Is Insert and Send HTML with Gmail safe?

Insert and Send HTML with Gmail transmits a hashed version of the signed-in Gmail address and compose-action events to Google Cloud Pub/Sub.

The extension reads the signed-in user's Gmail address from the page, computes a SHA-256 hash prefixed with 'inboxsdk:', and includes that hash in telemetry events batched in localStorage. Events covering actions such as compose open, attachment uploads, and Drive button clicks are posted to a Google Cloud Pub/Sub topic (project mailfoogae) using a hardcoded API key. Error reports containing the same email hash, session ID, and stack traces are separately sent to api.inboxsdk.com.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.