Privacy Policy

This policy covers the chat.cx browser extension (“chat.cx”, “we”, “us”). The short version: chat.cx has no accounts, no analytics, and no server that stores your data. Everything you do in the extension stays in your browser, and the few network requests the extension makes on its own behalf are listed below in full.

1. What we do not collect

We do not collect, transmit, store, or sell:

• Your conversations with any chatbot, embedded or native.
• Your prompts, AI responses, files, screenshots, or page content.
• Your browsing history or the URLs you visit.
• Your API keys, passwords, cookies, or authentication tokens.
• Analytics, telemetry, usage statistics, or crash reports. The extension contains no analytics code of any kind.

There is no sign-up and no user account. We could not identify you if we wanted to. None of this varies by who you are: nothing is collected from anyone, minors included, and the extension is not directed at children.

2. Data stored locally in your browser

The extension keeps its state in your browser’s local extension storage. This includes:

• Your settings and preferences (theme, layout, which chatbots you pinned, keyboard shortcut behavior, and similar).
• Your chat tab list.
• Native chat conversations, including message history and any generated images, when you use the built-in chat with your own endpoints.
• API keys and endpoint URLs you enter for custom providers or web tools.
• Your license key and an anonymous, randomly generated install ID, if you purchase Pro.

This data never leaves your device except as described in sections 4 to 7. It is deliberately kept out of browser sync, so it is not uploaded to your Google or Mozilla account. Uninstalling the extension deletes all of it.

3. Embedded chatbot sites

When you open a chatbot such as ChatGPT, Claude, or Gemini inside the panel, you are using that provider’s real website in a frame, signed in with your own account. Your conversations happen directly between your browser and that provider, under that provider’s terms of service and privacy policy. chat.cx is not a proxy: your messages never pass through any server of ours.

To make these sites work inside a panel, the extension:

• Modifies certain response headers (frame-blocking headers) on embedded frames: the frames the extension creates, and the nested frames the supported chatbot sites embed inside themselves (artifact and preview panes), wherever those sites are open. This changes how your browser renders the site; it never applies to a normal top-level page, and it does not read or transmit page content.
• Copies that site’s own cookies into a partitioned copy inside your browser, so your existing login works inside the panel. This copying happens entirely on your device. Cookies are never sent to us or to anyone other than the site they belong to.
• Clears a site’s stuck service worker data for the handful of sites that need it, using the browser’s clearing API. This affects only data for that site inside your browser.

4. Page text and screenshot actions

The extension can insert the current page’s text or a screenshot of a page area into a chatbot, but only when you explicitly trigger that action (a button in the extension’s tab strip, or the right-click “Ask AI” menu). The captured content goes directly into the composer of the chatbot you chose, and nowhere else. Nothing is captured in the background, and nothing is retained by us.

5. Native chats and your own endpoints

The built-in native chat talks to OpenAI-compatible endpoints that you configure yourself (a provider’s API, a local model, or anything in between). Requests go directly from your browser to the endpoint you configured, authenticated with your key. We never see these requests, and your keys are stored only in local extension storage on your device.

6. Integrated web tools

Native chats can use optional web tools. Their network behavior:

• Web search (default, no key): your search query is sent to DuckDuckGo and the results are parsed locally in your browser. DuckDuckGo’s privacy policy applies to that request.
• Web fetch (default, no key): your browser fetches the requested URL directly, like opening it in a tab.
• Keyed providers (optional): if you configure Tavily, Brave, Firecrawl, or Jina, your queries or fetched URLs are sent to that provider with your own API key, under that provider’s privacy policy.
• Image generation (off by default): images are generated by an endpoint you configure, with your own key, and each request requires your confirmation.

Tool calls happen only when a model you are chatting with invokes a tool during your conversation, and each tool can be switched off in the settings.

7. The only requests made to us

The extension contacts us on its own for exactly one thing: license validation, and only if you purchase Pro.

• Activation: when you paste a license key, the key and an anonymous random install ID are sent to our license endpoint (a Cloudflare Worker), which checks the key with Creem, our payment provider. The install ID is a random UUID; it is not derived from your device or identity and is used only to count activations.
• Revalidation: about once a day, the extension re-checks that a stored key is still valid by sending the key and its activation ID to the same endpoint.

Everything else that reaches us is a page opening in a normal browser tab, exactly like clicking a link:

• Welcome and exit pages: installing the extension opens our welcome page (chat.cx/welcome). On Chrome, uninstalling it opens an exit page (chat.cx/uninstalled) where you can tell us what went wrong; that address includes the extension version you had and nothing else.
• Buy and policy links: the Buy button opens chat.cx/checkout, which redirects to our payment provider’s checkout, and the in-product privacy link opens chat.cx/privacy.

None of these page opens involve an account or any identifier. That is the complete list. Our license endpoint is stateless: it stores nothing and has no database, and if you never activate a key, no validation request is ever made.

8. Purchases

Payments are processed by Creem, our merchant of record. Creem collects the information needed to process your order (such as your email address and payment details) under its own privacy policy and sends you the license key by email. We do not receive or store your payment details. The extension itself never handles payment; checkout opens in a normal browser tab.

9. Browser permissions

What the extension requests and why:

• Access to websites (<all_urls>): required to strip frame-blocking headers for chatbot sites, to run the on-page launcher, and to let the web fetch tool retrieve pages you ask for.
• storage / unlimitedStorage: local storage for settings and native chat history.
• sidePanel: the side panel surface itself.
• activeTab / scripting: reading page text or capturing a screenshot when you explicitly ask for it.
• cookies: the local cookie copying described in section 3.
• browsingData: clearing stuck service workers for the few sites that need it (section 3).
• declarativeNetRequestWithHostAccess: the header modifications that make embedding possible.
• contextMenus: the right-click “Ask AI” menu.

None of these permissions are used to observe your browsing.

10. Data retention and deletion

We retain nothing, so there is nothing for us to delete. All extension data lives on your device: you can delete individual native chats in the UI, and uninstalling the extension removes everything. The same applies to privacy rights under laws such as the GDPR or CCPA: we hold no personal data to access, correct, or erase. The one exception is data connected to a purchase (your order and receipt), which is held by Creem; contact us or Creem and we will help.

11. Changes to this policy

If our data practices ever change (for example, if a future feature introduces any form of data collection), this policy will be updated first and the “Last updated” date revised. Material changes will be called out in the extension’s release notes.

12. Contact

Questions about privacy: anan@chat.cx