This is why we have a big warning when you install a Raplet — you are trusting the authors of the Raplet to treat your email addresses with respect. This is why we only list Raplets in the gallery from authors we know and trust.

A hash would work for many use cases, but wouldn't work for adding a contact to a CRM/Helpdesk/etc.

Access to the plaintext email addresses could be a permission that Raplets ask for, but this may be unnecessary complication.