To work properly, your FlowCrypt browser extension needs to connect to your email provider (Gmail or Outlook). This allows you to encrypt and decrypt messages when you choose to.
The plugin will receive so called API Tokens. These tokens, and all related privileges (to send and read messages) will strictly stay within your own browser, stored locally in your computer for maximum security.
By design, the tokens cannot and will never be exposed to FlowCrypt servers or its developers.
The code running FlowCrypt is open-source and anyone can verify the underlying security. Visit FlowCrypt Sources Repository to learn more or inspect the code. Alternatively, please ask me directly at human@flowcrypt.com