CommitLatch is a privacy-first Chrome extension. All of your data stays on your own device. We have no servers, no accounts, no tracking, and no analytics. We cannot see, read, or share any of your data because we never receive it.
AI features run on your device by default (Chrome's built-in AI — zero network requests). Optionally, you can connect a cloud AI provider with your own API key; only then is the text of the thread you explicitly ask about sent — directly to the provider you chose, never to us.
When you use CommitLatch, the extension stores the following locally on your device (in Chrome's built-in storage and IndexedDB):
| Data | Where | Why |
|---|---|---|
| Thread items (next steps, waiting, blockers, risks, follow-ups) | Your device | The core feature — captured actions from your email threads |
| Contacts auto-extracted from email signatures (name, email, company, title) | Your device | To enrich thread items with context |
| Activity log (e.g., "email received from X") | Your device | Timeline display in the panel |
| Reminders you set | Your device | Chrome Alarms API to notify you at due time |
| Preferences (theme, notification toggles, AI engine choice) | Your device | Remember your settings |
| Your AI provider API key (only if you add one) | Your device | Sent only to the provider you chose, with your requests |
| License key (only if you buy Pro) | Your device | To validate your Pro purchase |
| Time-saved metrics (count of auto-captures, etc.) | Your device | The "Time saved this week" widget |
If you purchase CommitLatch Pro, activating your license sends only the license key to our payment provider (Freemius) to check it's valid. No email content, no contacts, no usage data — just the key. Validation results are cached locally.
By default, no. CommitLatch:
The only network requests the extension can ever make are the two you opt into:
Both use optional permissions that Chrome asks you to approve explicitly.
Permissions we request at install:
storage — to save your items on your devicealarms — to wake the extension for reminders you setnotifications — to show desktop notifications for due itemssidePanel — to open the CommitLatch panel next to Gmailoffscreen — a hidden extension page that runs Chrome's on-device AI (it makes no network requests)mail.google.com host access — to inject the UI into GmailOptional permissions, requested at runtime only if you enable the feature:
api.anthropic.com — only if you choose Claude as your cloud AI providerapi.openai.com — only if you choose OpenAI as your cloud AI providergenerativelanguage.googleapis.com — only if you choose Gemini as your cloud AI providerapi.freemius.com — only if you activate a Pro licenseWe do not request:
identity (no Google sign-in)history, cookies, tabs, or any other invasive permissionThe extension reads Gmail's DOM (the visible page) to display contact data you already see. It never sends anything to Gmail that wasn't already there. Gmail (Google) sees the same activity it always does — you reading your own inbox.
No. There are no developer-accessible servers, databases, or logs. Your data exists only in your Chrome profile.
When you remove CommitLatch from Chrome, all data stored by the extension is automatically deleted by Chrome, along with the extension itself. There is nothing left behind on any server because nothing was ever sent to a server.
You have full control over your data:
Only the two optional ones described above (your chosen AI provider; Freemius for Pro licenses). No analytics SDKs, no crash reporters, nothing else.
CommitLatch is a productivity tool for adult professionals. We don't knowingly collect data from children under 13 (or under 16 in the EU). Since we don't collect data from anyone, this is automatic.
If this policy ever changes, we will update this document and notify users via the extension before any new data flow is introduced.
Questions, concerns, or feedback about privacy:
CommitLatch is built and maintained by Eren Labs.