Privacy policy

Privacy policy

What Sent in Stone can see, what it can't, what we keep, and what you can do about it.

Last updated: November 12, 2026

1. Who we are

Sent in Stone is a Gmail add-on and email sending service operated by Semicognito. In this policy, "we" and "us" mean Semicognito, which is the controller of the personal data described here.

Email: hello@sentinstone.com

Mailing address: Semicognito, Av. Engenheiro Luís Carlos Berrini, 1748 - Conjunto 1710, HR: 121861 - Cidade Monções, São Paulo - SP, 04571-000, Brazil

2. The short version

  • We never read your inbox and never store the email you receive.
  • We read the single email you're replying to, only when you tap our reply control.
  • The email you send passes through our servers so it can be delivered. We keep delivery records, not the content.
  • We don't sell your data, use it for advertising, or use it to train AI models.
  • This website uses no cookies, no analytics and no tracking.

3. What we access in your Google account, and why

Sent in Stone asks Google for the smallest set of permissions it needs. Each one is listed here with what it allows and why we need it.

Running as an add-on in Gmail

Permission: gmail.addons.execute

This lets Sent in Stone appear and run inside Gmail as an add-on. Without it, there would be no reply button to tap.

Reading the email you have open, when you tap

Permission: gmail.addons.current.message.action

When you tap our reply control, and only then, we read the single email you have open. We use its sender, subject, threading headers and text to fill in your reply: who it goes to, the subject line, its place in the conversation, and the quoted message. We can't read any other email, and we can't read this one until you tap.

A hidden app folder in your own Google Drive

Permission: drive.appdata

Sent in Stone uses a hidden app folder in your own Google Drive to hand the reply over to our compose window and to keep your drafts, so they sync across your devices. Only Sent in Stone can see that folder. It's invisible in Drive, and it's removed when you uninstall the add-on. Our servers never read it: the compose window reads it in your own browser. This permission gives no access to any of your other Drive files.

Your Google identity

Permission: basic Google sign-in (your name and email address)

We use your name and email address to know which account, and which domains and addresses, are yours.

4. What we never do

  • We never read your inbox.
  • We never store the email you receive.
  • We never sell your data.
  • We never use your data for advertising.
  • We never use your data to train AI models.

5. What passes through our servers, and what we keep

The email you send. When you send from our compose window, the email, its recipients and your From address pass through our servers so that our sending provider can deliver it. We don't keep the content once it has been handed over for delivery.

Delivery records. For each email you send we keep a delivery record: times, status codes and message IDs. These let us show you whether an email was delivered, handle bounces and complaints, and prevent abuse. They never include the content of the email. We keep delivery records for [CONFIRM: retention period of delivery records].

Your account. We keep your name and email address from Google sign-in, the domains and addresses you set up to send from, and the status of your subscription. [CONFIRM: complete list of account data stored]

Messages you send us. If you email us for support, we keep that correspondence so we can help you.

6. Service providers

We share personal data only with the companies that help us run the service, and only as far as they need it to do their job:

  • Amazon Web Services (Amazon SES) delivers the email you send.
  • Paddle processes payments as our merchant of record. Paddle collects your payment details under its own privacy policy; we never see your card number.
  • Cloudflare hosts this website and routes our own email.

These providers may process data in countries other than your own, including the United States. Where the law requires it, such transfers are covered by appropriate safeguards, such as standard contractual clauses. [CONFIRM: AWS region used for sending]

We may also disclose data when the law requires us to.

7. This website

This website sets no cookies and uses no analytics, no tracking pixels and no third-party scripts or fonts. Everything you see is served from our own domain. Like any website, our hosting provider (Cloudflare) processes technical data such as IP addresses in order to deliver pages and protect the site.

8. Google API Services User Data Policy

Sent in Stone's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular: we use the data we receive from Google only to provide the features described in this policy; we don't transfer it to others except as needed to provide those features, to comply with the law, or as part of a merger or acquisition; we don't use it for advertising; and no person reads it unless you ask us to (for example, to investigate a problem you report) or it's needed for security or to comply with the law.

We process personal data to provide the service you signed up for (performance of a contract), to keep the service secure and prevent abuse (our legitimate interests), and to meet our legal obligations, such as keeping records of transactions.

10. Your rights

Wherever you live, you can ask us to:

  • tell you what personal data we hold about you and give you a copy;
  • correct data that is wrong;
  • delete your data;
  • stop or restrict a use of your data that you object to.

To use any of these rights, email hello@sentinstone.com. We'll answer within the time the law allows.

If you're in the European Union, the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) gives you the rights of access, rectification, erasure, restriction, objection and data portability, and the right to complain to your local data protection authority.

If you're in Brazil, the Lei Geral de Proteção de Dados (LGPD) gives you the rights set out in its Article 18, including confirmation of processing, access, correction, anonymization, portability, deletion and information about sharing, and the right to complain to the Autoridade Nacional de Proteção de Dados (ANPD).

11. How to revoke our access

You can take away Sent in Stone's access to your Google account at any time:

  • Open your Google account's third-party apps and services page, choose Sent in Stone and remove its access.
  • Uninstall the Sent in Stone add-on from Gmail. This also removes the hidden app folder in your Google Drive.

To have your account and delivery records deleted from our systems as well, email hello@sentinstone.com.

12. Children

Sent in Stone is a business tool and isn't directed at children. We don't knowingly collect data from children.

13. Changes to this policy

If we change this policy, we'll update this page and the date at the top. If a change is significant, we'll tell you by email or inside the product before it takes effect.

14. Contact

Questions about privacy: hello@sentinstone.com.