SpamCipher is an AI-powered sales engagement platform, B2B lead intelligence database, and email deliverability
and security suite in one product. SpamCipher Setup (the "Extension") sets up your domain's email authentication (SPF, DKIM, DMARC and the
records that go with them) at your DNS host and your mail provider. It works in your own browser, on pages
where you are already signed in, and only after you approve the plan in your
SpamCipher account. This policy says what it reads, what leaves your
browser, and what it never touches.
In one line: the Extension works only on the sites a setup you approved needs, reads only
what that setup needs from them (such as the DKIM record your mail provider shows, or a DNS key it creates),
sends that to your SpamCipher account, and never reads or types a password or payment detail. When a provider's
page has changed and a step cannot find what it looks for, an outline of that page, with the setup's own values
and any addresses, long numbers and codes removed, may go through SpamCipher to an AI model that suggests a way past it. Only if you click
the Extension's icon when it asks can it also send one picture of that page, with the same things covered. Nothing is sold, and SpamCipher never
uses your data to train AI models.
What the Extension reads
A setup token for one setup. When you press Start in SpamCipher, the app hands the
Extension a token that works for that one setup only, for at most two hours, and stops working when the
setup ends or you stop it. It is kept in your browser's memory for the session, not on disk, and it is
not your password.
The plan you approved and its steps. The Extension fetches them from SpamCipher. Each
provider's steps are a fixed list (open this page, wait for that heading, press this button, read that
value) delivered as data; no code is downloaded.
The parts of a provider's page a step names. On the sites the setup needs, the
Extension finds the buttons, fields and text its steps name, by their labels. It reads only the values a
step asks for: for example the DKIM record Google Admin shows, the API key a DNS host shows once when
it is created (limited to DNS where the host allows), or whether a setting is on.
What leaves your browser
To SpamCipher only, over an encrypted connection (TLS): whether each step finished, why it stopped if
it did, and the values the step read. A key read on a provider's page is sent once, in that one message.
A key the Extension reads is never stored in the Extension, never written to a log and never shown on
screen. SpamCipher stores it encrypted in your account and uses it only to change the DNS records of the
domain you are setting up.
When a step cannot find the button, field or words it looks for, the Extension may send SpamCipher an
outline of that one page: the labels of its headings, buttons, links and fields, and the words shown on it, so
an AI model can suggest a way past it: one other step, or up to four steps that only move around that provider's
own site (open one of its pages, wait for it, or click a link, tab, menu item or button whose words do not save,
create, add, send or switch on anything). Before the outline leaves your browser, the values this setup works
with (your domain, the account you use, the records it adds, a key it read) are replaced by placeholders,
including where the page shows only their start, and email addresses, numbers of four or more digits and long
codes are removed. The contents of text fields are never read, so nothing typed into one is in it. Other words
the page shows can remain, such as the names of your other domains or records, or the name on the account. For
each link, the outline keeps where it goes (the site and page address), without anything after a ? or #.
SpamCipher sends the outline through OpenRouter, a service that passes it to the AI model's provider. SpamCipher
pays for this (it costs you nothing) and asks OpenRouter to use only providers that, as OpenRouter lists them, do
not keep or train on what they are sent: Kimi K2.6 first, DeepSeek if it does not answer, and Claude Sonnet when
no usable answer comes back. SpamCipher keeps the model's short reason for its suggestion with the setup's
record, never the outline. What the model suggests is checked against the same rules as every other step before
it runs. SpamCipher looks for a way past a step at most six times in one setup, and each time it may ask a second
model. When a suggestion works, SpamCipher keeps the step itself (which button or link to use, or which page of
the provider's site to open) and, once the same step has worked in two different customers' workspaces, may use it in
other customers' setups with the same provider, so that it needs no AI model there. A step that holds a domain
name, an email address, a long number or a code is never kept, and the model's reason stays with SpamCipher's
staff. When a way past the same step has worked before, the Extension
tries that first, and no AI model sees the page for it.
When the outline is not enough, SpamCipher may ask to see the page itself. The Extension's panel asks you to
click its icon in Chrome's toolbar, and only that click lets it take a picture: one picture of the setup's own
tab, while that tab is on screen, for each click. Before the picture is taken, the Extension covers in black
every text field, drop-down list, editable area, embedded frame (part of the page loaded from elsewhere), small
picture that looks like a profile photo, and any page text holding the setup's values, an email address, a long
number or a code, and it hides its own panel. Words drawn inside a picture on the page are not covered. It
throws the picture away if the page changed meanwhile. The picture goes once, with the outline, through
OpenRouter to Claude Sonnet only; SpamCipher does not keep it. If you do not click, no picture is taken and the
setup carries on with the outline alone.
Apart from that outline and picture, nothing is sent to anyone else. There are no analytics or advertising trackers in the
Extension.
What the Extension never does
It never reads, fills or submits a password, a payment or card field, a one-time code or a recovery
setting. You sign in, pass two-step verification and solve any check yourself; the Extension waits.
It never acts on nameservers, DNSSEC, domain transfers, renewals, contact or WHOIS details, privacy
settings, billing, purchases, subscriptions, user or admin roles, or sign out. These are refused by the
Extension itself, whatever a page or a step says.
It never works on a site the setup did not ask for, and never follows a link off those sites, including
when it is finding its way around a changed page.
It never takes a step outside the plan you approved.
It does not read your browsing history, the pages you visit or what you type.
It never sells your data or shares it beyond the page outline and picture above, and SpamCipher never uses it to train AI
models.
Permissions, and why
storage: keep the setup token in browser memory for the setup, and remember which version it
last updated itself to.
scripting: run the setup's steps on the provider page the setup opened.
activeTab: take the pictures described above, one for each click on the Extension's icon on the
setup's own tab when it asks. Chrome lets it see only that tab.
Access to api.spamcipher.com and app.spamcipher.com: the Extension's own
service and app (fetch the plan, report each step, receive the setup from the app).
Access to the consoles of the mail providers and DNS hosts the Extension has or is building steps for, allowed
when you install it, so a setup you approved in SpamCipher runs without asking again: admin.google.com,
postmaster.google.com and workspace.google.com (Google Workspace), dash.cloudflare.com (Cloudflare),
dcc.godaddy.com and developer.godaddy.com (GoDaddy), hpanel.hostinger.com
(Hostinger), www.spaceship.com (Spaceship), porkbun.com (Porkbun),
ap.www.namecheap.com (Namecheap), and my.ionos.com and my.ionos.ca (IONOS).
The Extension does nothing on these sites until a setup you approved opens one of them.
Access to other sites (https://*/*), optional: only for a provider not in the
list above. A setup that needs one asks you, in Chrome's own prompt, for that exact site,
and gives the access back when the setup ends.
Keeping and removing data
The Extension keeps nothing about a setup once it ends: the token is deleted, and access to any site the setup
asked you for is returned. The only thing it remembers is which version it last updated itself to.
What a setup changed at your DNS host is recorded in your SpamCipher account with what it replaced, so
Undo all can put it back. A DNS key the setup made stays in your account, encrypted, until
you disconnect it there; you can also delete it at your DNS host at any time. Your SpamCipher data is
governed by the main SpamCipher terms and privacy policy.
Who we are
SpamCipher is operated from Canada and hosts data in the United States.
Contact
Questions about this policy: contact us in the SpamCipher app (profile menu) or at
spamcipher.com/contact.