1. Introduction

This Privacy Policy explains how Spark AI — Web Copilot & Summarizer (referred to as "Spark AI", "the Extension", "we", "our", or "us") collects, uses, stores, shares, and protects your personal and non-personal data. We are committed to transparency and user privacy. By installing and using Spark AI, you agree to the practices described in this policy.

2. Data We Collect

Below is a comprehensive overview of all data types the Extension collects and processes:

2.1. Authentication Data (Optional — only when you sign in)

When you choose to sign in with Google, we collect the following via Google OAuth 2.0:

• Google Account email address
• Display name (from your Google profile)
• Profile photo URL (from your Google profile)
• Unique user identifier (generated by our authentication provider, Supabase)

We request the OAuth scopes openid, profile, and email. We do not request access to your Google Drive, Gmail, Contacts, Calendar, or any other Google service beyond basic profile information.

2.2. Webpage Content (Processed Temporarily)

To provide AI-powered features such as summarization, Q&A, and text analysis, the Extension reads and processes:

• Visible text content of the webpage you are actively viewing
• YouTube video transcripts (extracted from YouTube's publicly available caption tracks)
• PDF document text (extracted client-side when you view a PDF in the browser)
• Selected text on a page (only when you use the selection toolbar)
• Page title and URL of the active tab

2.3. Chat History (Stored Locally)

Your conversations with the AI assistant are stored in your browser's local IndexedDB database:

• Chat messages (your questions and AI responses)
• Session metadata (title, creation time, last updated time)
• Source context (which page URL was associated with each conversation)

2.4. User Preferences (Stored Locally)

The Extension stores your settings in chrome.storage.local:

• Theme preference (light/dark mode)
• Feature toggles (selection menu, side dock, image overlay, Google Search AI, Quick Access on/off)
• Custom AI prompts you create

2.5. Usage Telemetry (Local Only — No Network Transmission)

Spark AI collects lightweight, anonymous usage statistics stored entirely on your device in chrome.storage.local. This data is never transmitted to any server.

• Aggregate counts: total chats sent, pages analyzed, summaries requested
• First and last usage timestamps
• Error occurrence counts

2.6. Temporary Visual Data

When you use the "Area Capture" or "Ask about image" feature:

• A screenshot of the visible browser tab or a selected region is captured
• This image is transmitted to the AI backend for analysis and is not stored persistently on our servers

3. Data Storage Summary

Data Type	Storage Location	Retention
Chat history	Local IndexedDB	Until you delete it or sign out
User preferences	Local chrome.storage	Until you change or uninstall
Usage telemetry	Local chrome.storage	Until you clear data or uninstall
Page content cache	Local IndexedDB	30-minute TTL, auto-expires
Auth session tokens	Local localStorage	Until sign out
User account info	Server Supabase	Until account deletion
Chat history (synced)	Server Supabase	Until you delete it or request removal
AI credit balance	Server Cloud API	Active account lifecycle
Page content sent to AI	Server Cloud Run	Not stored — processed in real-time, discarded after response
Screenshots / images	Server Cloud Run	Not stored — processed in real-time, discarded after response

4. How We Use Your Data

We use the collected data exclusively for the following purposes:

1. Provide AI-powered features — Page summarization, Q&A, text rewriting, translation, and other AI actions require sending page content to our secure backend for processing.
2. User authentication — Your Google account information is used to create and manage your Spark AI account, verify identity, and manage subscription tiers.
3. Chat history synchronization — If you are signed in, your chat history may be synced to our server (Supabase) so you can access conversations across devices.
4. Credit management — Track your AI usage credits for free and premium tiers.
5. Improve user experience — Local telemetry helps us understand which features are used so we can prioritize development (this data never leaves your device).

5. Data Sharing & Third-Party Services

Spark AI integrates with the following third-party services to function:

5.1. Google OAuth 2.0

Used for user sign-in. We receive your basic profile info (name, email, photo). Governed by Google's Privacy Policy.

5.2. Supabase (Authentication & Database)

Our backend authentication and database provider. Stores your user account record and synced chat history. Supabase is SOC 2 Type II compliant. Governed by Supabase's Privacy Policy.

5.3. Google Cloud Run (AI Processing)

Our AI processing backend runs on Google Cloud Run. When you use AI features, your page content and queries are sent to this service for real-time processing. Data is transmitted over HTTPS and is not persisted after the response is generated. Governed by Google Cloud's Privacy Notice.

5.4. LemonSqueezy (Payments)

If you choose to upgrade to a premium plan, payment processing is handled by LemonSqueezy. We do not store credit card numbers or financial data. Governed by LemonSqueezy's Privacy Policy.

5.5. Cross-Extension Communication

Spark AI can communicate with our sister extensions (BlackNote and AI Screen Recorder) via Chrome's cross-extension messaging API. This is limited to sending text content between extensions you have installed. No data is shared with any extensions outside our ecosystem, and only at your explicit action (e.g., "Send to BlackNote").

6. Chrome Extension Permissions Explained

Spark AI requests the following Chrome permissions. Each is justified below:

Permission	Purpose
sidePanel	Opens the Spark AI interface as a Chrome side panel for a non-intrusive browsing experience
activeTab	Reads the content of the currently active tab when you interact with Spark AI (e.g., summarize, chat)
tabs	Detects tab URL changes to update the AI context and manages tab lifecycle for state cleanup
identity	Enables Google OAuth sign-in flow within the extension using Chrome's built-in identity API
storage	Stores user preferences, feature toggle states, and session tokens locally on your device
host_permissions: <all_urls>	Required so the content script can extract page text, show the floating toolbar, and inject the Quick Access overlay on any webpage you visit. The Extension only activates when you interact with it.

7. Data Security

We implement the following security measures to protect your data:

• Encryption in transit — All network communication between the Extension and our servers uses HTTPS/TLS encryption
• Authentication tokens — Access tokens are securely stored in chrome.storage.local and are never exposed to page scripts
• Content Security Policy — The Extension enforces a strict CSP (script-src 'self' 'wasm-unsafe-eval') preventing injection of unauthorized scripts
• Shadow DOM isolation — UI elements injected into web pages use Shadow DOM to prevent data leakage between the Extension and the host page
• No persistent server-side content storage — Page content and images sent for AI processing are discarded immediately after generating a response
• Row-Level Security — Our Supabase database enforces row-level security (RLS) policies, ensuring users can only access their own data

8. Data Retention & Deletion

8.1. Local Data

All locally stored data (chat history, preferences, telemetry, page cache) is automatically deleted when you:

• Uninstall the Spark AI extension
• Clear your browser data for the extension
• Sign out (chat history is cleared on sign-out)

8.2. Server-Side Data

To request deletion of your server-side data (Supabase account and synced chat history), contact us at alvesoscar517@gmail.com. We will process deletion requests within 30 days.

8.3. AI Processing Data

Page content, screenshots, and images sent to our AI backend are processed in real-time and are not retained after the response is delivered. There are no server-side logs of your page content.

9. Children's Privacy

Spark AI is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal data from a child under 13, we will take steps to delete it promptly. If you believe your child has provided us with personal information, please contact us at alvesoscar517@gmail.com.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right to Access — Request a copy of the data we hold about you
• Right to Rectification — Request correction of inaccurate data
• Right to Erasure — Request deletion of your personal data
• Right to Data Portability — Request your data in a machine-readable format
• Right to Object — Object to certain types of data processing
• Right to Withdraw Consent — You can sign out at any time to stop data collection associated with your account

To exercise any of these rights, contact us at alvesoscar517@gmail.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Effective Date" at the top of this page. Significant changes will be communicated via the Extension's update notes on the Chrome Web Store. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us: