Is MailMagic - AI Email Assistant powered by ChatGPT safe?

Medium risk

MailMagic reads Gmail thread bodies when you open a conversation and sends the content to app.mailmagic.ai.

When a Gmail thread opens, the content script expands hidden messages, extracts visible body text and the signed-in account email, and builds a gmail://account/thread URL. The background worker sends that URL and parsed message content to MailMagic's browser-extension messages-history API.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

DevFortressv1.0.0Chrome Web Store
40Risk
Who publishes it

9361-9195 Quebec Inc - 2 other listings from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
DevFortress
Declared legal entity
9361-9195 Quebec Inc
Registered address
11015 Cavendish Blvd, Apt. 407, Saint-Laurent, QC H4R 2H5, CA
Registered contact
Shao Hang He

Same store account

2 other listings published from this account, 2k+ users between them. 1 of them carries a finding.

Shared hosts - 3 hostnames

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

app.mailmagic.ai
Also called by 5 other listings, including Mail Magic, Instagram AI, WhatsApp AI
mailmagic.ai
Also called by 5 other listings, including Mail Magic, Instagram AI, WhatsApp AI
staging.mailmagic.ai
Also called by 5 other listings, including Mail Magic, Instagram AI, WhatsApp AI

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 1.0.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on mail.google.com

    https://mail.google.com/*

  • Read and change your data on chatgpt.com

    https://chatgpt.com/*

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Mail Magic contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • app.mailmagic.ai

    Mail Magic sends data to app.mailmagic.ai. 5 other extensions we have analysed send data here.

Updated 30 September 2026efkagogbohcbmhhcfpphbibapmeaiklc