Privacy, plainly.

Fasthandle privacy policy · Last updated 28 October 2026

Your browser talks to Fastmail.
Your data stays out of our hands.

What the extension stores

Fasthandle stores your Fastmail API token, a cache of your Masked Email addresses, associated sites and notes, local usage records, preferences, and operation recovery information on your device. These records make search, site matching and recovery work.

Chrome uses local extension storage. Safari uses extension-origin IndexedDB. Fasthandle does not sync this data through a Fasthandle service, browser storage sync or a separate native-app account store. The Safari setup app does not maintain another copy of your account.

Fasthandle does not encrypt its local database. Your device and browser profile protections matter. A compromised browser profile or trusted extension page could expose locally stored information.

What is sent to Fastmail

Fasthandle communicates directly with Fastmail over HTTPS. It sends your API credential to authenticate, and sends the site information and notes you choose to associate with an address. Requests to create, read or change an address go to Fastmail, without a Fasthandle server in between.

Session discovery uses api.fastmail.com. The extension restricts the returned API destination to that host or a single regional subdomain such as ams.api.fastmail.com. Other destinations and redirects are rejected.

Your API token needs Masked Email access. Fasthandle does not request mail scope or read email bodies. Fastmail processes the requests and mail delivery under its own policies.

Website access and form filling

When you invoke Fasthandle on a site or grant it site access, it uses the current site and eligible email fields to offer and fill an address. Site-facing content code receives a limited projection for that site. It does not receive your API token or the account-wide cache. Form interaction is processed in your browser; Fasthandle does not upload form contents to an analytics or account server.

Your clipboard

Choosing an address or confirming creation may write that address to your clipboard. Fasthandle never reads or restores your previous clipboard contents. If copying fails, the address remains available for an explicit retry. Undo leaves the clipboard unchanged.

Removing your data

• Disconnect removes the account data, credential, cache, local usage and recovery records from Fasthandle’s local database. It does not revoke your token at Fastmail. You can revoke that token in Fastmail’s settings.
• Clear cached list removes cached account records while retaining the connection. It waits for active writes and does not erase unresolved operations. A later refresh can fetch your addresses again.
• Uninstalling the extension does not delete your Masked Email addresses at Fastmail. Manage those addresses in Fastmail or through the extension before uninstalling.

This website

This website has no analytics, advertising, third-party fonts or tracking cookies. Your light/dark preference is stored in your browser and stays on your device. The animated email addresses on the homepage are illustrations using example addresses. They do not connect to Fastmail or create real addresses.

The hosting service receives the network requests needed to deliver these pages. Following a browser store or GitHub link takes you to that service, where its privacy policies apply.

Questions and changes

For a privacy question, contact the maintainer through the Fasthandle GitHub repository. Never include an API token, private address list or sensitive form contents in a public issue. For a security concern, use the repository’s security reporting instructions.

Policy changes will appear on this page with a new update date. You can inspect the technical privacy statement and source code on GitHub.

Fasthandle is an independent project. Not made by or affiliated with Fastmail.