PhishTriage's privacy policy is published at https://phishtriage.com/privacy
and is the single canonical version for all builds.

In summary: nothing is read until you click Analyze. On Gmail and Outlook Web
the extension reads the open message; on any other page it reads that page's
title, full URL, visible text and links, and sends them to
api.phishtriage.com for a verdict. Optional threat monitoring and optional
file protection are off until you turn them on, and each asks for its own
permission at that point. File protection also uses
filescan.phishtriage.com. No sign-up and no email address are required.
The full policy at the URL above states retention, deletion routes and
third-party processors in detail.