Privacy Policy

1. Information We Collect

We collect the following categories of information, and only for the purposes described in this policy:

• Personally identifiable information. When you sign in with Google, we receive your Google account email address and basic profile information (such as your name and profile picture).
• Authentication information. We process authentication tokens issued by Google Sign-In to verify your identity and keep you signed in. We never see or store your Google password.
• Website content. The content of a web page is captured only when you explicitly request it — when you run a "See" analysis on the current page, or when you activate Grab mode and select text (limited to a maximum of 5,000 characters per selection). We do not passively read or capture page content in the background.
• Web browsing activity. To power the agent-availability badge, the URL of each page you visit while the extension is active is sent to our backend so we can determine whether your agents support that page. This is a real-time capability check: page URLs are used for this purpose only. We want this to be plainly understood — if you do not want page URLs sent to our servers, do not install or enable the extension.
• User activity. Your chat history with agents and the text highlights you save are stored server-side, associated with your account, so that they are available to you across devices.
• API keys you provide (BYOK). If you choose to bring your own AI provider API keys, we store them as described in the BYOK section below.
• Payment information. If you purchase a paid plan, payment is processed by Stripe on our web app. We do not receive or store your full card details; Stripe provides us with limited billing information (such as plan, status, and last four digits) needed to administer your subscription. Purchases never occur inside the extension.

2. How We Use Information

We use the information described above solely to provide and improve the user-facing features of the Service that you have requested:

• Authenticating you and maintaining your account.
• Generating AI responses to your chats, page analyses, and text selections.
• Determining agent availability for the pages you visit (the availability badge).
• Storing and syncing your chat history and highlights across your devices.
• Administering paid plans and billing.
• Securing the Service, preventing abuse, and complying with legal obligations.

We affirm that: (a) user data is used only to provide or improve user-facing features that are prominent in the Service and that you have requested; (b) user data is transferred to third parties only as necessary to provide those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with prior notice to you; (c) user data is never used or transferred for serving advertisements, including retargeted, personalized, or interest-based advertising; and (d) we do not allow humans to read your data, except (i) with your affirmative consent for specific data, (ii) as necessary for security purposes such as investigating abuse, (iii) to comply with applicable law, or (iv) after the data has been aggregated and anonymized.

3. Chrome Web Store User Data Policy & Limited Use

This means data obtained through Google APIs and through the extension is used only to provide the features described in this policy, is not sold, is not used for advertising, and is not used to determine creditworthiness or for lending purposes.

4. How We Share Information; Subprocessors

We share your data only with the service providers (subprocessors) listed below, and only to the extent necessary to operate the Service:

• Google Firebase / Google Cloud Platform (GCP). Hosting, data storage, and authentication infrastructure for the Service.
• AI model providers. To generate responses, the page content, text selections, and chat messages you submit are processed by the AI model provider powering the agent you are using: Google (Gemini), Anthropic (Claude), and OpenAI (GPT). These providers act as processors of your content for the purpose of generating responses.
• Stripe. Payment processing for paid plans purchased on the web app.

We may also disclose information if required by law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of Agashic, our users, or the public.

5. What We Never Do With Your Data

• We do not sell your data. Ever.
• We do not share your data with data brokers.
• We do not use your data for advertising of any kind.
• We do not serve ads in the Service.
• We do not embed third-party analytics or tracking SDKs in the extension or dashboard.

6. Bring-Your-Own-Key (BYOK) API Keys

If you provide your own AI provider API keys, they are treated as write-only secrets: they are encrypted at rest using Google Cloud Key Management Service (KMS), they are never returned to any client (including you) after submission, and they are never written to logs. Keys are decrypted server-side only at the moment a request is made to the corresponding AI provider on your behalf. You can replace or remove your keys at any time in the Service.

7. Security

We protect your data using industry-standard measures, including: encryption in transit via TLS for all communication between your devices and our servers; encryption of BYOK API keys with Google Cloud KMS; and access controls enforced through Firebase Security Rules and Firebase App Check. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to protect your information against unauthorized access, alteration, disclosure, or destruction.

8. Data Retention & Deletion

Your chat sessions and highlights are retained until you delete them, and you can delete them yourself at any time in the app. To delete your entire account and its associated data, contact us at privacy@agashic.ai and we will delete your account and personal data, except where we are required to retain certain records to comply with legal obligations. We retain personal data only as long as necessary to provide the Service and for the purposes described in this policy.

9. Your Privacy Rights (GDPR / CCPA)

Depending on where you live, you may have rights under data protection laws such as the EU/UK General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), including the right to:

• Access the personal data we hold about you.
• Correct inaccurate personal data.
• Request erasure of your personal data.
• Receive a copy of your personal data in a portable format.
• Object to or restrict certain processing of your personal data.
• Not be discriminated against for exercising these rights.

Because we do not sell personal data or share it for cross-context behavioral advertising, there is nothing to opt out of under the CCPA's "sale or sharing" provisions. To exercise any of these rights, contact us at privacy@agashic.ai. We will respond within the timeframes required by applicable law. You may also have the right to lodge a complaint with your local data protection authority.

10. International Data Transfers

Our infrastructure is provided by Google Cloud Platform, and your data is processed in the United States (primary region us-central1). Where required by applicable law, we rely on appropriate safeguards, such as standard contractual clauses, for international transfers of personal data.

11. Children's Privacy

The Service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the "Last updated" date above and, where appropriate, by additional notice in the Service or by email. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: