Privacy Policy

1. What We Collect

Data Collected Automatically

When you install and use the extension, the following data is collected automatically:

• Email address — collected via Google Sign-In when you authenticate
• Persistent device ID — a UUID generated and stored in chrome.storage.local. This ID persists across browser sessions and reinstalls. It is sent to our server for session management and authentication recovery.
• Device fingerprint — a randomly generated unique identifier (UUID) stored in Firestore alongside your userId, createdAt timestamp, lastSeen timestamp, and userAgent. Used for device verification and abuse prevention.
• IP address — logged in Firestore as part of your session record
• User agent — your browser identifier, logged in Firestore session records
• Session activity — a heartbeat is sent approximately every 30 seconds while the extension is active, tracking total usage time, heartbeat count, and last activity timestamp (no page content, URLs, or browsing data is included in this heartbeat)
• Subscription status — your plan type and status, stored in Firebase and managed via Stripe

Data Collected on User Action

The following data is only collected when you take a specific action:

• Page content — when you ask a question, the content of the current page is sent directly from your browser to your chosen AI provider using your own API key. The AI reads the page content to understand what you are viewing. No URL is transmitted. Our server never receives this data.
• AI questions — your questions are sent directly from the extension to your chosen AI provider using your own API key. Our server never receives this data.
• Text-to-speech content — when you use the TTS feature, text is sent directly from the extension to your chosen TTS provider (ElevenLabs or Google Cloud Text-to-Speech) using your own API key. Our server never receives this data.
• Research queries — when you use research tools (Semantic Scholar, ArXiv, PatentsView, Google Patents, OpenFDA, spam checker), your search queries are routed through our server as a stateless proxy. No query content is stored.
• Web search queries — when you use web search (Brave, Perplexity, Serper, or Exa), queries are sent directly from your browser to the search provider using your own API key.
• Feedback — when you use the feedback feature, we collect your rating, message, name (optional), email, the page URL, extension version, user agent, subscription status, newsletter opt-in preference, and prompt guide opt-in preference. Feedback is stored in Firestore.

2. How We Use Your Data

3. Third-Party Services

We rely on the following third-party services to operate Web Tutorial AI. Each service receives only the data necessary for its function.

4. Data Storage & Retention

Stored in Firestore (server-side)

• Session records — device ID, device fingerprint, IP address, user agent, usage time, heartbeat data. Auto-deleted after 7 days.
• Daily usage data — aggregated per-user daily usage metrics. Auto-deleted after 60 days.
• Subscription data — plan type, status, Stripe customer ID. Retained until subscription ends and account is deleted.
• Feedback — rating, message, email, page URL, extension version, user agent, subscription status. Retained indefinitely until addressed or you request deletion.
• Authentication data — email address, Firebase user ID. Retained until you delete your account.
• Device fingerprints — fingerprint hash, userId, createdAt, lastSeen, userAgent. Retained until you delete your account.

Stored locally (your browser only)

• Device ID — a persistent UUID in chrome.storage.local. Remains until you clear extension data or uninstall.
• API keys — your Gemini, OpenRouter, Anthropic, Brave Search, Perplexity, Serper, Exa, ElevenLabs, Google Cloud TTS, and Apify API keys are stored in chrome.storage.local or chrome.storage.sync. They are never sent to our server.
• Chat history — your complete conversation history with the AI is stored locally and never leaves your browser.
• AI responses — all AI-generated responses are stored locally only.
• User preferences — theme, TTS voice settings, max tokens, active role, and other settings are stored locally.
• Authentication tokens — JWT tokens cached in chrome.storage.session for authenticating API requests to our server (session management, rate limiting, and premium verification).

Never received by our servers

• Page content — sent directly from the extension to your chosen AI provider; our server never receives it
• AI questions and responses — sent directly from the extension to your chosen AI provider; our server never receives them
• API keys — stored locally and sent only to the respective third-party services directly from the extension

Account Deletion

When you delete your account, all associated data in Firestore (session records, subscription data, feedback, device fingerprints) is deleted within 30 days. Stripe retains payment records according to their own retention policy. Local data can be cleared by removing the extension.

5. Data Sharing

Your data is shared only with the service providers listed in Section 3, and only to the extent necessary for the service to function. Specifically:

Infrastructure

• Firebase receives authentication, session, and device fingerprint data
• Stripe receives payment and billing data

Direct from Browser (your API key)

• Google Gemini receives page content and questions directly from the extension
• OpenRouter / Anthropic Claude receives page content and questions directly from the extension
• Brave Search, Perplexity, Serper, Exa receive search queries directly from the extension
• ElevenLabs, Google Cloud TTS receive text directly from the extension when you use TTS
• Chrome Built-in TTS processes text-to-speech entirely on your device — no data is sent externally

Server-Routed Proxy (stateless pass-through)

• Semantic Scholar, ArXiv receive academic search queries via our server proxy
• PatentsView (USPTO), Apify (Google Patents) receive patent/trademark search queries via our server proxy
• OpenFDA receives FDA data queries via our server proxy
• Postmark SpamAssassin receives email content for spam analysis via our server proxy
• MCP Documentation Servers (AWS, Microsoft, Cloudflare, Google, FDA) receive documentation search queries via our server proxy

We do not use advertising networks, data brokers, or marketing partners.

Legal Requirements

We may disclose information if required by law (e.g., court orders, subpoenas) or to protect the safety of our users or the public.

6. Your Rights

You have the following rights regarding your data:

• Access — You can request a copy of the data we hold about you.
• Deletion — You can request that we delete your account and all associated data.
• Correction — You can update your email address through Google Sign-In.
• Opt out of feedback — Feedback is voluntary. Simply don't use the feedback feature if you prefer not to share that data.
• Clear local data — You can clear your device ID and local data at any time by removing or resetting the extension.

7. Children's Privacy

Web Tutorial AI is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. Google Sign-In requires users to meet Google's minimum age requirements.

If we learn that we have collected personal information from a child under 13, we will promptly delete that information. If you believe a child under 13 has provided us with personal data, please contact us at privacy@webtutorial.ai.

8. Chrome Extension Permissions

The Web Tutorial AI extension requests the following browser permissions. Each permission follows the Principle of Least Privilege — we request only what is strictly necessary for the extension to function.

• <all_urls> (Content Scripts) — Essential for injecting the chat overlay and extracting text from the page you are viewing. Text extraction is triggered only when you submit a chat prompt. The extension does not passively scan, monitor, or record your browsing activity. Extracted content is cached locally for up to 5 minutes to avoid redundant processing.
• scripting — Used to dynamically load the content extractor and user interface onto the webpage.
• storage — Used to securely save your API keys (encrypted with AES-GCM), local chat history, authentication tokens, and personal preferences on your device.
• tabs — Used to communicate between the background logic and the chat overlay, and to manage tab lifecycle for cache cleanup.
• tts — Enables the browser's native Text-to-Speech engine to read AI responses aloud upon your request.
• downloads — Used exclusively to allow you to export and save your local chat history as a text file.
• Host Permissions — The extension connects to authorized services from your browser:
  • AI providers: Google Gemini API, OpenRouter, Anthropic
  • Search providers: Brave Search, Perplexity, Serper.dev, Exa.ai
  • TTS providers: ElevenLabs, Google Cloud Text-to-Speech
  • Our server & Firebase: Session management, authentication, server-routed research APIs

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do:

• The updated policy will be posted on this page with a new "Last updated" date.
• For material changes that expand data collection, we will notify users through the extension or by email.
• Continued use of the extension after changes constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights: