Answers from the text
you choose.

Short version

• We never see the pages you visit or your browsing history.
• We only receive text you explicitly highlight and submit.
• Highlighted text is sent to our backend over HTTPS, then forwarded to OpenAI to generate the answer.
• We do not store submitted text or the AI response in our database.
• If you create an account, we store your email, a bcrypt hash of your password, and usage records needed for quota enforcement.
• You can delete your account from the extension popup at any time.

What we collect

When you use the extension anonymously

• Selected text. Sent to our backend over HTTPS, then forwarded to OpenAI. Neither the request body nor the response is written to our database.
• Anonymous device identifier. A random UUID generated once per install and stored in chrome.storage.local to help enforce the free-query limit.
• Your IP address. Combined with the device identifier into a one-way daily hash used as a quota key. We do not store the raw IP address.
• Per-day query count. Stored against the quota key and deleted after seven days.

When you create an account

• Email address. Used to identify your account.
• Password hash. A bcrypt hash of your password. We do not store plaintext passwords.
• Per-day account query count. Used to enforce Free and Pro quotas, resetting at midnight in the America/New_York time zone.
• Stripe customer ID, subscription ID, and status. Stored only if you upgrade to Pro so we can verify plan status.

What we do not collect

• The URLs of pages you visit.
• Your browsing history.
• The contents of pages you do not explicitly highlight and submit.
• Analytics beyond per-day usage counts.
• Tracking pixels, third-party cookies, or fingerprints.

Where your data goes

• Our backend. A self-hosted service operated by us receives queries and stores account data.
• OpenAI. Selected text is forwarded to OpenAI's API to generate the answer. OpenAI's handling is governed by its own policies.
• Stripe. Handles payment processing if you subscribe to Pro. Card details never touch our backend.
• Cloudflare. Acts as a CDN and proxy in front of our backend and may log request metadata for DDoS protection.

We do not sell, rent, or otherwise share your data with anyone else.

Your rights

• Access. Email us and we will tell you what we have about you.
• Deletion. Use "Delete account" in the extension popup to remove your local account and usage data. If billing exists, we also attempt to cancel the Stripe subscription and remove the Stripe customer from our side. Stripe keeps its own payment records under its retention policy.
• Correction. Email us to update your email address.
• Opt-out of analytics. We do not run analytics beyond quota tracking.

Security

• All traffic is HTTPS-only with HSTS enforced.
• The OpenAI API key lives only on our server.
• Passwords are bcrypt-hashed at cost 10.
• The backend runs as an unprivileged user in a hardened systemd unit.
• The database file is permissioned for the service user only.
• Database backups are encrypted at rest on the VPS.
• The anonymous quota hash rotates daily so requests cannot be correlated across days.

Children

Context is not directed at children under 13 and we do not knowingly collect data from anyone under 13. If you believe we have, email us and we will delete it.

Changes

If we make material changes to this policy, we will update the date at the top of this page and, for account holders, email notice before those changes take effect.