Privacy policy
Last updated: 27 August 2026
Every heyyoshi extension collects nothing. No account, no server, no analytics, no telemetry, no advertising and no remote code: each tool runs inside your own browser, talks only to the site or sites it is built for, and writes anything it saves to your own device and nowhere else.
What every heyyoshi extension promises
heyyoshi makes a growing set of small browser extensions. They do not share code, but they share one posture, and this single policy covers all of them, including any that have not shipped yet:
- No account, no server, no analytics, no telemetry, no advertising, no remote code. There is nothing to sign up for and nothing running anywhere but your own browser.
- Each extension runs only on the site or sites it is built for, and talks only to those, using the login already in your browser. It contacts no other server. Chrome enforces this from the extension's manifest, which is a stronger promise than a policy document can make on its own.
- Anything an extension saves stays on your own device. Templates, backups and exports are written to your own computer and uploaded nowhere. They are not synced between your devices and not visible to anyone but you.
- You can check all of this yourself. Open your browser developer tools, watch the Network tab while you use the tool, and it stays empty.
What each tool touches
Each extension reads only what it needs, in memory and only while you are using it. Here is what that is, tool by tool:
| Tool | Runs only on | Reads, in memory while you use it | Keeps, on your device |
|---|---|---|---|
| Mailplate (live) | mail.google.com |
The message you are composing, and the Gmail background colour. | The templates you save, in local extension storage. |
| Depot (live) | claude.ai |
Your Claude Projects list, and a chosen project's instructions and text documents. | Shared Library groups in local extension storage, and backups as zip files on your computer. |
| Intact (in development) | ChatGPT and Claude | The one conversation you choose to save. | That conversation, as a file on your computer. |
Depot writes to your Claude account only when you explicitly confirm an action: duplicating a project, restoring from a backup, synchronizing a Shared Library group, or saving an edited document. For project duplication and restoration, it shows a pre-flight dry run of precisely what it will create first, writing nothing until you confirm. Your original projects are never modified without confirmation.
One honest limit, worth stating because it is not obvious: claude.ai only exposes a
downscaled webp preview of an uploaded image, not the original file. Depot saves those previews,
clearly labelled as previews, because the original is not something it can reach. That is a
claude.ai limit, not a Depot one.
Intact is not released yet. When it ships it follows the same rules, and this policy already covers it.
What they read
Each extension reads only what its job needs, in memory and only while you are using it, and nothing else on the page. The table above lists it per tool: Mailplate reads the message you are composing and the Gmail background colour; Depot reads your Claude Projects list and a chosen project's instructions and text documents; Intact reads the one conversation you ask it to save.
None of them reads anything else. Not your other messages, your inbox, your other projects, your contacts, or your account details. None of what they read is logged, and none of it remains once you close the page or finish the task.
What they store
Everything these extensions save is written to your own device and to no server.
Mailplate keeps the templates you save in your browser local extension storage
(chrome.storage.local) on that device. Depot writes backups as zip files on your
computer. Intact writes each conversation as a file on your computer.
None of it is synced between your devices, backed up anywhere, or visible to anyone but you. For anything kept in extension storage, uninstalling the extension deletes it, so if a saved template matters to you, copy its contents out first. Files you have already saved to disk, like a Depot zip or an Intact export, are ordinary files and stay where you put them.
What they send
Nothing. None of these extensions contains code that contacts a heyyoshi server, because there is no heyyoshi server. They load no remote scripts, fonts, or images, and they include no analytics, telemetry, crash reporting, or advertising.
You do not have to take our word for it. Open your browser developer tools, switch to the Network tab, and use the tool: it stays empty. That check takes a few seconds and proves more than any policy page can.
One consequence worth stating plainly: if content you preview links to an image hosted somewhere else, your browser fetches that image from its host while showing it, exactly as it would on any web page. That request goes to whoever hosts the image, not to heyyoshi.
Permissions, and why each is needed
Every permission an extension requests is there to do the job on its one host, and nothing wider:
| Tool | Permission | Why |
|---|---|---|
| Mailplate | storage | Save your templates on your own device, so they are still there next time you compose. |
| Mailplate | mail.google.com | Add the Templates button to the compose window and insert the template you pick. It is the only site Mailplate runs on. |
| Depot | claude.ai | Read your own Claude projects, and create a duplicate project when you confirm one. It is the only site Depot runs on. |
| Depot | scripting | Connect on your first click even if the
claude.ai tab was already open before you installed Depot. The injected code is part of
Depot; it loads nothing from anywhere else. |
| Depot | sidePanel | Open Depot's own panel from the toolbar. |
Between them these extensions ask for no broad host access, no access to any site other than the one each is built for, and no remote code. Intact is still in development; when it ships, its permissions will be listed here in the same way and held to the same rules.
Children
These are general purpose tools and are not directed at children. Since they collect no personal information from anyone, they collect none from children either.
Changes to this policy
If any heyyoshi extension ever changes in a way that affects this policy, the policy is updated here and the date at the top revised. Should a future version, or a future tool, ever collect or transmit anything, which is not planned, it would be disclosed here first, and would not be switched on without asking you.
Contact
Questions about this policy, or about anything one of these extensions does, can go to the Support tab on that tool's Chrome Web Store listing, which reaches the developer directly, or to the developer email address shown there. The studio is heyyoshi, built by Yoshi Bansal.