Give to Reach

Privacy policy

Last updated: 26 September 2026. This policy exists only in English. The Portuguese, Spanish, French and German pages of this site summarise it for convenience; where a summary differs from this text, this text is the one that applies.

Give to Reach is a free Gmail add-on. Once an hour it looks at new mail in your inbox, sets aside cold pitches from people you have never dealt with, and replies in the thread with a link to give a small amount to GiveDirectly, with a shorter note each time the sender writes again. When the gift lands, the email comes back to your inbox. This page is for people who install the add-on ("you") and for people who write to them ("senders", see For senders).

Who runs Give to Reach. Give to Reach is run by Sergio González, in Portugal, who is the data controller for the personal data described on this page, apart from what stays inside your own Google account. On this page, "we" and "us" mean Give to Reach's operator. Contact: privacy@givetoreach.com.

1. In one paragraph

The add-on runs on Google's servers, inside your own Google account, as you. No server of ours holds a permission to your mailbox. Mail from people you know is read no further than its headers. The text of a first-time sender's email, unless its headers show it is automated, is sent from your account to an AI model, which says what kind of email it is and, for a cold pitch, how well it was researched; the text is then discarded. A cold pitch is set aside and answered, and so are job applications, investors and the press if you choose them in Settings. Everything else stays in your inbox, unread; a customer, a personal note or a kind you have not chosen gets a label saying what it looked like. The Give to Reach relay receives scores, a category, a one-line description of what was being sold, which note was shown, a salted one-way hash of the sender's address and what happened next, as well as your settings and profile. Never the message itself. The relay also receives Every.org's notice of each gift and keeps it until your add-on collects it. Nothing is ever deleted from your mailbox, and nothing about your mail is sold, used for advertising, or used to train AI models.

2. The permissions it asks for, one by one

These are the five Google permissions (OAuth scopes) the add-on asks for, all declared from the first version so that an update never has to ask for more. Each heading is the identifier your Google account lists at myaccount.google.com/permissions.

3. What it reads

• Message headers of new mail in your inbox: sender, recipients, subject, date, message id, authentication results (SPF, DKIM, DMARC), mailing-list and auto-reply headers, and Gmail's own category. Headers are enough to tell whether a sender is known to you, and to leave automated mail alone: Gmail's Promotions, Social, Updates and Forums tabs, bounces, auto-replies and calendar invites.
• The text of mail from first-time senders only, to have it classified and scored and to recognise a sender writing again from a new address. Known senders are left alone: anyone you have written to or answered by hand, anyone at an organisation you have written to, colleagues on your own domain, anyone a known person introduces in a thread, anyone you mark as known or whose set-aside email you bring back, and anyone who gave. Your sent mail is searched only to tell who these are and whether a sender has already had a note, and your own reply to a sender who gave is read only to measure its length. The add-on does not read your contacts.

4. What leaves your account, and to whom

Apart from what this section lists, your mail stays inside your Google account, where Google runs the add-on. Three recipients receive something: an AI model, Every.org, and the Give to Reach relay, which Cloudflare hosts.

An AI model, which reads mail from first-time senders

Since September 2026 the model is Anthropic's Claude, called through Anthropic's API; Anthropic is a United States company. If the provider ever changes, this line is updated and dated before the change ships.

• Why: the model's answer is how a cold pitch is told from a job application, an investor, a customer or a personal note, and it decides whether an email is set aside. Mail from people you know never reaches it, and neither does automated mail, mail from a sender who asked to stop or whom you ruled a liar, or a LinkedIn message you have chosen not to answer.
• What is sent: the subject and the text of the message, whole, with your name and email address replaced by placeholders; the sender's name and text as they wrote them; and your profile (your role, company, stage and industry, and anything you add), so the model can judge whether the pitch fits you.
• What comes back: what kind of email it is, scores against a fixed nine-point rubric, a category, what they sell in one line, the sender's role and company size, how the email opened, and short excerpts of the opening line, the credibility claim and the ask. The add-on keeps these in its record in your account (section 7) and discards the message. The excerpts never leave your account.
• The request goes straight from your Google account to the provider, never through the relay, under Give to Reach's own agreement with the provider. Anthropic's commercial terms do not allow it to train models on this data, and it deletes API inputs and outputs within 30 days, unless the law or an investigation of misuse requires otherwise.

Every.org, the donation platform

• What Every.org receives: the link in the note carries the amount and a code for that one email. The sender gives Every.org their own details when they give. The add-on itself makes no request to Every.org.
• What comes back: when a gift is made, Every.org sends a notice of it to the Give to Reach relay. The relay keeps the code, the amount and net amount, the currency, the charity, the date, how often and how it was paid, and Every.org's reference for the payment. It discards the rest on arrival, including the donor's name and any note, and keeps the donor's email address only as a salted one-way hash, like the one it keeps for senders. Your add-on collects the notice on its next hourly run and uses it to bring the right email back; the relay then deletes the notice, and the gift's details, but not Every.org's reference, join that email's record there. When a gift matches no email, your add-on uses the hash only to look for the donor's address among those it already keeps, so you can match the gift by hand. Section 7 says how long each of these is kept. Every.org, a registered US 501(c)(3) public charity, is the legal recipient of the gift, issues the donor's receipt, and handles the donor's details under its own privacy policy.

The Give to Reach relay

The relay runs at go.givetoreach.com on Cloudflare, with its database in Western Europe. It holds no Google permission and cannot reach your mailbox.

• What is sent, for each email the model read: the rubric scores, the kind of email and its category, what they sell in one line, the sender's role and company size, how the email opened, how it arrived (direct, mass mail or LinkedIn), whether it landed in spam, whether it carried a tracking pixel, a scheduling link or a disguised link, which note and price were shown, the code in that email's link, a salted one-way hash of the sender's address, what happened, with times (set aside, note sent, gift made and its amount, thank-you page reached, email restored, you replied and how long your reply was, the sender asked to stop or wrote back, your rulings), and technical details of how it was handled, such as which rule applied and the model's version. Every hour it also sends counts of the mail it looked at and of why it left mail alone.
• What is never sent: the message, its subject, its excerpts, the sender's name or address, or your email address.
• What the relay knows about you: an id for your copy of the add-on, its version, when it last checked in and last collected gifts, the gift notices waiting for it and what it did with them, the four-character code all your links carry, whether you are out of office, and your settings and profile, with a history of their changes. Your profile is your name (at first, your Gmail sending name), your role, your company, its stage and industry, and anything you add.
• Your page at givetoreach.com. You sign in with Google, and the relay keeps only your Google account's email address. It keeps it with your copy of the add-on so the page recognises you, which means the relay can tell which records are yours.
• What donors see. After giving, a donor reaches a thank-you page that shows your first name, the reply promise their note made and whether you are away.

Outside the European Economic Area

Anthropic, Cloudflare and Google, which handle personal data for Give to Reach, are United States companies, and so is Every.org. Transfers to Anthropic, Cloudflare and Google from the European Economic Area are covered by the European Commission's standard contractual clauses or by the EU-US Data Privacy Framework, under each company's data processing terms; write to us for details. Every.org receives a sender's details from the sender, when they give.

5. What it never does

• No one but you reads your mail, and Give to Reach keeps no copy of any message.
• Nothing is deleted from your mailbox. Mail that is set aside moves under a visible label, and a restore only ever touches a thread the add-on set aside.
• No advertising, no sale or rental of personal data, no data brokers, no credit or lending use, and no use of anyone's mail to train AI or machine-learning models.
• No permission beyond the five above, and none used for anything this page does not describe.
• It never answers a reply to its own note, and it stops at 20 notes an hour and 60 a day.

6. Your controls and your rights

• Your profile. Until you have filled in the four profile fields (role, company, stage and industry) on the Profile tab of your page at givetoreach.com, no email is sent to the model or answered, and no pitch is set aside.
• Rulings. Beside an email the add-on set aside, its card offers to restore it; when the sender answered the note instead of giving, it also offers to mark them a liar, which blocks their address for good and their organisation's domain for 30 days. A gift, or moving the email back to your inbox, lifts both blocks and makes the sender known. Beside an email left in your inbox with a label, the card offers to mark the sender known. Each ruling can be undone from the same card.
• Scoring and pooled results. Scoring is how the add-on decides what happens to each email, and each email's record at the relay, which carries no message, name or address, joins the pooled results (section 8). Both stop when you uninstall.
• Take a break. On the Account tab of your page at givetoreach.com, you can pause the add-on for a day, a week, or until you resume. New mail stays in your inbox and no notes go out; the add-on only checks in with the relay, each hour and when its card is opened (at most once a minute), to learn when the break ends. A gift made during a break waits at the relay, and its email comes back when the break ends.
• Uninstall. Uninstalling revokes every permission above, and so does removing the add-on at myaccount.google.com/permissions. Your mail then arrives as normal, and anything still set aside stays under its label for you to restore by hand.
• Delete. Your page at givetoreach.com deletes you from the relay in one step: the link to your Google account, your settings, your profile and your change history. A gift still waiting for your add-on stays at the relay, without the donor's hash, until the add-on collects it or for at most 180 days. If the add-on is still installed, it reconnects within the hour and starts a new record. The anonymised data your inbox contributed to the pooled results stays, with nothing in it that can be tied back to you: not your emails, not your senders' names or addresses, not your identity. You can also write to us from the Google account you signed in with, and we do the same.
• Your rights. The legal basis is our agreement with you, these terms, for running the service, and our legitimate interest in publishing what the experiment finds, in figures that name no one, for the pooled results. You can ask to see, correct, restrict or delete what we hold about you, or for a copy in a portable form: your settings and profile are on your page, and for anything else write to us. You can complain to Portugal's data protection authority, the CNPD (cnpd.pt), or to the authority where you live or work.
• Your right to object. You can object to the pooled use at any time: uninstall, then delete your data on your page or write to us.

7. What is kept, where, and for how long

• In your Google account, in storage Google keeps for the add-on, while the add-on is installed: its labels; your settings; which messages it has looked at and which senders have had a note, as one-way hashes; its lists of known and blocked senders, by address; and, for up to 90 days, a short record of each email it handled (the sender's name and domain or LinkedIn profile link, the subject, the verdict, the scores and the excerpts) and, to recognise a sender writing again from another address, that sender's address, name and signature details. Uninstalling revokes the add-on's access to all of it.
• At the AI provider: the message text, for up to 30 days, as section 4 says.
• Gifts: at the relay, Every.org's notice of each gift until your add-on collects it, and never more than 180 days; the donor's address is in it only as a salted one-way hash, for at most 14 days. A gift your add-on could not match to an email also stays, without the hash, for at most 180 days, in case it can still be matched. Once a notice is deleted, a one-way code for its payment is kept for 180 days, so the same gift is never handled twice. A notice the relay cannot read is kept for 30 days, without the donor's address, so it can be delivered by hand. In your account, a gift that matched no email is kept for up to 14 days, with the donor's address when the add-on has it, so you can match it by hand. For notes sent before 25 September 2026, Every.org's notice may still arrive in Give to Reach's own storage at Google, with the donor's address, and is kept there for up to 14 days.
• At Every.org: whatever a gift normally creates there, under Every.org's own policy.
• At the relay: the records about emails, for as long as Give to Reach runs and publishes results, then deleted; your settings and profile, until you delete your data on your page (unlinking your Google account from the page removes only that link); sign-ins, for one day. Cloudflare keeps standard request logs for the relay for up to seven days. If a gift's notice cannot be read or stored, the relay's log may keep its code, amount, date and Every.org's reference for as long.

8. Published results

Give to Reach will publish statistics about the cold email participants receive on a public results page: pooled figures only, never for a group small enough to point to anyone, and never naming a sender or a participant. A line of your own, under an anonymous label, appears only if you agree to it separately, and you can withdraw that at any time.

9. Google API Services User Data Policy and Limited Use

In plain words: data obtained through the permissions above is used only to provide the add-on's own features described on this page; it is transferred to others only as listed in section 4, for security purposes, or to comply with the law; it is never used or transferred for advertising, never sold to data brokers or information resellers, and never used to determine credit-worthiness or for lending; no person other than you reads it, except with your agreement for specific messages, for security (such as investigating a bug or abuse), to comply with the law, or once it has been aggregated: at the relay we look only at pooled figures, never at one email's record or one person's profile, except in those same cases; and it is never used to develop, improve or train generalized artificial intelligence or machine-learning models.

10. For senders

This section is for someone who emailed a Give to Reach user and received the automated note, or who gave through a note's link.

• Who. The person you wrote to uses Give to Reach in their own mailbox and decides what happens to your email there. Give to Reach is responsible for the data its relay keeps and for the published results; who runs it, and how to reach us, is at the top of this page.
• What is used, and where it comes from. From your email and its headers: your address, your name, the subject, the text and the details in your signature. From Every.org, if you give: the gift's amount, currency and date, how often and how it was paid, Every.org's reference for it, and your email address. The relay discards your name and any note on arrival, and keeps your address only as a salted one-way hash, for at most 14 days, to help match your gift to your email by hand when the code in your link is not enough.
• What happens to it. Your message is sent from the recipient's account to the AI provider named in section 4, which says what kind of email it is and, for a pitch, scores it against a rubric; the text is then discarded, and Give to Reach keeps no copy. The recipient's add-on keeps, for up to 90 days, a short record (your name and domain, the subject, the scores and short excerpts) and your address and signature details, to recognise you writing again from another address; if you give, ask to stop or are blocked, your address stays on its lists. The relay keeps the facts listed in section 4 (the scores, the category, what you sell, your role and company size, which note you were shown, what happened next) for as long as section 7 says, with your address only as a salted one-way hash, so a sender who writes more than once, or to more than one person, counts once, and a request about your address can be answered. No one at Give to Reach reads your email.
• The note. Every cold pitch gets a note. If you write again, you get a shorter one that counts your emails. One gift brings back every email from you that was set aside, within the hour unless the person you wrote to is taking a break, and after it your emails reach the person directly. A reply to the note gets no automatic answer. If you reply STOP, that mailbox sends you no more notes, and your later emails are set aside without one.
• The link. The note's one personal link, unique to your email, goes to Every.org; its other links go to givetoreach.com. The gift goes to GiveDirectly through Every.org, a US 501(c)(3) public charity, which sends you the receipt; no money reaches the person you wrote to or Give to Reach. Opening the link is not recorded. Giving is, and so is reaching the thank-you page afterwards.
• Why, and your rights. Where European data protection law applies, the basis is legitimate interest: the recipient's, in managing unsolicited mail, and ours, in running the service and publishing its results. The AI provider, Google and Cloudflare, which hosts the relay, are United States companies; section 4 says how those transfers are protected. Every.org, also in the United States, handles what you give it under its own policy. Write to us with the code from your link, or with your email address, to see what is held about you outside the recipient's mailbox, to correct it, to restrict its use, or to have it deleted. Deleting a gift's notice before the recipient's add-on collects it means the email it paid for stays set aside. You can also complain to Portugal's CNPD or to the data protection authority where you live or work.

Your right to object. You can object at any time to this use of your data. Write to us with your email address, and the relay deletes what it holds about that address and keeps nothing more about it from then on.

11. The waitlist

The form on the home page collects your email address, your LinkedIn profile, how much unsolicited email you get, why you want Give to Reach, and the language of the page you used. No name, no account, no payment details, no cookies, no analytics.

We use it to decide who gets a place and to tell you when one is ready, and for nothing else. It is stored on Cloudflare in Western Europe, and nowhere else, and is never sold or shared. A salted one-way hash of your IP address is kept apart from your entry for one day, only to limit repeat submissions, and Cloudflare's standard request logs (section 7) apply to the form too.

Your entry is deleted when you take a place, when you ask, or when the waitlist closes. Write to us to see it, correct it or remove it; removal is immediate and needs no reason. The basis is your consent, given by submitting the form, and you can withdraw it at any time.

12. Changes to this policy

If the way Give to Reach uses Google user data changes, this page changes first, and you are asked to agree before any data is used in the new way. The date at the top is the date of the current version.

13. Contact

Give to Reach, privacy@givetoreach.com.

Back to Give to Reach · Terms