Privacy Policy
Message Science LLC · Effective date: May 28, 2025 · Extrovert privacy choices updated September 29, 2026
extrovert.dev is a service provided by Message Science LLC. This policy applies to it.
Your privacy matters. This Privacy Policy explains how Message Science LLC ("Message Science," "we," "us," or "our") collects, uses, discloses, and safeguards information when you access or use our email mailbox software-as-a-service platform, websites, mobile apps, and related services (together, the "Service"). Optional advertising data use requires your separate choice; using the Service does not give advertising consent.
1. Information We Collect
| Category | Examples | Source |
|---|---|---|
| Account Data | Name, postal address, company, email, phone number, user ID, authentication credentials | Provided by you during sign-up or profile updates |
| Payment Data | Last four digits of card number, expiration date, billing address (full card data is handled by our payment processor) | Provided by you; stored by processor |
| Email Content | Messages, attachments, folders, metadata | Created or imported by you |
| Usage Data | Log files, IP address, browser type, device identifiers, timestamps, clickstream | Collected automatically |
| Cookie & Tracking Data | Session cookies and privacy-preference cookies; optional Google Analytics, PostHog and Meta advertising measurement, as described below | Collected automatically with consent where required |
| Support Data | Chat transcripts, tickets, feedback | Provided by you |
We do not knowingly collect information from children under 13 (or the applicable age of digital consent). If we learn that we have, we will delete it.
Structured support reports
Extrovert support reports collect limited task descriptions, summarized attempts, accessible resource references and known versions. Do not include credentials, transcripts or email bodies. Automatic reporting is off unless a human organization administrator opts full integrations in; Assistant reporting requires an explicit request. Raw evidence is reviewed by a human before a selected brief is available to staff tools.
Unlinked feedback expires after 90 days. Open cases remain available; resolved cases and linked evidence expire after one year. Administrators can delete standalone feedback and resolved cases. Evidence needed by another case follows that case's retention. Backups age out within 30 days. Approved synthetic evaluation fixtures can remain independently, without source personal identifiers. Learn about support reporting.
2. How We Use Information
We process information to:
- Provide and maintain the Service: create accounts, route and store email, ensure delivery, and back up data.
- Improve and develop features: analyze usage, test, troubleshoot, and enhance performance.
- Ensure security: detect fraud, spam, abuse, and security incidents.
- Communicate with you: send transactional emails, respond to requests, and provide customer support.
- Marketing with consent: send newsletters or promotions; you can opt out any time.
- Comply with law: meet legal, tax, and regulatory obligations.
Legal bases (where the GDPR applies) include performance of a contract, legitimate interests, consent, and compliance with legal obligations.
3. Sharing and Disclosure
With Marketing consent, we share limited advertising information with Meta as described in section 8. We may otherwise share information:
- Service providers: payment processors, hosting and customer support partners under contracts requiring confidentiality.
- Business transfers: in connection with a merger, acquisition, or asset sale.
- Legal requirements: to comply with subpoenas, court orders, or other lawful requests, or to protect rights, property, or safety.
- With your consent: if you explicitly authorize disclosure.
4. International Transfers
Servers may be located in the United States and other countries. Advertising data is also processed by Meta as described in its linked privacy policy. Contact us for information about applicable transfer arrangements.
5. Data Retention
We keep personal data only as long as necessary for the purposes described in this Policy, including dispute resolution and compliance with legal obligations. Contact us for information about deletion and backup retention applicable to your account.
6. Your Choices and Rights
Depending on your jurisdiction, you may have rights to:
- Access, correct, or delete personal data.
- Object to or restrict processing.
- Port data in a structured, machine-readable format.
- Withdraw consent at any time.
- Lodge a complaint with a supervisory authority.
Submit requests by emailing privacy@messagescience.com or through account settings. We may verify your identity before responding.
Marketing Opt-Out
Click the "unsubscribe" link in promotional emails or adjust preferences in your account. Transactional and essential communications will still be sent.
7. Security
We use access controls and technical safeguards to protect the Service. No method of transmission or storage is completely secure; we cannot guarantee absolute security.
8. Cookies, analytics and advertising choices
Essential cookies support authentication, security and privacy preferences. They remain enabled. Marketing is optional and off by default everywhere. You can keep using Extrovert without making a choice or after rejecting optional tracking. Analytics is a separate optional choice, also off by default.
Google Analytics: with Analytics consent, we load Google Analytics on the public extrovert.dev website to understand visits and acquisition campaigns. Google receives public page addresses, campaign parameters, browser/device and connection information, and analytics cookie identifiers. Analytics cookies last up to 180 days and may be renewed on a visit. Private console pages are not included. We do not send account identifiers, email content, credentials or payment details to Google Analytics. Google advertising signals and ad personalization are disabled in this integration. Without Analytics consent, we do not load the Google tag or send cookieless analytics pings. Withdrawal disables further collection and removes our Google Analytics cookies; it cannot recall data already transmitted. See Google’s privacy policy.
PostHog product analytics: with Analytics consent, PostHog measures public website pageviews, selected navigation and pricing clicks, successful agent-prompt copies, and app screen visits. We send pseudonymous browser/session identifiers and coarse browser/device information. App screen names replace organization, project, inbox and submission identifiers with route templates; app query strings, page titles and fragments are not sent. We do not identify your account or send email addresses, message content, credentials, billing details or form contents. Session replay, automatic click capture, error capture and heatmaps are disabled. PostHog data is sent to its US service. Its analytics cookie is shared across extrovert.dev subdomains, lasts up to 180 days and may be renewed on use. Withdrawal stops capture and removes analytics persistence when the running page synchronizes your choice. See PostHog’s privacy policy.
Meta advertising measurement: with current Marketing consent, Meta Pixel sends one homepage PageView per document on extrovert.dev and a CompleteRegistration event on the public signup-confirmation page. The Pixel is not installed on private console or billing pages. Meta receives the permitted page address, browser and connection information and its advertising cookies. Automatic event detection and Advanced Matching are off.
Our server-side Meta Conversions API integration measures an eligible first successful payment confirmed by Stripe, when the verified human initiating payment has consented. It sends the payment time, a stable event identifier, actual collected amount (including tax, before payment fees or refunds), currency and first-payment designation. It can include a redacted payment-page address, the initiating browser’s IP address and user agent, actual Meta browser/click identifiers when available, and hashed verified account email and account identifier. Hashing does not make these identifiers anonymous. We do not send renewals, free or failed payments, email content, mailbox recipients, attachments, credentials or payment-card details.
Our server may send a CompleteRegistration event when a newly verified account is linked to a consented website session, provided Marketing consent was already active at signup and remains active when the event is sent. It can include the signup time, a stable event identifier, the browser’s connection information from the authenticated consent request, and hashed verified account email and account identifier. It does not include payment value. The browser confirmation and server event share the same server-assigned event identifier so Meta can deduplicate them. If consent cannot be linked to the account, no registration event is sent.
These measurements help attribute ads, measure revenue and return on advertising spend, improve ad delivery and support relevant advertising on Facebook and Instagram. Missing consent, GPC or unavailable consent checks prevent tracking. Payment processing works without Marketing consent. Payments made before consent are not sent later merely because you accept.
Browser payment-attribution records expire after seven days. Queued server events are checked again before each attempt and expire within six days of the event. Matching payloads are removed after delivery or terminal suppression; ordinary billing records and minimal delivery/deduplication records remain separate.
Sharing with an advertising network for cross-context advertising may be considered a “sale” or “sharing” under applicable US state privacy laws. Marketing stays off unless you choose to allow it. We honor Global Privacy Control (GPC) as an opt-out: it keeps Marketing and Analytics off even if you previously accepted them. For information about Meta’s practices, see Meta’s privacy policy.
Open here, in the website footer or in the console footer to review or withdraw your choice. Withdrawal is as easy as acceptance and does not affect the lawfulness of processing before withdrawal. Promotional-email subscriptions are separate from this advertising choice.
An essential, secure cookie named __Host-extrovert_privacy on api.extrovert.dev
connects the website and console to the same preference record. Each site also keeps an essential
extrovert_privacy_ui cookie for the preference interface. A shared
extrovert_privacy_change cookie signals changes between the website and app; it contains
no account information and cannot grant consent. Cookies last up to 180 days; choices
expire after 180 days or a policy revision change. The record includes your choice, its time and policy
revision. When signed in, we associate the preference with your account so a later withdrawal can prevent
future server-side advertising use. A previous account permission cannot override a browser rejection or GPC.
Both sites recheck the shared record. If synchronization fails, Marketing remains off in that browser; failed withdrawals are saved locally and retried when the connection returns. A withdrawal cannot reach our servers while your device is offline, and cannot recall events already sent or a transmission already in progress. Privacy choices will show a sync failure until it succeeds. If you clear or block cookies, the browser defaults to Marketing off; use Privacy choices to withdraw an existing account preference, or contact privacy@messagescience.com.
9. Third-Party Links
The Service may contain links to third-party sites. We do not control and are not responsible for their privacy practices. Review their policies before providing information.
10. Changes to This Policy
We may update this Privacy Policy periodically. Optional advertising requires separate consent to the applicable revision. Newly verified registrations may now be measured through the Conversions API; this update uses revision 5 and requires a fresh Marketing choice.
11. Contact Us
For questions, requests, or concerns:
Message Science LLC
MessageScience.com/contact