In the absence of a written policy, we'll "treat users right" which roughly means we'll "treat users how we ourselves would want to be treated".
That's not particularly computable, so: the bodies of user's emails never leave the browser. We find email addresses in the browser, and send those back to our server to lookup. The emails themselves never touch our server.
That said, nifty idea. I'd like to see more website extensions like this, if there was a better security model.
Our users' trust is absolutely crucial to what we're doing, so you can expect detailed information on exactly what we do with your private data; and we may also make some things opt-in/opt-out. We have no intention of hiding anything.
You are already using GMail. How bad could it be?