myaccount.google.com/permissions
• Clear local extension storage via your browser settings
• Request a refund within 7 days of purchase (see Terms of Service)

10. Children

Inbox Extractor is not directed to children under 13, and we do not knowingly process information from children. If you believe a child has used the extension, contact us and we will assist as best we can.

11. International users

The extension runs locally in your browser regardless of your country. No data leaves your device except to go to the destination you explicitly choose (Google Sheets in your account, your Downloads folder, or your clipboard). GDPR, CCPA, and similar regulations that govern data controllers do not apply to data we never collect.

12. Changes to this policy

If we make material changes, we'll update the "Last updated" date at the top, note the change in the extension's release notes on the Chrome Web Store, and — where we can — surface a one-time notification in the extension.

13. Contact

Privacy questions, concerns, or requests:

• Email: support@inboxextractor.xyz
• Website: inboxextractor.xyz