Privacy Policy

1. Data Collection

The Extension does not collect, track, or sell personal data.

The Extension only processes data explicitly provided by the user, such as:

• Text selected by the user on a webpage
• On pages where the user has turned on Spotlight: the headlines and short snippets of the feed items on that page, so the AI provider the user chose can mark which ones match the user’s Interests. Spotlight only runs on sites the user switched it on for, and the user can switch it off per site at any time
• For Hidden Regions: a CSS selector describing the page region the user chose to hide, a structural fingerprint of it, and up to 60 characters of its visible text as a label — never the region’s content, and nothing is sent anywhere
• Images, files, or screenshots the user chooses to attach to a request
• User configuration and preferences (e.g. selected AI provider, models, skills, UI settings)
• API keys the user enters, or — for OpenRouter — the API key OpenRouter issues to the user when they choose to sign in (see section 4)

2. Data Usage

Selected text is used solely to enable AI interactions requested by the user. No data is processed without a direct user action: Spotlight classifies feed items only on sites where the user turned it on, and Hidden Regions are created only when the user picks a region.

3. Data Storage

User settings, preferences, and API keys are stored using Chrome’s storage APIs. Provider settings (including API keys) use Chrome’s sync storage, which Chrome may synchronize between the user’s own signed-in Chrome profiles; Spotlight Interests and per-site settings and Hidden Region selectors also use sync storage; other data (skills, the Spotlight verdict cache, the cached model catalog) stays on the device. We never receive any of it. All data remains under the user’s control unless the user explicitly sends content to a third-party AI service.

4. Third-Party Services

The Extension allows users to interact with third-party AI providers using the user’s own account or API key. The Extension operates no server of its own: requests go directly from the user’s browser to the provider the user selected.

• OpenRouter (openrouter.ai): the user can sign in to OpenRouter from the Extension’s settings. This uses OpenRouter’s standard OAuth 2.0 (PKCE) flow; the Extension receives only the API key OpenRouter creates for the user and stores it like a manually entered key. When OpenRouter is the selected provider, the text the user selects, any attachments, and the user’s messages are sent to OpenRouter to be routed to the AI model the user chose, together with an application identifier (the Extension’s name and store listing URL) so that usage is attributed to AI Bridge in the user’s OpenRouter account. Billing, credits, and key revocation are managed by the user on openrouter.ai. OpenRouter’s handling of this data is governed by OpenRouter’s privacy policy.
• OpenAI, Google Gemini, Anthropic Claude: used with an API key the user enters; requests go directly to that provider under its own privacy policy.
• models.dev: the Extension periodically downloads a public, read-only list of available AI models from models.dev to keep its model picker current. No user data is sent in this request.

Any data sent to these services is subject to the respective provider’s privacy policy. We do not receive, store, or log this data.

5. Permissions

The Extension requests the following permissions:

• Storage: to save user preferences, skills, API keys, Spotlight Interests and per-site settings, Hidden Region selectors, and the cached model catalog
• Host permissions (all websites): to detect user-selected text, display the AI toolbox on any page, dim or hide feed items for Spotlight and apply Hidden Regions on sites the user configured, and capture a screenshot when the user asks for one
• Tabs: to know which tab is active so selected content can be relayed between the page, the side panel, and the background service, and cleared when the user switches tabs
• Side panel: to show the chat panel in the browser’s side panel
• Alarms: to refresh the model catalog from models.dev once a day
• Identity: used solely for the OpenRouter sign-in flow (identity.launchWebAuthFlow); the Extension does not read the user’s Google or Chrome identity, email, or profile

These permissions are used strictly to provide core functionality.

6. Data Sharing

The Extension does not share user data with the extension developer or any third party other than the AI provider the user has selected and explicitly sends content to (see section 4). User data is never sold.

7. Security

We follow best practices to ensure that user data is handled securely and only within the scope of the Extension’s functionality.

8. Changes to This Policy

This Privacy Policy may be updated from time to time. Any changes will be reflected on this page.

9. Contact

If you have any questions about this Privacy Policy, please contact us at:
hoangleanhtu@gmail.com