Privacy policy

Effective date: 20 August 2026

Fromensics is operated by Zima Media OÜ, an Estonian private limited company (registry code 17241943, VAT EE102861338), doing business as Fromensics (“Fromensics,” “we,” “us,” or “our”), located at Sepapaja tn 6, Lasnamäe linnaosa, Tallinn, 15551, Harju maakond, Estonia. This Privacy Policy explains how Fromensics handles information when you use the Fromensics Chrome extension, visit fromensics.com, use proxy.fromensics.com, purchase or use Fromensics Pro, or contact us.

Fromensics’ single purpose is local sender investigation for the Gmail message you select.

1. The short version

Fromensics investigates a Gmail message only after you choose it and click Investigate Sender. The extension reads and analyzes that message primarily on your device. Fromensics does not operate a central database of analyzed emails and does not receive the full message through the ordinary investigation flow.

Strict Local mode prevents investigation-related DNS, RDAP, and proxy lookups. The extension still makes operational requests that do not contain message content, such as checking fromensics.com for signed threat-feed updates. If you enable Private Live-Check, the extension may send a single domain or hostname needed for a lookup. Pro license validation sends the license key and extension version.

We do not sell personal information, use analyzed-message data for advertising, or train general-purpose AI models on your messages.

2. Scope and roles

This policy applies to Fromensics-controlled services. Gmail, Google Chrome, the Chrome Web Store, Whop, DNS and RDAP providers, and other third-party services have their own privacy notices and act under their own terms.

Where applicable under data-protection law, Zima Media OÜ is the controller of personal information received by Fromensics-operated services. Information that remains solely in your browser is stored and processed locally by the extension and is not collected into a Fromensics server database.

3. Information the extension handles

A. The Gmail message you select

After you click Investigate Sender, the extension may read the following from the open Gmail page:

• sender email address and display name;
• subject, visible date, message body, quoted text, and visible links;
• message and thread identifiers used to associate local results with the selected conversation;
• attachment names when Gmail exposes them; and
• mailed-by, signed-by, and other message details that Gmail exposes.

If you use the optional Show original workflow, the extension may also process headers or original-message content that you explicitly paste or ask Gmail to display. Pasted headers are kept in extension session storage for the current browser session.

Fromensics does not use the Gmail API and does not request Google account OAuth in the current version.

B. On-device results and settings

The extension creates findings, scores, model outputs, and investigation summaries on your device. Local storage may include:

• the most recently selected message and its extracted content;
• sender name/address, subject, verdict, score, timestamps, and conversation identifier in investigation history;
• structured output from on-device AI, including extracted claims or tactics;
• privacy and model preferences, onboarding status, and license key;
• license status and entitlement cache;
• signed threat-feed files and feed status;
• DNS and RDAP lookup results; and
• optional locally downloaded model files managed by Chrome or browser storage.

Free keeps up to 50 investigation summaries and AI scan records; Pro keeps up to 500. The most recently selected full message remains until another message replaces it or the extension’s data is cleared. Removing the extension or clearing its site/extension data through Chrome deletes extension-controlled local storage. Chrome-managed model files may need to be managed through Chrome.

C. On-device AI

If available and you choose to run it, Chrome’s on-device Prompt API (Gemini Nano) analyzes selected message text locally. Chrome may download and manage the model. Fromensics servers do not receive the prompt or message through this analysis path. Google or Chrome may process operational information about browser and model functionality under Google’s own policies.

The current version does not download third-party WebGPU model weights. If that changes, we will disclose the model provider, download source, size, and data flow before enabling the feature.

4. Information sent off the device

A. Signed threat-feed updates

The extension includes a local threat feed and ordinarily checks https://fromensics.com/feed/ for a signed update about every 12 hours. These requests do not include message content or message-derived indicators. As with ordinary web requests, the hosting provider may receive network and HTTP information such as IP address, request time, requested file, user agent, and security logs.

B. Private Live-Check

If you explicitly enable Private Live-Check, the extension derives a registrable domain or hostname from the selected message and may send that single indicator for:

• DNS-over-HTTPS queries to Google Public DNS or Cloudflare;
• RDAP bootstrap or registration queries to IANA, RDAP.org, or the authoritative RDAP service; or
• Pro DNS, RDAP, or reputation queries through https://proxy.fromensics.com.

The ordinary lookup flow does not send the message body, subject, recipient list, email-address local part, full headers, or full private URL. The report identifies the lookups attempted. DNS and RDAP providers receive the indicator and ordinary request metadata and apply their own privacy policies.

Pro proxy lookup requests contain the license key, lookup type, and indicator. The proxy may send the indicator to Google Public DNS, Cloudflare, or RDAP.org to complete the lookup.

C. Pro license validation and membership events

When you check a Pro license, the extension sends only two fields to https://proxy.fromensics.com/api/license/validate: the license key and the extension version (JSON fields licenseKey and extensionVersion). It does not send the email, subject, body, or recipients. The Whop company API key is not in the extension; it stays on our server. Checking a license is optional and is not required to investigate a sender.

The proxy sends the license key to Whop to validate the membership. Whop may also send Fromensics membership events containing a membership ID, license key, membership status, product ID, or plan ID.

The proxy hashes license keys for caching and rate limiting. Its durable cache may store the license-key hash, membership ID, entitlement status, update time, and short-lived rate-limit counters. Entitlement cache records currently expire after approximately 30 days and rate-limit counters after approximately two hours, although infrastructure security logs and backups may follow the provider’s retention schedule.

D. Website, support, and payment information

The current fromensics.com site does not contain Fromensics analytics or advertising scripts. Our hosting and security providers may nevertheless process IP address, request headers, timestamps, requested pages, and security events in standard logs.

If you contact us, we receive the information you provide, such as your name, email address, message, and attachments. Do not send an unredacted email under investigation unless we specifically ask for it and you consent to our reviewing that specific content.

Whop handles checkout and payment information for Pro. Fromensics may receive purchase, membership, plan, status, and license information, but does not receive complete payment-card details from the extension. Whop’s privacy policy governs information collected on its checkout and account pages.

5. Why we use information

We use information to:

• provide the investigation, local history, threat feed, live lookup, and Pro features you request;
• validate licenses, manage entitlements, prevent abuse, and enforce rate limits;
• maintain, secure, debug, and improve Fromensics without using private message content for unrelated product training;
• respond to support and rights requests;
• process purchases and administer memberships; and
• comply with law and protect users, Fromensics, and others.

For users in the EEA, UK, or similar jurisdictions, the legal bases may include performance of a contract, your consent for optional live checks or specific support access, our legitimate interests in operating and securing the service, and compliance with legal obligations. You may withdraw consent for future live checks at any time by returning to Strict Local mode.

6. When we disclose information

We disclose information only as described in this policy:

• Service providers: Cloudflare for website/feed hosting and security; Vercel for the privacy proxy; Upstash for entitlement cache and rate limiting when configured; Whop for checkout and membership validation; and DNS/RDAP providers for optional lookups.
• Your direction: when you enable a lookup or ask us to review specific information for support.
• Security and law: when reasonably necessary to investigate abuse, protect rights or safety, comply with law, or respond to valid legal process.
• Business transfer: in a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable notice or consent requirements. Chrome Web Store user data will be transferred in this context only as permitted by its Limited Use requirements.

We do not sell or rent personal information, provide it to data brokers, use it for personalized advertising, or use it to determine creditworthiness or lending eligibility.

7. Human access and AI training

Fromensics personnel do not read the content of messages analyzed by the extension because those messages are not ordinarily sent to us. If we do receive user data, humans may access it only with your explicit consent for specific data, where necessary for security or abuse investigation, to comply with law, or in aggregated and anonymized form for lawful internal operations.

We do not use Gmail message content to train general-purpose or shared AI models. On-device output is used only for the report and local history unless you deliberately send specific content to support.

8. Retention and deletion

Local extension data remains in your Chrome profile until it reaches a record cap and older records are replaced, you overwrite it through later use, or you clear the extension data/remove the extension. DNS cache entries are used for up to 24 hours, and RDAP cache entries for up to 30 days, but expired browser records may remain physically stored until replaced or extension data is cleared.

Server-side entitlement cache records currently expire after approximately 30 days; rate-limit counters after approximately two hours. Support correspondence is retained for up to 24 months after the last contact unless a longer period is required for an ongoing dispute. Transaction, tax, and accounting records are retained for seven years as required by Estonian accounting and tax law. Cloudflare and Vercel security and access logs follow those providers’ schedules, typically up to 90 days unless a security investigation requires longer.

To request deletion of information held by Fromensics, contact privacy@fromensics.com. We cannot directly delete local browser data on a device we do not control; use Chrome’s extension controls for that data. Purchases and Whop account data may also require a request to Whop.

9. Security

Fromensics uses HTTPS for network transfers, validates signed feed updates, omits credentials from ordinary lookup requests, minimizes lookup payloads, hashes license keys in the proxy cache, and restricts accepted proxy fields. No system is perfectly secure, and we cannot guarantee absolute security.

10. International transfers

Our providers may process information in the European Union, the United States, and other countries. Cloudflare hosts fromensics.com and the threat feed. Vercel hosts the privacy proxy. Upstash, when configured, stores hashed license-entitlement cache. Whop processes checkout and membership validation. Optional lookups may go to Google Public DNS, Cloudflare DNS, IANA, or RDAP.org.

Where GDPR or UK GDPR requires a transfer mechanism, we rely on the European Commission’s Standard Contractual Clauses or another approved mechanism offered by the provider, or on a transfer that is otherwise lawful.

11. Your privacy rights

Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, or objection; withdraw consent; and complain to a data-protection authority. You may also have rights to know the categories and sources of personal information, the purposes for use, and the recipients, and to opt out of sale or sharing. Fromensics does not sell or share personal information for cross-context behavioral advertising.

Send requests to privacy@fromensics.com. We may need to verify your identity. Authorized agents may submit requests where local law permits. You will not receive discriminatory treatment for exercising a privacy right.

The Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) is Zima Media OÜ’s lead supervisory authority.

12. Children

Fromensics is not directed to children under 13, or the higher minimum age required where they live. We do not knowingly collect children’s personal information through Fromensics-operated services. Contact privacy@fromensics.com if you believe a child provided information to us.

13. Chrome Web Store Limited Use

Fromensics complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Our detailed statement is available at fromensics.com/limited-use.

14. Changes

We may update this policy. We will change the effective date and provide additional notice in the extension when a change materially expands collection, use, or disclosure. Where law or Chrome Web Store policy requires consent, the new practice will not begin until consent is obtained.

15. Contact

Zima Media OÜ
Sepapaja tn 6, Lasnamäe linnaosa
Tallinn, 15551, Harju maakond
Estonia

Registry code 17241943 · VAT EE102861338
privacy@fromensics.com · support@fromensics.com