Privacy Policy — Codext CRM browser extension
The short version
Codext CRM is a client for a CRM you host yourself. The extension has no backend of its own. Everything it reads is sent to the CRM address you type into its options page, and to nowhere else. Codext GmbH operates no server that receives your data, and we cannot see it.
What the extension reads
- The Gmail conversation you have open. The sender, recipients, subject and message text of the thread on screen, taken from what Gmail has already rendered. It does not read your inbox listing, your other mail, your Google account, or any of Gmail's network traffic.
- The LinkedIn profile you are viewing. Name, headline, employer and profile URL, from the rendered page.
- Any other page — only when you ask. Opening the side panel or using a right-click action runs a one-off script on the current tab to find email addresses on it. No content script runs on the sites you browse; nothing is read in the background.
What the extension sends, and where
All network requests go to the CRM URL you configured and to no other host. Codext GmbH receives nothing.
Sent to your CRM:
- The email address being looked up, so your CRM can return the matching record.
- When you press Sync on a message, or Sync conversation: the messages you selected (at most the 25 most recent in the thread).
- When you save a lead or log a note: the fields you filled in, plus the conversation if you ticked "Attach this conversation".
Opening a conversation sends nothing on its own, unless you have switched on "Sync every conversation automatically" in Options.
What the extension stores
Your CRM URL, your API key and your preferences are kept in chrome.storage.sync
(encrypted at rest by Chrome, and synced across your Chrome profile by Google if you have Chrome
Sync enabled). Writes that could not reach your CRM — a note, task or sync made while offline —
are queued locally in chrome.storage.local and retried until they succeed.
The API key is read only by the extension's service worker. It is never exposed to page scripts,
and never sent anywhere except to your own CRM as an Authorization header.
Which sites the extension can reach
The extension declares access to two sites only — mail.google.com and
www.linkedin.com — because that is where its panels run. It has no standing access
to anything else you browse.
Your own CRM is not on that list and does not need to be: the extension reaches it as an ordinary cross-origin request, which your CRM allows. Any other page is read only for as long as it takes to answer one explicit request from you, using the access Chrome grants for the current tab when you press the shortcut or pick a right-click action.
What we do not do
- We do not sell or transfer your data to third parties.
- We do not use or transfer your data for any purpose unrelated to the extension's single purpose.
- We do not use or transfer your data to determine creditworthiness or for lending purposes.
- We run no analytics, no telemetry, and no advertising in the extension.
Retention and deletion
Codext GmbH stores nothing, so there is nothing for us to retain or delete. Data sent to your CRM lives in your own database, under your control. Mail that has already been synced can be removed in the CRM under Settings → Email → Delete synced mail. Removing the extension clears its stored settings, including the API key; revoke the key itself in the CRM under Settings → API keys.
Changes
Material changes to this policy will be published here, and the "last updated" date above will change.