Privacy Policy

Effective date: March 18, 2026

Altus Labs LLC ("we", "us", "our") operates the Connect for Fastmail Chrome extension and related website. This Privacy Policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

Account Information

When you create an account or start a trial, we collect your email address and payment information (processed by our payment provider — we do not store card numbers).

Attachment Data

When you preview a document, the attachment is temporarily uploaded to our Monolith Docs API for rendering. Documents are processed in memory and are not stored permanently. Rendered sessions are discarded after the preview window is closed or after 24 hours, whichever comes first.

Extension Usage Data

We collect basic, anonymized usage telemetry: number of previews opened, file types used, and error events. We do not collect the contents of your emails, attachment filenames, or browsing history.

Anonymous Tracker Statistics

The extension can collect anonymized counts of blocked trackers by category (ads, analytics, social, fingerprinting). This collection is disabled by default and requires your explicit opt-in consent via the "Share anonymous tracker stats" toggle in the extension popup. Counts are uploaded using a random device identifier that is not linked to your email, identity, or any personal information.

This data is used to display aggregate statistics (e.g., "X trackers blocked across all users") and to improve our tracker detection. If you log in to the extension, your device identifier is linked to your account so you can view your personal stats in the Account Portal. This linkage is disclosed during login. You can revoke consent at any time by unchecking the toggle in the extension popup.

Link Safety Checks

When you hover over or click a link in an email, the extension may send the URL to our API for redirect resolution and safety checking via Cloudflare Security DNS. This is used to protect you from phishing and malware. We cache resolved URLs for 24 hours but do not associate them with your identity.

IP Addresses

When your extension authenticates with our server, we record a one-way hash of your IP address for rate limiting and fraud prevention. We do not store your raw IP address. Hashed IP data is retained for up to 90 days and then deleted.

Community Image Intelligence

If you opt in to Community Image Intelligence (enabled by default), your extension anonymously reports image URL patterns and sender domains when you reveal or classify blocked images. This data is used to build a shared whitelist that helps all users distinguish legitimate images from trackers.

We do not collect your email address, email content, user identity, or any personally identifiable information as part of these reports. Only normalized URL patterns (with tracking parameters stripped) and sender domains are shared. You can opt out at any time in your Account Portal under Privacy Protection.

Waitlist & Contact Forms

If you join our waitlist or contact us, we store your email address to communicate with you about the product.

2. How We Use Your Data

• To provide and maintain the document preview service
• To manage your subscription and process payments
• To send transactional emails (receipts, trial expiry, account changes)
• To improve the extension based on anonymized usage patterns
• To respond to support requests

3. Data Sharing

We do not sell your data. We share data only with:

• Payment processor — to handle subscription billing
• Hosting infrastructure — to operate the document rendering service

All third-party processors are bound by data processing agreements and handle data solely on our behalf.

4. Data Retention

• Documents: Discarded immediately after preview session ends, or within 24 hours maximum.
• Account data: Retained while your account is active. Deleted within 30 days of account closure or deletion request.
• Tracker stats: Retained while your account is active; deleted with your account. Aggregated, non-identifiable totals may be retained indefinitely for public statistics.
• IP hashes: Retained for up to 90 days for fraud prevention, then automatically deleted.
• Link safety cache: Resolved URLs cached for 24 hours, not associated with any user identity.

5. Chrome Extension Permissions

Connect for Fastmail requests only the minimum Chrome permissions needed to operate:

• Host permissions for Fastmail — to detect and intercept attachment clicks within the Fastmail web app.
• Host permissions for our Docs API — to upload and render attachments.

We do not access other tabs, browsing history, or any data outside the Fastmail web application.

6. Your Rights

You may at any time:

• Export your data — download a complete copy of your personal data from your Account Portal under "Download my data."
• Delete your account — request permanent deletion from your Account Portal under "Delete my account." A 30-day grace period allows you to cancel before data is permanently removed.
• Revoke consent — disable anonymous stats collection or error reporting at any time via the extension popup toggles.
• Uninstall the extension to immediately stop all data collection.
• Cancel your subscription from your Account Portal.

You may also exercise these rights by emailing privacy@altuslabs.net.

7. Security

All data in transit is encrypted via TLS. Document rendering sessions are isolated and ephemeral. We follow industry-standard practices to protect your information.

8. Children's Privacy

Connect for Fastmail is not directed at children under 13. We do not knowingly collect data from children.

9. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or a notice in the extension. Continued use after changes constitutes acceptance.

10. Contact

Altus Labs LLC
Email: privacy@altuslabs.net