Consent-Based Screen Alerts · Chrome & Edge Extension · v12.0.11
Blasts is a lightweight browser extension that delivers Screen Blasts — rich, visual alerts from a person whose pairing code you accepted, from an organization you tapped Add for, or from a colleague at your own verified company (delivery notifications, appointment reminders, account updates, and other announcements).
Consent is the core of the product. You decide who may send you Blasts. Nobody can reach you unless you accept their pairing code, you tap Add for an organization, or they are a colleague at your own verified company whose company turned on automatic approval. You can cut off any colleague. This extension does NOT perform any B2B prospecting, lead generation, data scraping, or contact enrichment. It delivers opt-in screen alerts — not a sales-intelligence tool.
We do not collect, store, or transmit your browsing data for advertising or lead generation. The extension does not scrape the websites you visit, does not inject scripts into LinkedIn or Gmail, and does not monitor your browsing for prospecting.
To display a Blast on whatever page you happen to be viewing, the extension shows a small on-screen alert surface. That surface only renders the Blasts sent to you — it does not read, collect, or transmit the content of the pages you visit. Optional CRM page helpers (Salesforce/HubSpot) only add a "log this Blast" action on your own CRM record pages when you choose; they do not read or export your CRM's contact data.
http://localhost on your own computer, and can connect to it with one click after you approve a 6-character code shown inside Cockpit. The connection token is stored encrypted on your device. Nothing about this leaves your PC, and the extension works without Cockpit.Forwarding Blasts into your own Gmail — a double layer of opt-in. Auto-forwarding is entirely under the recipient's control, through two separate, explicit opt-ins:
Only when you turn this on for a specific sender does the extension use the Gmail API — with your Google OAuth consent — to place those Blasts into your mailbox. It never reads your existing email, never sends email on your behalf to anyone else, and you can switch forwarding off for any sender at any time. Forwarding is off by default.
chrome.storage.local on your device (encrypted at rest; not synced to any cloud). Optional cloud sync (off by default): if you turn on "Sync sending accounts to secure cloud for mobile portal access" in the extension, the sending credentials for your bulk Email and Text Blasts — OAuth refresh tokens, provider/CPaaS API keys, and any bring-your-own OAuth client ID/secret — are transmitted over TLS and re-encrypted at rest on our servers using AES-256-GCM envelope encryption. They are decrypted only in memory during an active campaign send, are never exposed through any read interface, and are used solely to send your own campaigns from the online portal. You can erase the cloud copy at any time by turning the toggle off.chrome.storage.sync. Display preferences only — no sensitive data.The extension contacts the Blasts service for its core function. The following are optional and are only contacted when you enable a feature or connect an account with your own credentials:
None of these are advertising or analytics networks. We use no third-party trackers.
LoginBlasts lets you sign in to other companies' apps and websites by approving the request on your own Blasts device instead of typing a password. When one of those services offers "Sign in with Blasts," your phone or extension shows you who is asking, and nothing happens until you approve it.
The company you sign in to never learns your email address from us. We give them a scrambled identifier that is unique to them — a code that means "this same person again" to that one company and nothing at all to anyone else. Sign in to two different companies and each gets a different identifier, so they cannot compare notes and work out that you are the same person.
Where we keep a running note of which computers you have approved before — so an unfamiliar one can be challenged harder — that record is filed under a one-way scramble of your email address, not the address itself, and holds only device identifiers and the time of your last approval.
An organization that provides your Blasts account can set rules about how sign-ins are approved — for example requiring a typed code rather than one tap, or limiting how many sign-ins happen per day. It can also see counts and timings of sign-ins on accounts it provides, in order to spot credential sharing. It does not see the contents of your Blasts messages. Your approval card tells you honestly when a rule has made a sign-in ask more of you, and why.
Questions about LoginBlasts data: support@blasts.app.
Two features use your approximate location to show you what is nearby. Device location is never used to sign you in (see section 8), never sold, never shared with advertisers, and never combined into a profile. If you follow an organization, the ZIP code shown on its card goes to that organization when you tap Add. That choice is described in Newsletters & Organizations.
In both cases the location is approximate by design — a rounded area or a ZIP, never a precise fix — and it goes only to our own Blasts and SavingsSites servers to return nearby results. Location for these features is optional: the app is fully usable without granting the device-location permission.
What we do NOT do with location: we do not track your movements, do not store a location history, do not use device location for advertising, and do not share device location with third parties. The ZIP code you choose to give an organization is covered under Newsletters & Organizations, not under this sentence. Cached results that include your area stay on your device and are cleared when you delete your account or sign out.
You can follow organizations in Blasts: a local newsletter, a church, a club, a chamber, a city office, or a business. Following is your choice. Nothing about you goes to an organization until you tap Add. Organizations are added over time. Until one is added, you will not see the row.
What the organization sees. When you tap Add, the organization can see your name, the ZIP code shown on the card, and the date you joined. It does not see your email address, phone number, or street address. Your name is the name on your Blasts profile. If that name cannot be used, the organization sees "No name on file." You can change the ZIP code on the card before you tap Add. We do not check that the ZIP code is where you live. If you have already changed that ZIP code several times in one day, a later change may leave the earlier ZIP code in place. Looking through the list does not give an organization your name. A ZIP code you type so the list can show organizations near you is used for that list and is not saved as a membership until you tap Add.
What we keep. We keep that membership on our servers so the organization can message you and see its list. We do not charge you for following. If the organization has saved a welcome message, that message can arrive in your inbox after you tap Add. You do not tap a separate button for the welcome message.
Messages. Their messages arrive in your Screen Blasts inbox with the organization's name and logo. We store the text on our servers so we can deliver it. These messages are not end-to-end encrypted. Dismissing a message deletes that copy. Deleting your account deletes the inbox, including these messages. We do not delete them on a fixed schedule. These messages do not ring your phone. In the browser extension these messages add to your unread count. They do not pop up as notifications. They do not include a sponsor message.
Leave, Hide, and Report. Leave takes you off that organization's list when the request succeeds, and it can no longer message you. Leave does not take back the name and ZIP code the organization already saw. Messages from an organization stop showing in your inbox 30 days after they are sent. We do not yet delete the stored copy automatically at 30 days. Dismissing a message that still shows deletes it. Deleting your account deletes all of them. An organization can remove you and block you from joining again. It does not have to tell you. That block lasts until you delete your account. Hide removes that organization's circle on this device. Messages from that organization still arrive until you leave. The organization is not told. Report lets you send us a note about an organization. The note does not include your email address. We do not tell the organization who sent the report. A report we have closed is kept for 365 days. An open report is not deleted on a schedule.
Pictures. An organization gives us its logo, and we approve the name, category, area, and logo before readers see the organization. The logo is shown from our server.
What joining shows. Joining an organization in Faith & Spirituality, News & Politics, Health & Wellness, or Nonprofit & Advocacy tells that organization your name and ZIP code, and that you chose that kind of group. We do not collect a separate beliefs or health field. The terms say you must be 18. We do not check your age when you tap Add.
Organizations are independent. They are not our employees. Approving a name and a logo is not a review or an endorsement of what they send. We may remove an organization at any time.
sidePanel — Display the Blasts inbox and composer in the browser side panel.storage, unlimitedStorage — Save your preferences, approved-sender list, cached Blasts, and any keys you provide (encrypted); unlimited supports long Blast history offline.alarms — Periodic inbox polling and scheduled delivery.notifications — Desktop alerts when Blasts arrive (if enabled).activeTab — Used only when you take an action on the current tab (e.g., capture a selection to send as a Blast).tabs — Open/focus the secure pairing ("connect") page and the side panel.scripting — Render the on-screen Blast alert surface and the optional CRM "log this Blast" helper.identity — Google/Microsoft sign-in (OAuth) so you can send from — and forward to — your own mailbox. Gmail features may request gmail.insert (inbox forwarding) and gmail.settings.basic (safe-list filter); see Section 11.contextMenus — Right-click "Send as Blast".nativeMessaging — Optional license check (reads a stable machine ID) only if you install our desktop helper. The extension works without it.http://localhost/* (optional) — Requested only at the moment you click Connect to M365 Cockpit, so the extension can talk to the Cockpit add-in running on your own PC. Never requested at install; the extension works without it.offscreen — Runs a local analytics database of your own send history, entirely on your device.Network/API access is limited to the specific services listed in Section 7. The optional "all sites" permission is not requested at install — it is requested only at the moment you add a custom delivery webhook, on a per-site basis.
When you connect a Google account, and only for the optional features you explicitly enable, the extension may request these Gmail scopes:
https://www.googleapis.com/auth/gmail.insert — used solely to place the Screen Blasts from senders you approved into your own Gmail inbox (per-sender forwarding; off by default). It is never used to read, modify, send, or delete any of your other email.https://www.googleapis.com/auth/gmail.settings.basic — used solely to create, at your explicit request, a single Gmail filter that keeps a chosen sender's mail out of Spam (a "never send to Spam" / safe-list filter). It is not used to change any other Gmail setting.If you connect Gmail or Outlook under FIND ME, the Blasts server keeps the sign-in token Google or Microsoft gives us on your account so it can place a copy of a Screen Blast in your own inbox. The program does not encrypt that token before it saves it. Disconnect removes it; deleting your Blasts account removes it too.
Blasts' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
This extension's use of information received from Chrome APIs also adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.
This extension contains no analytics, no telemetry, no advertising, and no tracking pixels. We do not collect usage data. There are no calls to Google Analytics, Mixpanel, Segment, or any other analytics service from extension code.
For privacy questions, contact support@blasts.app
Website: blasts.app
Publisher: Tips Marketing Services, Corp
Last updated: October 12, 2026 · Newsletters & Organizations