Blasts — Privacy Policy

Consent-Based Screen Alerts · Chrome & Edge Extension · v12.0.11

1. What This Extension Does

Blasts is a lightweight browser extension that delivers Screen Blasts — rich, visual alerts from senders you have explicitly opted in to receive (delivery notifications, appointment reminders, account updates, and other announcements).

Consent is the core of the product. You decide who may send you Blasts — nobody can reach you without your explicit opt-in. This extension does NOT perform any B2B prospecting, lead generation, data scraping, or contact enrichment. It delivers opt-in screen alerts — not a sales-intelligence tool.

2. Data We Collect

We do not collect, store, or transmit your browsing data for advertising or lead generation. The extension does not scrape the websites you visit, does not inject scripts into LinkedIn or Gmail, and does not monitor your browsing for prospecting.

To display a Blast on whatever page you happen to be viewing, the extension shows a small on-screen alert surface. That surface only renders the Blasts sent to you — it does not read, collect, or transmit the content of the pages you visit. Optional CRM page helpers (Salesforce/HubSpot) only add a "log this Blast" action on your own CRM record pages when you choose; they do not read or export your CRM's contact data.

3. What Runs Automatically

Inbox polling — The extension periodically checks for new Screen Blasts from senders you have approved. This communicates only with the Blasts delivery servers.
Badge notifications — When new alerts arrive, a badge count appears on the extension icon. No popup ads or intrusive notifications.
FIND ME relay — If you enable this optional feature, copies of your Screen Blasts can be forwarded to your email, phone (SMS), or webhook. Off by default. You control which destinations are active.

4. What Runs Only When You Act

Opening the side panel — Shows your Blasts inbox. No data is collected from the page you are viewing.
Sending a Blast — Message content is transmitted through the Blasts delivery network only to recipients who have opted in to receive messages from you.
Managing subscriptions — Block senders, unsubscribe, or set quiet hours at any time.

Forwarding Blasts into your own Gmail — a double layer of opt-in. Auto-forwarding is entirely under the recipient's control, through two separate, explicit opt-ins:

Opt-in #1 — who may send to you: You first decide which senders are allowed to send you Blasts at all, by accepting a pairing code. Nobody can Blast you without this approval.
Opt-in #2 — per-sender forwarding: Separately, and individually for each approved sender, you choose whether that sender's Blasts should also be copied into your own Gmail inbox.

Only when you turn this on for a specific sender does the extension use the Gmail API — with your Google OAuth consent — to place those Blasts into your mailbox. It never reads your existing email, never sends email on your behalf to anyone else, and you can switch forwarding off for any sender at any time. Forwarding is off by default.

5. Data Storage

Account credentials — By default stored only in chrome.storage.local on your device (encrypted at rest; not synced to any cloud). Optional cloud sync (off by default): if you turn on "Sync sending accounts to secure cloud for mobile portal access" in the extension, the sending credentials for your bulk Email and Text Blasts — OAuth refresh tokens, provider/CPaaS API keys, and any bring-your-own OAuth client ID/secret — are transmitted over TLS and re-encrypted at rest on our servers using AES-256-GCM envelope encryption. They are decrypted only in memory during an active campaign send, are never exposed through any read interface, and are used solely to send your own campaigns from the online portal. You can erase the cloud copy at any time by turning the toggle off.
Preferences — UI/notification settings in chrome.storage.sync. Display preferences only — no sensitive data.
Cached Blasts — Recently received alerts cached locally for offline viewing; pruned over time.
Keys you provide — Any optional API keys (e.g., your own AI or CRM keys) are stored locally and encrypted, and are never shared with us or third parties.
Hard-bounce suppression list — When Email Blasts detects a hard bounce (a permanent delivery failure, such as an address that no longer exists), the bounced email address and the bounce reason are automatically reported to our servers to maintain a shared suppression list, so undeliverable addresses are removed from future campaigns and data downloads. No message content, no recipient identity beyond the dead address itself, and no information identifying you as the sender are transmitted.

6. What This Extension Does NOT Do

❌ Does NOT scrape websites or collect browsing data for lead generation
❌ Does NOT inject scripts into LinkedIn, Gmail, or arbitrary sites for data harvesting
❌ Does NOT perform B2B lead generation or prospecting
❌ Does NOT enrich, harvest, or buy contact data via Apollo, Hunter, ZoomInfo, or similar prospecting APIs
❌ Does NOT read your email, messages, or form inputs
❌ Does NOT sell your data to anyone

7. Third-Party Services

The extension contacts the Blasts service for its core function. The following are optional and are only contacted when you enable a feature or connect an account with your own credentials:

Blasts delivery network — Sending and receiving Screen Blasts (operated by Tips Marketing Services, Corp).
Your own email provider — Google Workspace / Gmail and Microsoft 365, via OAuth, so you can send Blasts from your mailbox and (if you enable per-sender forwarding) place your opted-in Blasts into your own inbox.
Your own CRM — Salesforce, HubSpot, Pipedrive, and others — to log Blast engagement when you connect one, using credentials you provide.
OpenAI (optional) — Help composing a Blast, only if you add your own API key.
DeepL (optional) — Translating a Blast, only if you add your own API key.
DNS-over-HTTPS (Google / Cloudflare) — Verifying a recipient's email domain is a genuine Google/Microsoft workspace during pairing.
Internet Archive (optional) — Saving a public snapshot of a Blast you sent, for your records.
Twilio (optional, via Twilio Connect) — SMS/voice relay, billed to your own Twilio account.
Stripe — Payment processing for licensing and credits.

None of these are advertising or analytics networks. We use no third-party trackers.

8. Signing In With Blasts (LoginBlasts)

LoginBlasts lets you sign in to other companies' apps and websites by approving the request on your own Blasts device instead of typing a password. When one of those services offers "Sign in with Blasts," your phone or extension shows you who is asking, and nothing happens until you approve it.

The company you sign in to never learns your email address from us. We give them a scrambled identifier that is unique to them — a code that means "this same person again" to that one company and nothing at all to anyone else. Sign in to two different companies and each gets a different identifier, so they cannot compare notes and work out that you are the same person.

What we record when you use it

Your email address — we need it to know whose device to ring. It is kept with the sign-in request record for up to 30 days, then deleted automatically.
Which service asked — a sign-in request has to say who it is for. This does mean our records show which partner services you have signed in to. We treat that as sensitive and never sell, share, or use it for advertising.
How you approved — whether you typed a matching code, picked from choices, or used one-tap, and when. Used to enforce the security rules your organization sets.
Which device approved — the identifier of the approving device and the identifier of its security key. Not the key itself, which never leaves your device.
Your IP address — recorded in our security audit log so we can investigate abuse and lock out attacks. Kept up to 90 days, then deleted automatically.

Where we keep a running note of which computers you have approved before — so an unfamiliar one can be challenged harder — that record is filed under a one-way scramble of your email address, not the address itself, and holds only device identifiers and the time of your last approval.

What the other company receives

The scrambled per-company identifier described above — not your email address, name, or contacts.
The time you approved, and that the approval came from a Blasts device.
A short-lived proof that expires in five minutes and can only be used once.

What we do NOT do

❌ We do NOT give partners your email address, name, or any contact details
❌ We do NOT sell, rent, or share your sign-in history with anyone
❌ We do NOT use sign-in data for advertising or profiling
❌ We do NOT record what you do inside a service after you sign in — our part ends at the door
❌ We do NOT collect location, browsing history, or device fingerprints for this feature

If your organization uses Blasts for work

An organization that provides your Blasts account can set rules about how sign-ins are approved — for example requiring a typed code rather than one tap, or limiting how many sign-ins happen per day. It can also see counts and timings of sign-ins on accounts it provides, in order to spot credential sharing. It does not see the contents of your Blasts messages. Your approval card tells you honestly when a rule has made a sign-in ask more of you, and why.

Your control

Nothing happens without your approval. Ignoring a request is a refusal — it simply expires.
You can decline any request from the card, and a declined request mints nothing.
You can ask us what we hold about you. Sign-in records are not shown proactively in the app, but they are available on request, and you can ask us to delete your account and its data at any time.
Deleting your account removes these records along with the rest of your Blasts data.

Questions about LoginBlasts data: support@blasts.app.

9. Permissions Explained

sidePanel — Display the Blasts inbox and composer in the browser side panel.
storage, unlimitedStorage — Save your preferences, approved-sender list, cached Blasts, and any keys you provide (encrypted); unlimited supports long Blast history offline.
alarms — Periodic inbox polling and scheduled delivery.
notifications — Desktop alerts when Blasts arrive (if enabled).
activeTab — Used only when you take an action on the current tab (e.g., capture a selection to send as a Blast).
tabs — Open/focus the secure pairing ("connect") page and the side panel.
scripting — Render the on-screen Blast alert surface and the optional CRM "log this Blast" helper.
identity — Google/Microsoft sign-in (OAuth) so you can send from — and forward to — your own mailbox. Gmail features may request gmail.insert (inbox forwarding) and gmail.settings.basic (safe-list filter); see Section 9.
contextMenus — Right-click "Send as Blast".
nativeMessaging — Optional license check (reads a stable machine ID) only if you install our desktop helper. The extension works without it.
offscreen — Runs a local analytics database of your own send history, entirely on your device.

Network/API access is limited to the specific services listed in Section 7. The optional "all sites" permission is not requested at install — it is requested only at the moment you add a custom delivery webhook, on a per-site basis.

10. Google API Services — Restricted Scope Disclosure & Limited Use

When you connect a Google account, and only for the optional features you explicitly enable, the extension may request these Gmail scopes:

https://www.googleapis.com/auth/gmail.insert — used solely to place the Screen Blasts from senders you approved into your own Gmail inbox (per-sender forwarding; off by default). It is never used to read, modify, send, or delete any of your other email.
https://www.googleapis.com/auth/gmail.settings.basic — used solely to create, at your explicit request, a single Gmail filter that keeps a chosen sender's mail out of Spam (a "never send to Spam" / safe-list filter). It is not used to change any other Gmail setting.

Blasts' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is used only to provide or improve these user-facing features.
We do not sell Google user data, and do not use or transfer it for advertising, profiling, or creditworthiness.
We do not transfer Google user data to third parties except as needed to provide the feature you enabled, to comply with law, or as part of a merger/acquisition with notice.
We do not allow humans to read your Google user data, except: with your explicit consent (e.g., support you request), where required for security or to comply with applicable law, or where the data has been aggregated and anonymized.

This extension's use of information received from Chrome APIs also adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.

11. No Tracking

This extension contains no analytics, no telemetry, no advertising, and no tracking pixels. We do not collect usage data. There are no calls to Google Analytics, Mixpanel, Segment, or any other analytics service from extension code.

12. Contact

For privacy questions, contact support@blasts.app

Website: blasts.app

Publisher: Tips Marketing Services, Corp

Last updated: July 6, 2026 · v12.0.11