CodeHound — Privacy Policy

Last updated: June 5, 2026

CodeHound is a Chrome extension that retrieves verification codes from your Gmail inbox and copies them to your clipboard. Your privacy is important to us. This policy explains what data is accessed and how it is used.

Data We Access

CodeHound requests read-only access to your Gmail account via Google OAuth2. This access is used solely to search for and retrieve verification code emails. We do not store, transmit, or share any email content.

Data We Store

CodeHound stores the following data locally on your device using Chrome's built-in storage API:

• Your optional custom Gmail search query
• Your AI provider preference (Claude or OpenAI), if enabled
• Your AI API key, if provided

None of this data ever leaves your device except to communicate directly with the selected AI provider when AI-assisted mode is active.

AI-Assisted Mode

If you enable AI-assisted email selection, CodeHound will send the subject lines (not the full content) of recent matching emails to the AI provider you select (Anthropic or OpenAI). Your API key is stored locally and sent only to the respective provider. We do not have access to your API key or any data sent to AI providers.

Google OAuth Scopes

CodeHound requests the gmail.readonly scope, which allows read-only access to your Gmail messages. The extension never modifies, deletes, or sends emails on your behalf.

Third-Party Services

CodeHound communicates with the following third-party services:

• Google Gmail API — to search and read emails
• Anthropic API — only if Claude is selected as the AI provider
• OpenAI API — only if OpenAI is selected as the AI provider

Data Protection

CodeHound takes the following measures to protect sensitive data:

• OAuth tokens (Chrome): Chrome manages and caches the OAuth token through its built-in Identity API. CodeHound receives the token from Chrome and uses it to call the Gmail API; Chrome is responsible for its secure storage. You can revoke access and clear the cached token at any time via Google Account Permissions or the extension's sign-out button.
• OAuth tokens (Firefox): Firefox does not cache OAuth tokens on the extension's behalf. Each session, CodeHound initiates a web auth flow via browser.identity.launchWebAuthFlow and receives a short-lived access token that is held in memory only for the duration of that session. The token is never written to disk or extension storage and is discarded when the popup closes.
• API keys (Anthropic or OpenAI) are stored locally in the browser's extension storage, which is sandboxed to CodeHound and inaccessible to other extensions or web pages.
• All communication with Google's APIs and AI providers uses HTTPS (TLS-encrypted transport).
• No sensitive data is written to disk outside of the browser's own secure storage mechanisms.

Data Retention and Deletion of Google User Data

CodeHound does not retain any Google user data beyond the duration of a single use session:

• Email content and verification codes retrieved from Gmail are held in memory only for the duration of the active popup session and are never written to disk or transmitted to any server.
• No Gmail messages, metadata, or personal information derived from Google APIs are stored persistently by CodeHound.

To delete locally stored extension data (your search query preference, AI provider choice, and API key), you can either remove the extension or clear its storage through your browser's extension management page.

To revoke CodeHound's access to your Google account, visit Google Account Permissions, find CodeHound in the list of connected apps, and click "Remove Access." This immediately invalidates the OAuth token the browser holds on the extension's behalf.

Contact

If you have any questions about this privacy policy, please open an issue on the CodeHound GitHub repository.

← Back to Gardner Programs