Privacy policy
DRAFT FOR NAJM'S REVIEW, not legal advice. These pages are drafts and may change before launch.
On this page: What we track (short version) · Privacy policy · Every data point
What SparxSolver tracks: the plain-language version
DRAFT FOR NAJM'S REVIEW, not legal advice. Do not publish as-is. Written 31 Oct 2026 against branch
prepublish-fixes(backendssmw, extension 8.0.16 worktreesxp-prepublish-fixes).[PLACEHOLDER]= see ASSUMED_BUSINESS_FACTS.md.[LEGAL REVIEW]= a solicitor to check. This text is shown in the Extension at first run and in Options (shared/what-we-track.js), and on /privacy. Keep the three copies in sync.
You need to be 13 or older to use SparxSolver.
What we keep about you
- Your Google name, email and picture, so we know it's you.
- The questions you send and the answers, for 14 days, so we can fix mistakes and refund credits.
- Your credits and the devices you're signed in on.
Who else sees it
- Your question (not your name or email) goes to the AI company that works out the answer.
- Cloudflare runs our servers.
- We never sell your data and there are no adverts or trackers.
Extra checks are OFF
- We can switch on checks that stop people making lots of accounts for free credits. They are off right now. If we turn them on, this box will say so.
Your own key
- If you use your own Google Gemini key, your questions go straight to Google, not to us, and you must follow Google's rules, including their age rules.
You're in control
- Download your data or delete your account from your account page. Deleted means gone within 30 days.
SparxSolver: Privacy Policy (DRAFT FOR NAJM'S REVIEW, not legal advice)
DRAFT FOR NAJM'S REVIEW, not legal advice. Do not publish as-is. Updated 31 Oct 2026 for branch
prepublish-fixes(backendssmw, extensionsxp-prepublish-fixes). Every statement describes what that code does. The retention periods in section 9 now match the code (they replace the earlier flat "1 year" wording, which the code never did). The full per-field inventory is in DATA_INVENTORY.md.[PLACEHOLDER]= Najm to supply (see ASSUMED_BUSINESS_FACTS.md).[LEGAL REVIEW]= a solicitor to check.
Last updated: [PLACEHOLDER: effective date]
1. Who we are
SparxSolver (the SparxSolver Pro Chrome extension and the service at api.sparxsolver.com) is run by [PLACEHOLDER: legal name of operator] of [PLACEHOLDER: postal address]. We are the controller of your personal data under the UK GDPR and the Data Protection Act 2018.
- Contact for anything in this policy: [PLACEHOLDER: privacy email, e.g. [email protected] — suggestion only]
- ICO registration number: [PLACEHOLDER: ICO fee registration number, or confirm exemption]
If you are under 18: there is a short version for you in section 14. Please ask a parent or guardian to read this with you.
2. The short version
- You sign in with Google. We get your email, name and profile picture.
- When you ask a question, we send the question (and sometimes a picture of it) to an AI provider to get the answer, and we keep a log of it.
- You must be 13 or older to use SparxSolver.
- Abuse checks are switched off by default. Only if we switch them on do we collect extra technical details to stop people making lots of accounts for free credits: a scrambled code of your IP address and network, a scrambled code made from your browser's settings, and a few facts about your Extension install. While they are off, none of this is collected, and the server throws it away even if it is sent.
- We don't sell your data, we don't show adverts, and we don't use advertising or analytics trackers.
- We keep most data for a short, fixed time: questions and their pictures for 14 days, abuse-check details for 30 days (section 9). If you delete your account, everything linked to you is erased within 30 days.
- You can download your data and delete your account yourself from your account page (section 11).
3. What we collect, and why
3.1 Your account
| What | Where it comes from | Why |
|---|---|---|
| Google account ID, email address, name, profile picture | Google, when you sign in | To create and run your account and recognise you when you sign in |
| Whether your Google account belongs to a Google Workspace domain (for example, a school) | Google sign-in (the hd claim) | Abuse checks: a school or Workspace account lowers your risk score |
| Your email domain (the part after @) | Your email | Abuse checks (for example, disposable email services) |
| Role, status, sign-up date, last-seen date, per-account limits | Created by us | To run the Service |
| Access requests: your email, name, the reason you gave, IP address, any referral code | You, when you ask for access | To decide on access requests and prevent repeated requests |
| Invitations: the invited email and who invited them | An admin | To control who can join |
3.2 Sign-in, devices and security
| What | Why |
|---|---|
| Sign-in sessions: when they started, were last used and ended, your IP address and browser user agent (browser and operating-system version) | To keep you signed in, let you see and sign out your devices, and detect stolen sessions |
| Connected Extension installs: a random device ID created by the Extension, the Extension version, your platform (for example "Win32" or "MacIntel"), when it was first and last seen, and its last IP address | To manage connected devices and block outdated versions |
| A second random install ID from the Extension, stored only as a scrambled code (keyed hash), linked to the accounts that used it, with first and last seen dates | To notice when several accounts are used on one Extension install (shared devices are flagged for a person to look at, never blocked) |
| A security audit log of account and admin actions (for example sign-ins, suspensions, credit changes), with IP address and user agent | Security, investigating misuse, and handling appeals |
| Rate-limit counters | To apply per-minute and per-day limits |
3.3 Questions and answers
When you use SparxSolver credits (not your own Gemini key), the Extension sends us:
- the question text read from the Sparx page;
- details of the answer boxes (how many, what format, any multiple-choice options);
- sometimes pictures of the question, taken from the Sparx page (up to 3).
We send these to our AI provider (section 6) to get an answer. We log each request:
- the question (first 8,000 characters), the AI's raw output (first 8,000 characters) and the final answer (first 2,000 characters);
- the pictures;
- which AI model answered, token counts, estimated cost, timing and any errors;
- your IP address, country (worked out by Cloudflare from your IP), browser user agent, the page origin and the Extension version.
Why: to give you answers, charge and refund credits correctly, stop a retried request being charged twice, investigate wrong answers and complaints, control costs, and detect abuse.
Please note: pictures are taken from the question area of the Sparx page. If anything else personal is visible there, it may be included. [PLACEHOLDER/LEGAL REVIEW: confirm what the screenshot area can contain.]
Stored answers. If the shared answer store is switched on (it is currently off), we keep a copy of an answer (not who asked) for up to 6 hours so the same question can be answered without asking the AI again.
3.4 Credits, weekly credits and referrals
- A record of every credit change: starter credits, solves, refunds, weekly claims, referral bonuses, purchases and admin changes, with dates.
- Weekly claim history.
- Referrals: your referral code; who referred whom; the referred person's first name; when they qualified; the status of the referral; and admin notes.
- Credit holds: if a free credit is delayed or held by an abuse check, a record of it (type, amount, status, the risk band, dates, and who released or refused it).
- Purchases [NOT BUILT: no payment provider in the code yet]: what you bought, when and how much. Our payment provider handles your card details; we never receive your full card number.
Why: to run the credit system accurately and to deal with disputes.
3.5 Abuse checks ("risk score")
Off by default. To protect free credits, an admin can switch on a risk score that works out for each account, from low to very high. An admin can switch each rule on or off, and can exempt groups of users from rules. The score may use:
| What | Details |
|---|---|
| Browser fingerprint | When you sign in or sign up on our website (including through the Extension's connect page), your browser works out a code from settings that rarely change: screen size, colour depth and pixel ratio, time zone, languages, platform, number of processor cores, memory size, touch support and a small drawing test (canvas). Only a one-way hash of these settings leaves your browser, and we store only a further keyed hash of that. We can't turn it back into your settings. We use it only to notice many accounts being made on one browser. Only collected while abuse checks are switched on (they are off by default). While they are off, the sign-in page doesn't work it out at all, and the server ignores it if it is sent. |
| IP address and network | Only while abuse checks are on. At sign-up and sign-in: a keyed hash of your IP address and of its network range, plus your network operator number (ASN), the operator's name and your country, as provided by Cloudflare. We use these to spot many sign-ups from one place, and sign-ups through Tor, VPNs or data centres. |
| Extension signals | Sent by the Extension (version 8.0.8 and later) only when you are signed in to a SparxSolver account, on sign-in, token refresh and at most once a day: how many days since the Extension was installed; how many times it has been reinstalled; whether Chrome's synced storage answered; if Chrome sync is on, the previous install ID after a reinstall (so a reinstall can be linked to the old install); whether the browser reports it is being controlled by automation software; the install type (store, developer, side-loaded or managed); and whether it was installed from a store. We store these against the scrambled install code only. Only while abuse checks are on; nothing is read, stored or sent otherwise, and nothing is sent when you use your own Gemini key or are signed out. When checks are switched off, the Extension deletes the synced reinstall record. |
| ChromeOS | Whether you use a Chromebook (from the user agent). This reduces browser-match points, because school Chromebooks often look identical. |
| Activity patterns | Sign-up timing, how quickly the first question was asked, bursts of questions, running out of credits, use of referral codes, and links between accounts on the same install, browser or network. |
What the score can do. On its own, nothing that affects you. If an admin switches the matching option on, it can delay, hold or withhold free credits (see Terms §6). It never affects sign-in, purchased credits or credits an admin gave you, and it never suspends anyone. You are never shown your score; you see only the message "Some of your free credits are being checked automatically…". You can ask for a person to review it (section 11).
3.6 Security checks (Cloudflare Turnstile)
When you create an account or request access, and (if switched on) when you claim weekly credits or collect a referral bonus, we may ask your browser to pass a Cloudflare Turnstile check to show you are a person. Turnstile runs in your browser and is provided by Cloudflare. We send Cloudflare the check result and your IP address to verify it. See Cloudflare's privacy policy for what Turnstile collects.
3.7 Account sync (older Extension versions)
We no longer offer account sync and no longer collect this data: the sync and saved-key features were removed before publish. If an older Extension version ever stored allowed settings, your bookwork-code list, device names, local usage counts or an encrypted API key with your account, that data is included in your data export and erased when your account is deleted (within 30 days).
3.8 Contacting us
If you email us (for example, to appeal a suspension), we keep the email and our reply.
3.9 Age
SparxSolver is for people aged 13 and over. If you are under 13, please don't use it. If we learn that someone under 13 has an account, we will close it and delete their data as set out in section 9.
3.10 What we do NOT collect
- Your Google or Sparx password.
- Your Sparx login, Sparx account ID, or your Sparx marks or history. (The Extension reads the page you are on to find the question, but sends us only what is listed in 3.3.)
- Your browsing on other websites.
- Precise location (only a country from your IP address).
- Advertising IDs. We use no advertising or analytics services.
4. What stays on your device
The Extension stores some things only in your browser (Chrome extension storage) and never sends them to us: your settings, your bookwork codes, your own Gemini API key, the list of Gemini models your key can use (cached for 24 hours, labelled with a scrambled code of the key, never the key itself), your sign-in tokens (sent only to us, to sign in), and local usage counts. Only while abuse checks are on, the Extension also keeps its install date and, if Chrome sync is on, a small record ({ install ID, date, reinstall count }) in Chrome's synced storage so a reinstall can be recognised. The "Remove key" button deletes your key and the cached model list. You can remove all of it by uninstalling the Extension (and clearing Chrome sync data for it).
If you use your own Gemini key (off by default; you confirm once that "You're using your own API key; you must follow that provider's terms (including any age requirements)."), your questions and pictures go directly from your browser to Google, not to us. The Extension also asks Google which models your key can use. Google's terms and privacy policy apply to that, and you are solely responsible for following them.
5. Our lawful bases
[LEGAL REVIEW: confirm each basis, and complete a Legitimate Interests Assessment for every "legitimate interests" row.]
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Creating and running your account; answering questions; credits, weekly credits, referrals; purchases | Contract — to provide the Service you asked for. [LEGAL REVIEW: where the user is a child, consider legitimate interests instead.] |
| Security, sign-in sessions, audit log, rate limits | Legitimate interests — keeping the Service and accounts secure |
| Abuse checks, browser fingerprint, extension signals, IP/network checks, Turnstile | Legitimate interests — preventing fraud and abuse of free credits, which keeps the Service affordable |
| Request logs, cost tracking, fixing errors | Legitimate interests — running and improving the Service |
| Keeping payment records | Legal obligation — tax and accounting rules |
| Responding to rights requests and legal claims | Legal obligation / legitimate interests |
We don't knowingly collect special category data (such as health or religion). Please don't include it in questions.
Where we rely on legitimate interests, we have weighed our interests against yours, taking extra care because many of our users are children. You can object (section 11).
Storage on your device. The browser fingerprint reads information from your device, and the Extension stores data on it. We do this because it is strictly necessary to provide a secure service you asked for, and to prevent fraud. [LEGAL REVIEW: PECR regulation 6 and the Data (Use and Access) Act 2025 exemptions for security and fraud prevention.]
6. Who we share data with
We don't sell your data. We share it only with these service providers, who act on our instructions (processors), and only as needed:
| Provider | What they do | Data | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosts the website and Service (Cloudflare Pages and Workers), stores our database (D1) and files (KV), provides network information (country and network), and runs Turnstile | Everything the Service stores | Global network; [PLACEHOLDER: D1 database location] |
| ZeroGPU (api.zerogpu.ai) | Runs the AI models that answer questions | Question text, answer-box details, question pictures, and instructions. Not your name, email or IP address | [PLACEHOLDER: ZeroGPU's location and the companies whose models it runs] |
| [PLACEHOLDER: payment provider] [NOT BUILT] | Takes payments | Payment details, email, amount | [PLACEHOLDER] |
Google provides sign-in. Google is not our processor for this: it is an independent controller of your Google account, and Google's privacy policy applies. If you use your own Gemini key, you deal with Google directly.
We may also share data:
- if the law requires it, or to protect someone's safety;
- with professional advisers (such as lawyers), under confidentiality;
- with whoever takes over SparxSolver, if it is sold or transferred. We will tell you first.
Within SparxSolver: administrators can see account records, request logs (including question pictures), credit records, referral records and abuse-check details, in order to run the Service. Other users see only the referral details in Terms §5.4.
7. International transfers
Our providers may process data outside the UK, including in the United States. Where they do, we rely on [PLACEHOLDER/LEGAL REVIEW: for each provider, the UK adequacy regulations / UK–US Data Bridge certification, or the ICO International Data Transfer Agreement or Addendum to the EU SCCs in its data processing terms]. Contact us for a copy of the safeguards.
8. Automated decisions
The risk score is worked out automatically. It can affect when, or whether, you get free credits. It does not affect your access, purchased credits or admin-granted credits, and it never suspends anyone. We don't think this has a legal or similarly significant effect on you, but you can still ask for a person to review any hold, give your point of view, and challenge it (section 11). [LEGAL REVIEW: UK GDPR Article 22, especially for children.]
9. How long we keep data
These periods are what the code does (scheduled clean-up runs every few minutes from our Cloudflare cron worker).
| Data | Kept for |
|---|---|
| Request logs (questions, answers, IP address, country, user agent) | 14 days from the request |
| Question pictures | 14 days (they expire automatically) |
| Stored retry results (so a retry isn't charged twice) | 7 days after the request finished |
| Old sign-in tokens (used, revoked or expired) | 30 days |
| Abuse-check details while checks are on: browser-fingerprint links, sign-up network details, extension signals, reinstall links | 30 days from when last seen |
| Abuse-check IP/network codes and install links | While your account exists (removed when your account is erased) [LEGAL REVIEW: consider 30 days] |
| Risk score history | 1 year |
| Resolved admin alerts | 90 days |
| Refused access requests | 30 days after the decision |
| Approved or pending access requests, invitations | While relevant to your account |
| Your account, sessions, devices, credits, referrals, synced settings and bookwork codes | While your account exists |
| After you delete your account | Signed out at once; everything above is erased within 30 days. We keep only the security audit log and the credit ledger, which can't be edited (that is what makes them tamper-proof). Your email is hidden (shown as a scrambled code) everywhere the audit log is viewed or exported, and the ledger is linked only to a scrambled account number. The original audit entries stay in the locked log; only the operator can reach it. |
| Security audit log (with IP address and user agent) | Kept, because it is tamper-evident. [LEGAL REVIEW: Najm to set a period; see COMPLIANCE_NOTES §5] |
| Key-vault audit records (older Extension versions) | 1 year |
| Payment records [NOT BUILT] | 6 years, because tax law requires it. [LEGAL REVIEW] |
| Stored answers (not linked to you; currently off) | Up to 6 hours |
Backups. Deleted data can remain in our hosting provider's recovery history and in our backups for up to [PLACEHOLDER: backup period, e.g. 30 days] more before it is gone for good.
When we need it longer. If data is needed for a legal claim, a complaint or an investigation of serious misuse, we may keep that specific data until the matter is closed.
10. How we protect your data
- All connections use HTTPS.
- Where we can, we store keyed hashes instead of raw values: for the browser fingerprint, the Extension install ID, and the IP addresses used by the abuse checks. The keys are kept secret.
- Sign-in tokens are stored only as hashes. Saved API keys are encrypted.
- The admin area requires a Google sign-in or security key, and an allow-list.
- The audit log is tamper-evident (hash-chained).
No system is perfectly secure. If a breach is likely to put you at high risk, we will tell you without undue delay.
11. Your rights
Under UK data protection law you can ask us to:
- give you a copy of your data (access);
- correct it;
- delete it;
- restrict how we use it;
- give it to you in a portable format;
- stop using it where we rely on legitimate interests (object), including for the abuse checks;
- have a person review an automated decision about your free credits.
Do it yourself: on your account page you can download a copy of your data (a JSON file) and delete your account. Both ask you to sign in again first, to make sure it's you. Deleting signs you out everywhere and your data is erased within 30 days. You can't undo it, and starter credits are not given again to the same Google account. If we remove an account for breaking our rules, we also keep a scrambled code (keyed hash) of the Google account id so the same Google account can't simply sign up again; we keep it until we decide to let that account back in.
For anything else, email [PLACEHOLDER: privacy email]. We may need to check it's you, for example by asking you to email from your sign-in address. We'll reply within one month (sometimes longer for complex requests, and we'll tell you). There's normally no charge.
A parent or guardian can make a request for a child who is too young to understand their rights.
Some limits. If you object to the abuse checks, we may still keep the minimum needed to stop repeated abuse of free credits; and if you ask us to delete your account, we may keep records we must keep by law (such as payment records).
Complaints. If you're unhappy, please tell us first. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113.
12. Cookies and similar technology
We use no advertising or analytics cookies. We use:
| Name / item | What it's for | How long |
|---|---|---|
__Host-sx_web cookie (sparxsolver.com) or sx_web cookie (api.sparxsolver.com) | Keeps you signed in to your account page on that site only (secure, HttpOnly, never shared between the two) | Up to 30 days, renewed when you use it |
sx_admin cookie | Admin sign-in only | 8 hours |
| Cloudflare Turnstile | Security check (may set its own data while the check runs) | See Cloudflare's policy |
| Browser fingerprint (computed, not stored in your browser) | Abuse checks (section 3.5) | Nothing stored on your device |
Extension storage (chrome.storage.local, chrome.storage.sync, session storage on Sparx pages) | Settings, sign-in, bookwork codes, install date, reinstall link | Until you uninstall or clear it |
These are all strictly necessary for the Service or for security, so we don't ask for consent. [LEGAL REVIEW]
13. Children
SparxSolver is likely to be used by school pupils. We:
- collect only what we need to run the Service and stop abuse;
- don't use data for advertising, and don't sell it;
- don't show your score, and don't profile you for anything except stopping abuse of free credits;
- never share your email or surname with other users.
[LEGAL REVIEW: Age Appropriate Design Code; see COMPLIANCE_NOTES §1.]
14. The short version for young people
- We use your Google account to know who you are.
- You need to be 13 or older.
- When you ask a question, a computer program (AI) works out the answer. We keep a copy of your question for 14 days.
- Our extra checks against people cheating the free-credits system are off unless we turn them on. If they are on, we check things like which computer and internet connection you use, stored as secret codes, not the real details.
- If our checks think something's wrong, some free credits might take a bit longer to arrive. You'll see a message. You can ask us to check it.
- You can download what we know about you, or delete your account, from your account page. Ask a grown-up if you need help.
15. Changes to this policy
We'll update this policy when what we do changes, and show the new date at the top. If the change is significant, we'll tell you in the Extension, on your account page or by email before it takes effect.
16. Contact
[PLACEHOLDER: privacy email] · [PLACEHOLDER: postal address]
SparxSolver: data inventory (every data point)
DRAFT FOR NAJM'S REVIEW, not legal advice. Do not publish as-is. Written 31 Oct 2026 against branch
prepublish-fixes(backendssmw, extension 8.0.16 worktreesxp-prepublish-fixes).[PLACEHOLDER]= see ASSUMED_BUSINESS_FACTS.md.[LEGAL REVIEW]= a solicitor to check.
Key: Mode = when it is collected. Always = needed to run the service. Risk on = only while the admin risk score is switched on (off by default; the server drops these even if sent while off). Own key = only in own-key mode (off by default). Sharing: Cloudflare hosts and stores everything server-side (processor). ZeroGPU receives only the question payload. Google is an independent controller for sign-in and for own-key requests. Lawful bases (UK GDPR Art. 6): C = contract, LI = legitimate interests, LO = legal obligation. [LEGAL REVIEW: every LI row needs a Legitimate Interests Assessment; the DPIA covers the risk-on rows.]
A. Account and access
| Data point | Purpose | Basis | Retention | Shared with | When collected | Mode |
|---|---|---|---|---|---|---|
Google account id (sub) | Identify the account; stop starter-credit reuse | C | While the account exists; erased ≤30 days after deletion | Cloudflare; Google (source) | Every Google sign-in | Always |
Admin-removal block (keyed hash of the Google sub only; no email or name) | Stop an account an admin removed for abuse from coming back through open sign-up | LI | Until an admin restores the account or sends a new invite (then marked lifted) | Cloudflare | Admin deletes an account (unless the admin opts out) | Always |
| Email, name, profile picture | Account, support, admin review | C | As above | Cloudflare; Google (source) | Sign-in | Always |
Workspace domain flag (hd) | Lowers the risk score for school accounts | LI | As above | Cloudflare | Sign-in | Always (used only when risk on) |
| Role, status, limits, created / last-seen dates | Run the service | C | As above | Cloudflare | Server-generated | Always |
| Access request: email, name, reason, IP, Google sub, referral code | Manual approval (kept by decision) | LI | Refused: 30 days after decision. Approved/pending: while relevant | Cloudflare | Request form | Always |
| Invitations (email, inviter) | Control who can join | LI | While relevant | Cloudflare | Admin action | Always |
| Turnstile token / result + IP | Bot check at sign-up and access request | LI | Not stored (verified and discarded) | Cloudflare (Turnstile) | Sign-up, access request, optionally claims | Always (where enabled) |
B. Sign-in, devices, security
| Data point | Purpose | Basis | Retention | Shared with | When collected | Mode |
|---|---|---|---|---|---|---|
| Session: refresh-token hash, IP, user agent, dates | Keep you signed in; device list | C / LI | Session rows while account exists; old tokens 30 days | Cloudflare | Sign-in, refresh | Always |
Client: random inst_… id, version, platform, last IP | Tell devices apart; revoke one; min-version | C / LI | While account exists | Cloudflare | Extension connect | Always |
| Audit log (actor email, action, target email, IP, UA) | Security, accountability, appeals | LI | Kept (tamper-evident, append-only: stored rows cannot be edited). After deletion the email is masked with a keyed hash wherever the log is shown or exported (admin views, CSV, data exports); the stored row is unchanged | Cloudflare | Security/admin events | Always |
| Rate-limit and auth-throttle counters (keyed by user / IP) | Abuse prevention | LI | Minutes to a day (expire) | Cloudflare | Each request | Always |
sx_web (api.*) / __Host-sx_web (root site) / sx_admin cookies | Web sign-in | C | 30 days / 8 hours | — | Web sign-in | Always |
C. Questions and credits
| Data point | Purpose | Basis | Retention | Shared with | When collected | Mode |
|---|---|---|---|---|---|---|
| Question text, answer-box details | Produce the answer | C | 14 days (request log) | Cloudflare; ZeroGPU | Each solve with credits | Always (credit mode) |
| Question pictures (≤3) | Produce the answer | C | 14 days (KV TTL) | Cloudflare; ZeroGPU | Screenshot solves | Always (credit mode) |
| Request log: model, tokens, cost, latency, status, IP, country, UA, origin, version | Billing, refunds, debugging, abuse | LI | 14 days | Cloudflare | Each solve | Always |
Retry record (solve_requests) | Never charge a retry twice | C | 7 days after finishing | Cloudflare | Each solve | Always |
| Credits, ledger entries, weekly claims, holds | The credit system | C | While account exists; ledger kept (pseudonymous) after deletion | Cloudflare | Credit changes | Always |
| Referral code, referrer/referee link, referee first name | Referral bonus | C | While account exists | Cloudflare | Referral sign-up | Always |
Legacy synced settings, bookwork codes, device names, local usage counts, encrypted saved key (old /account/sync, KV) | None now: the routes were removed before publish; nothing new is collected | C | Existing data only: in the export; erased ≤30 days after deletion | Cloudflare | Never (removed) | — |
D. Abuse checks (OFF by default)
| Data point | Purpose | Basis | Retention | Shared with | When collected | Mode |
|---|---|---|---|---|---|---|
| Browser fingerprint (hash of screen, time zone, languages, cores, memory, touch, canvas), stored as a keyed HMAC | Spot many accounts on one browser | LI | 30 days from last seen | Cloudflare | Website sign-in / connect | Risk on |
Extension install id (ssp_…), stored as HMAC, linked to accounts | Spot shared installs | LI | While account exists; erased with it | Cloudflare | Token, refresh, /me | Risk on |
| Extension signals: install age, previous install id, reinstall count, sync answered, webdriver, install type, store install, ChromeOS | Spot scripted / farmed installs | LI | 30 days from last seen | Cloudflare | ≤1×/24 h on token / refresh / /me | Risk on |
| Sign-up snapshot: IP & network HMAC, email domain, ASN, operator name, country | Spot sign-up bursts, VPN / data centre | LI | 30 days | Cloudflare | Sign-up | Risk on |
| IP / network HMAC per user | Link accounts on one network | LI | While account exists; erased with it | Cloudflare | Sign-up, sign-in | Risk on |
| Risk score, reasons, admin review | Gate free credits only | LI | Score while account exists; history 1 year | Cloudflare | Scoring | Risk on |
E. Stays on the device (never sent to us)
| Data point | Purpose | Retention | Mode |
|---|---|---|---|
| Settings, bookwork codes, sign-in tokens | Run the Extension | Until uninstalled / cleared | Always |
| Own Gemini API key (encrypted secret store) | Own-key mode; sent only to Google | Until "Remove key" or uninstall | Own key |
Own-key acknowledgement {at, v} | Record the one-time confirmation | Until uninstall | Own key |
| Gemini model list cache (keyed by a SHA-256 of the key, never the key) | Pick a working model | 24 hours; deleted by "Remove key" | Own key |
Install date, sync reinstall shadow (sspShadow) | Abuse checks | Deleted when checks are turned off | Risk on |
F. Sent to Google in own-key mode (not to us)
Question text and pictures go to generativelanguage.googleapis.com with the user's key; the Extension also calls Google's models list. Google is the controller for that processing. The user is solely responsible for Google's terms.