Privacy Policy

The short version

Browsy is a browser extension that connects your AI provider API key to your browser. When you use a Browsy feature, the text you've selected travels directly from your browser to your AI provider (Google Gemini or xAI Grok) over HTTPS. It does not pass through any server we operate. We don't receive it, store it, analyze it, or share it — because it was never sent to us.

Your API key is stored in chrome.storage.local on your device. It is never synced to any server, never transmitted to us, and never shared with any third party except the provider you're using to process your request.

We don't require an account. We don't collect personal information. We don't use analytics that identify you. We don't have a database of users.

---

What Browsy collects

Browsy collects nothing from you personally. To be precise:

• No email address. There is no account creation, no login, no "save your settings" flow.
• No usage data. We don't log which features you use, how often, or what text you process.
• No browsing history. The extension content script activates when you're in a text field; it does not report what sites you visit or what you read.
• No payment information. If you pay anything, you pay your AI provider directly. Browsy has no payment processor.

The Chrome Web Store provides aggregate, non-identifying statistics to all extension publishers (installs, uninstalls, active users at a count level). This tells us that N people have installed Browsy — not who they are, where they are, or what they do with it.

What your AI provider collects

When you use Browsy to process text, your selected text and a system prompt go to your AI provider. Browsy does not control what providers do with this data. Their privacy policies apply:

• Google's Privacy Policy (covers Gemini API)
• xAI's Privacy Policy (covers Grok API)

At time of writing, both providers allow you to opt out of having your API data used for model training. We recommend reviewing and configuring your provider privacy settings if this is important to you.

The relevant point: Browsy is not a data middleman. You have a direct relationship with your provider, and their privacy practices are the only ones that apply to your content.

Where your API key is stored

Your API key is stored in chrome.storage.local — the browser storage partition explicitly designed to remain on your device and not sync anywhere. This is distinct from chrome.storage.sync, which backs up to your Google account.

We enforce this choice in tests: automated CI checks assert that no key material ever touches sync storage. The key is read by the extension's background service worker exclusively when making API calls, and only to the provider you configured the key for.

No Browsy server ever receives or reads your API key. If you uninstall the extension, the key is removed with it.

Permissions the extension requests

Browsy requests the following permissions. Here's what each is for and what it explicitly cannot do:

storage

Required to save your API key and settings locally. Browsy uses chrome.storage.local only.

<all_urls> (host permission)

Browsy injects a content script into pages where you want to use it. Since "any page you visit" is the product's actual scope, we've used <all_urls> rather than a false-restrictive list. This permission allows the content script to activate in text fields on any site.

What this permission does not allow: silently reading page content you haven't selected, transmitting data to non-AI-provider destinations, or operating without your interaction. The content script is event-driven — it activates on text selection, not page load, and processes only the text you explicitly select.

https://generativelanguage.googleapis.com/*

Required to call the Gemini API when you've configured a Gemini key. Only requested if you add a Gemini key.

https://api.x.ai/*

Required to call the Grok API when you've configured a Grok key. Only requested if you add a Grok key.

Third-party services

Browsy uses no third-party analytics, no crash reporting services, no A/B testing platforms, and no CDN that could log your messages. The website at browsy.ai is statically hosted. The extension itself makes no calls to browsy.ai for any reason.

Data retention

Because we don't collect personal data, there is nothing to retain. Your API key and settings exist in your browser's local storage and nowhere else. If you clear your browser data or uninstall the extension, everything is gone — there is no cloud backup to restore from and no account to recover.

Children's privacy

Browsy does not knowingly collect information from anyone. We have no mechanism to identify users, let alone their ages. If you are the parent or guardian of a minor who has installed Browsy, there is no data collection we can help you remove — because there is no data.

Changes to this policy

If Browsy's architecture changes in a way that affects the privacy model — for instance, if we ever added optional account features or analytics — we would update this policy and make it prominent in the extension's changelog. We'd also consider whether such a change is consistent with the design principles that motivated building Browsy this way in the first place.

The current architecture — no servers, no accounts, no data collection — is a design choice, not a compliance checkbox. We intend to keep it that way.

Independent verification

You don't have to take our word for any of this. Browser DevTools let you observe the extension's behavior directly:

1. Open Chrome DevTools → Network tab
2. Use a Browsy feature (select text and run a rewrite)
3. Filter requests by domain — you'll see one request to generativelanguage.googleapis.com (Gemini) or api.x.ai (Grok), and nothing going to browsy.ai

You can also inspect the extension's installed files at chrome://extensions with Developer mode enabled. The manifest declares which domains the extension contacts, and the content script files are readable.

Contact

Questions about this policy can be sent to our support contact listed in the Chrome Web Store. There is no privacy-team email because there is no company with a privacy team — Browsy is a small product built by a small team.