Last updated: September 21, 2026. This policy covers Jev Detector and the Jev for Gmail extension, provided by StealthGPT.
Looking to remove your data? See Google user data retention and How to delete your Google user data, or contact support@stealthgpt.ai.
What happens to pasted text
When you click “Scan with Jev,” the text is sent over HTTPS to a Jev Detector server function hosted by Vercel and then to TypeSafe's Jev API for analysis. The result is returned to your browser.
What happens in the Gmail extension
On Inbox, the extension takes strict Gmail thread IDs from the currently rendered list page with a hard maximum of 50 conversations. It does not use displayed subjects or snippets as email content and does not request Gmail's next page itself. If you use Gmail's Next or Previous control, that newly opened page can be scanned as a separate pass. Category scans remain limited to rendered rows. The extension does not search or crawl older conversations in the background.
For each discovered ID, the extension service worker fetches the full thread directly from Google's Gmail API. It keeps the bodies of inbound messages for processing and excludes messages Gmail marks as sent mail, drafts, chats, spam, or trash, including the mailbox owner's replies. It attempts to remove quoted history and signatures. Named file attachments are not downloaded or analyzed; inline plain-text or HTML body parts can be read when Gmail exposes that body through an attachment reference. Extraction filters are a convenience rather than a security boundary, so do not scan sensitive mail you are not allowed to share.
The cleaned inbound text is sent in bounded requests to Jev Detector's batch endpoint and TypeSafe for Jev analysis. The analysis request does not include OAuth credentials, subjects, sender or recipient fields, timestamps, attachments, or Gmail thread and message identifiers. After analysis, the extension displays “Strong AI Detected,” “Mild AI Detected,” or “No AI Detected” beside each reviewed Inbox row. A conversation with too little inbound sender text to score receives the neutral “Not Enough Text” badge. These results are cached locally for the browser session so they can reappear after reloading Gmail during that session. Every manual scan also saves the corresponding native Gmail classification labels, recreating missing label categories so scanned conversations can be organized from Gmail's sidebar. Mail is moved only if you enabled an optional Spam or Trash rule. If you click Remove all AI labels, the extension clears its local badge cache, lists Gmail labels, and deletes only its four exact current names and four exact legacy Jev names. Gmail removes those label definitions from every message and thread carrying them. No email is deleted, moved, or sent by label cleanup.
If Gmail cannot save all labels, a manual “Retry saving labels” option retries only labels on already-scored messages from that same account and page. It does not reread mail, repeat analysis, or repeat Spam/Trash actions. The pending operation contains message identifiers, classifications, scores, and counts, but no bodies, subjects, or snippets. It becomes unavailable for retry after ten minutes and is removed when next checked. It is cleared earlier after success, disconnect, label cleanup, or a replacement scan, and session storage is also cleared when the browser restarts or the extension is reloaded, updated, or disabled.
Optional Gmail actions
Saving Gmail labels without moving mail is the default. A user can instead choose Move to Spam or Move to Trash and decide whether that action applies to Strong AI Detected results only or both Strong and Mild AI Detected results. Either moving action requires an explicit confirmation explaining that it applies to future manually started visible-page scans and moves the entire Gmail conversation, including the user's own replies. Changing the threshold while a move rule is active requires the same confirmation again. The extension worker independently checks the saved account setting and confirmation before changing Gmail. Page content cannot authorize a move, and a Not Enough Text result never triggers one.
A Spam action adds Gmail's spam label and removes the conversation from the Inbox after applying its Jev label. Use Not spam in Gmail's Spam folder to recover it. A Trash action uses Gmail's thread-trash operation after applying the Jev label. Use Move to inbox in Trash to recover it before Gmail's normal deletion window. The scan result reports the number moved and repeats the relevant recovery steps. A recent move can also be undone during the same browser session. Jev Detector does not use Gmail's permanent-delete operation.
Google authorization
Reading whole threads and applying persistent labels or selected actions
requires Google's gmail.modify permission. The extension
creates a fresh random state value and PKCE verifier, opens Google's
consent page only after a user click, and validates the exact Chromium
completion URL and returned state. Jev Detector's HTTPS callback and
exchange endpoints relay and exchange the short-lived authorization code.
Offline access lets the extension renew your connection without asking
you to sign in for every session. Google's refresh token is sealed in an
authenticated, account-bound encrypted credential. There is no server-side
Gmail connection database or retained refresh-token record.
The returned short-lived Google access token is stored only in
chrome.storage.session, under a one-way hash of the Gmail
address and restricted to trusted extension contexts. The Gmail page
content script never receives it. The encrypted renewal credential is
stored in trusted chrome.storage.local and persists across
browser restarts. It is sensitive authorization, even though its contents
are encrypted. Jev Detector's OAuth endpoints temporarily decrypt it to
renew or revoke Google access. Neither credential is sent to TypeSafe or
exposed to the Gmail page. Only clicking Connect Gmail opens the consent
window; scans remain manual.
Disconnect Gmail removes the saved connection from this browser and asks Google to revoke it. If Google cannot be reached, the app reports that revocation was not confirmed; you can also revoke access in your Google Account. Google may require you to reconnect after revocation, account policy changes, or grant expiry. In Google's external Testing mode, Gmail grants expire after seven days.
You can revoke access from your Google Account at any time. Jev Detector's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google user data retention
We retain Google user data only for the purposes and periods described below. Jev Detector does not maintain a server-side mailbox archive, Gmail connection database, refresh-token record, or durable scan queue. The account keys used in extension storage are one-way hashes of the Gmail address; they separate accounts but are not a claim of anonymity.
- Email content and scan processing: Gmail message content is processed in memory while the requested scan runs. Cleaned inbound text passes through our Vercel-hosted endpoint to TypeSafe's Jev API. Jev Detector does not save message bodies, subjects, sender names, or recipient names in extension storage or an application database, and does not intentionally log email content. Working data is discarded as the scan and request state are released; it is not kept as a retrievable scan archive. Provider records are described separately below. Text itself may contain personal information even though separate sender and recipient fields are not sent for analysis.
- Temporary connection and result data: the Google access token and its expiry, the latest scan summary, duplicate-scan state, and a cache of up to 500 thread IDs with classifications and scores per account are held in trusted extension session storage. Tokens are used only before their expiry; expired entries are removed when checked. Result state remains for the browser session unless replaced, evicted from the cache, or cleared by the controls below. Session storage is cleared when the browser restarts or the extension is disabled, reloaded, updated, or removed.
- Retry and Undo records: records needed to retry label saving or undo a recent move include message/thread identifiers, classifications, counts, actions, and timestamps, not email bodies. Retry and Undo expire after ten minutes and may be cleared earlier. Expired records are removed when next checked, or earlier when their operation completes, the record is replaced, you disconnect, or session storage is cleared. Label cleanup also clears pending label retries.
- Saved connection: an encrypted, account-bound credential containing the Google refresh token is stored in trusted local extension storage so the connection can survive browser restarts. It has no fixed application retention period: it remains until you disconnect, the app recognizes that authorization is no longer valid, or the extension's local data is removed. OAuth exchange, renewal, and revocation endpoints process credentials transiently; they do not save a server-side connection record.
- Preferences: your per-account classification threshold, label/Spam/Trash rule, and action confirmation remain in local extension storage until changed or the extension's local data is removed. Disconnecting does not delete these preferences.
- Gmail labels: native classification labels and their assignment to messages are stored in your Google account, not just in the extension. They remain until you remove them through Jev's label cleanup control or Gmail. Disconnecting or uninstalling does not remove them, undo previous moves, or delete your emails.
How to delete your Google user data
- Remove saved Gmail labels: while connected, choose Settings → Remove all AI labels. This deletes Jev's current and legacy label categories from Gmail. After successful cleanup, it also clears the local badge cache and last-scan state. Your emails stay in place. If Google reports a failure, some labels may remain; retry cleanup or remove those labels directly in Gmail.
- Disconnect and clear the connection: choose Disconnect Gmail for the account. This removes its saved encrypted renewal credential, access token, cached scan results, pending retries, and Undo record from this browser, and asks Google to revoke access. Preferences and native Gmail labels remain as explained above. If revocation cannot be confirmed, remove Jev Detector from your Google Account connections. Revoking access stops future authorized access; it does not recall requests that were already processed.
- Remove all local extension data: uninstall Jev for Gmail from the browser's Extensions page. The browser removes its local and session storage, including saved preferences. Uninstalling alone does not revoke Google's grant or remove Gmail labels, so use the steps above first. Repeat these steps in each browser/profile where you installed or connected the extension.
To request deletion of Google user data associated with Jev Detector, or get help with these controls, email support@stealthgpt.ai with the connected account address and approximate dates of use. Do not send passwords, access tokens, or copies of private emails. We use the request information to verify the request, identify any data held on your behalf, and handle deletion, including coordinating with service providers where applicable. We cannot remotely clear storage in your browser; use the controls above for that. Request correspondence is retained while needed to handle and document the request or meet legal obligations.
Pasted text and permitted use
Text pasted into the website is also processed for the requested scan, not saved in an application document database or intentionally logged as document content. Clear the editor or close the page to discard the displayed passage and results.
Jev Detector uses Google user data to provide the requested scanning, labeling, and optional mailbox actions. We do not sell Google user data, use it for advertising, or use data obtained through Google Workspace APIs to develop, improve, or train non-personalized AI or machine-learning models. TypeSafe's published privacy policy also states that it does not train or fine-tune models on API input.
When scans run
The first Google connection and every scan require a click. Opening Gmail, connecting, receiving mail, or changing pages never starts a scan. An Inbox pass is limited to the currently rendered page of at most 50 conversations; category passes remain limited to rendered rows. Moving to another Gmail page lets you start a separate pass with the Scan button. Cached badges can reappear without another scan. It does not monitor or crawl Gmail while no supported list page is rendered. A pass runs in the extension service worker and is not a server job that continues after the browser stops it.
Service provider retention and deletion
Vercel hosts our endpoints and TypeSafe processes the text sent for Jev analysis. Their processing and technical records are separate from the extension's local storage. TypeSafe's published policy retains personal data for as long as reasonably necessary for its services or business purposes and describes deletion or de-identification on request when data is no longer needed, subject to legal retention. It does not state a fixed number of days for API-input retention. We do not promise zero retention or immediate erasure by either provider. Disconnecting or uninstalling Jev does not itself erase provider records; contact us at support@stealthgpt.ai for help with a deletion request. Review Vercel's privacy policy and TypeSafe's privacy policy for their practices. Do not submit secrets, regulated data, or text you are not allowed to share.
Cookie-free site analytics
Jev Detector uses Vercel Web Analytics to measure anonymized page views, referrers, approximate location, browser, device, and operating system. Vercel Web Analytics does not use cookies. It does not receive the text pasted into the detector or scanned by the Gmail extension. The extension itself contains no analytics. Learn more in Vercel's Analytics privacy documentation.
Detection limits
Results describe writing patterns. They are not proof that a person or an AI wrote the text and should not be used as the sole basis for academic, employment, moderation, or disciplinary decisions.