This page is the complete privacy policy for the Osmolog Chrome extension.

Privacy Policy for Osmolog

Effective date: September 4, 2026

Osmolog records active and passive language-immersion time on supported media websites, records active reading time on article websites the user individually enables, and records activities the user adds manually. This policy explains the information the extension handles and how it is used.

Information handled

To provide tracking, the extension processes:

Fully manual counting treats eligible supported-site playback as the selected target language without performing language checks. Automatic mode normally identifies spoken language from player-provided audio and caption metadata. Weak page-title evidence may suggest an option when asking the user, but does not automatically confirm the spoken language. If the user separately approves the optional local detector and normal detection fails on a Netflix or Crunchyroll session, the extension captures and analyzes tab audio until the language is identified or the session is stopped on that computer as described below. It never transcribes or uploads that audio.

Optional local spoken-language detection

Local spoken-language detection is experimental, off by default, and limited to unclear Netflix and Crunchyroll sessions. An explicit tab-audio recording approval requests Chrome's optional tab-capture and offscreen-document permissions. Capture remains blocked until that approval is saved and those permissions are granted; an older enabled setting or a record that a prompt was shown is not recording consent. Approval is saved on this device and authorizes local audio analysis for unclear playback while Chrome permits access; videos identified by normal detection do not trigger sampling. When normal detection needs help, the video page offers approval if capture consent or Chrome permission is missing. A source-guide impression never suppresses a required permission request. Dismissing the request hides it for that page visit without granting permission. Saved approval avoids repeating the question on later videos. Source-guide shown/dismissed receipts stay device-local and contain no viewing details; they are not exported or synced. Chrome may still require a toolbar click to activate capture in a newly opened tab. Turning the setting off stops an active sample and removes those optional permissions.

After approval, when normal detection cannot identify a playing video, Osmolog keeps tab-audio capture connected while waiting for a confident language result. Dialogue may begin much later in the session; there is no fixed waiting deadline. Silence is discarded. Audible audio is processed in bounded windows, and uncertain windows are discarded before trying fresh audio. The detector requires agreement between two independently sampled confident results. It does not accumulate or save a recording of the session. The language model is not a dedicated speech/music classifier, so confidence is not a guarantee of correctness. Captured tab sound is routed back to the speakers so playback remains audible. Capture ends after identification, a fatal capture/model error, navigation, tab closure, a tracking pause, or permission revocation through Tracker settings.

The sample is resampled locally and processed by the packaged VoxLingua107 ECAPA-TDNN model through packaged ONNX Runtime Web code. The model returns language scores only; it does not produce a transcript. Raw audio buffers are discarded when analysis ends and are never written to extension storage, included in exports or sync, sent to Osmolog, Supabase, OpenAI, the model authors, the streaming provider, or any other remote service. The confidence and sample duration are transient. The resulting per-video language choice and tracked session follow the same local-storage and optional Pro Sync and Backup rules as a manually selected language. The enablement setting is device-local and excluded from Chrome Sync, Pro Sync and Backup, JSON/CSV exports, analytics, diagnostics, feedback, and Groups.

The development installer obtains the model from Hugging Face and ONNX Runtime Web from npm over HTTPS. Those services receive ordinary download request information such as the network address and user agent under their own privacy practices. A distributed extension package can include the verified files and does not need those downloads at runtime.

The extension does not read passwords, payment information, or cookie contents. A page containing a password or payment field is never eligible for reading tracking. Outside declared media services, ongoing tracking requires the user to add an individual custom video or reading website and approve Chrome's site-access prompt. When the user opens the Osmolog toolbar popup on another website, Chrome's temporary active-tab access lets the popup check for HTML video elements and their playback state, including accessible same-origin frames and open shadow roots. This bounded check returns only presence/playback flags, does not read page text or capture audio, and does not store or transmit its results. The popup can also use Chrome's tab-audible flag to suggest adding a website. No custom-video time is recorded until the user chooses a language and approves site access.

On an enabled reading website, Osmolog runs only on ordinary HTTP or HTTPS article pages. Browser-internal pages, extension pages, local files, PDFs, Google Docs, ebook readers, and app-like editors are not supported. The worker reads a bounded visible-text sample locally to identify Japanese, Korean, or Chinese when the page's language declaration is insufficient. The sample and computed character ratio are immediately discarded. Page text, page titles, full URLs, paths, query strings, selections, and scroll positions are never stored or transmitted. A reading session stores only the enabled hostname, duration, language, activity type, and timestamps in the same local history used for other sessions. Reading starts only after the user presses its control, and time accrues only in the focused, visible tab while recent reading activity is present. The reading-site permission list stays on that browser and is excluded from Chrome Sync, account sync, product analytics, feedback, and Groups. Removing a reading website unregisters its worker and revokes its optional site access.

Custom video tracking reads ordinary HTML-video playback state on an individually approved website and uses the language selected by the user; it does not perform language detection there. The custom-video site-access configuration stays in local extension storage and is not included in Chrome Sync, product analytics, feedback, or Groups. Recorded custom-video sessions follow the same history rules as other sessions: their hostname source label and page title remain local unless the user has explicitly enabled Pro full backup, whose disclosure includes complete session titles and source labels. Removing the website revokes its optional access. When a supported provider exposes artwork only through its own signed-in page session, Osmolog may make a same-provider request from that page to obtain the artwork URL; it does not copy or transmit the provider's cookies elsewhere. YouTube, Netflix, Twitch, and Crunchyroll are labelled Supported and available by default. YouTube Music is labelled Beta and is also available by default. Spotify, supported podcast web players, and additional streaming services are labelled Experimental and shown only when the user enables the Experimental list. Generic webpage audio is not enabled because arbitrary pages cannot reliably separate content from ads or interface sounds.

The optional Windows MPV companion runs locally and connects to the extension through loopback after the user grants Chrome's local-host permission. On first run it opens a five-minute local connection window that accepts Chrome-extension Origins only and stores the verified Osmolog extension ID locally. If Osmolog is later reinstalled with a different ID, the user must explicitly select Reconnect Osmolog in the companion before the new extension can replace the trusted ID. Folder-to-language rules and full media paths remain in %APPDATA%\Osmolog and are evaluated only by the companion. Completed segments are journaled there until the extension acknowledges them; unassigned-language segments are retained in extension storage until the user assigns them. The configured Chrome-extension Origin check blocks ordinary websites but is not intended to defend against a determined process already running on the same computer. The installed companion checks its public GitHub Releases feed over HTTPS and downloads newer installers automatically; GitHub receives ordinary request information such as the network address and user agent, but no media titles, paths, activity, languages, settings, or Osmolog history. The portable companion performs no automatic update checks. The companion sends no data directly to Osmolog or Supabase.

Steam games

Steam tracking is optional and off by default in Osmolog Companion. When enabled, Companion reads local Steam library manifests and observes game-window focus and keyboard/mouse/XInput idle state. The paired extension receives only the current game's app ID, optional title, language, timing, and bounded tracking/settings status. Full paths, process IDs, raw input, and the installed library stay inside Companion. No Steam account, public profile, credentials, or third-party Steam website is required. Per-game language/exclusion preferences remain in local Companion configuration. Recorded Gaming sessions follow the same local history, export, and optional sync rules as other sessions; app IDs can identify games even when Companion title recording is disabled.

Channel, artist, show, and artwork information

Osmolog's Sources view can group locally retained sessions by a bounded channel, artist, or show identity and display the readable name, recorded time, share, session count, and available provider artwork. For episodic services, the local session title may also contain the season, episode number, and episode name exposed by the player. Provider logos, such as the YouTube, Netflix, and Twitch marks, are packaged inside the extension and do not require a network request.

When a supported player exposes a channel avatar, artist image, or show artwork, Osmolog may retain the provider-hosted image URL with the session. It does not retain a separate individual-video thumbnail. The dashboard displays available artwork by requesting that retained URL directly from the provider or its image-delivery service. That provider receives the ordinary image request, which can include the user's network address and standard request information under the provider's own privacy practices. Osmolog does not proxy the request or copy the image into an Osmolog-operated image library. The retained URL stays in local extension storage, is included in a deliberate local JSON export, and can be included in live Pro Sync. Automatic cloud recovery snapshots omit provider artwork URLs, so restored artwork may be unavailable; it is never included in Free Basic Sync, product analytics, feedback, or Groups. It can be removed by permanently deleting the session, resetting data, or removing the extension.

How information is used

Information is used only to:

Local storage and Chrome Sync

Tracker history and settings are stored in Chrome extension storage on the user's device. Free Basic Sync stores a separate random contributor ID for each installation; lifetime total, aggregate active seconds and aggregate passive seconds by language; combined daily total, aggregate active seconds and aggregate passive seconds for the latest 12 months; goals, language settings and selected safe settings; compact format/version data; and reset markers through chrome.storage.sync, which is operated by Google and subject to the user's Chrome and Google account settings. Sources, activities, exact times, session rows, titles, URLs and descriptions remain local. Separate device contributions are added together for the displayed total and permanent session IDs are not placed in Chrome Sync. Chrome Sync extension storage is not treated as encrypted storage.

Basic Sync does not contain session records, session IDs, source or activity values, titles, readable channel/show labels, manual descriptions, URLs, searches, subtitle or page text, exact times, or session timelines. Optional older calendar data is compacted before lifetime totals if Chrome Sync approaches its quota; the Account page warns at approximately 75% and 90% use and offers a full local JSON export. Older detailed Chrome Sync entries created by a previous extension version are converted to the current compact contract and removed when the new Basic Sync contract runs.

The popup's collapsed Detection details panel is transient and local. Its sanitized copy action includes only the provider and adapter names, detected language codes/names, decision/conflict state, scan timing, and—when local detection was used—the bounded model confidence and sample duration. It excludes audio, page URLs, video titles, channel/source names, content identifiers, and account/profile data. The extension does not keep a diagnostic event log or transmit these details.

To avoid repeating the same first-time provider guide or unresolved-playback tip, the extension keeps separate local-only education metadata containing only the education version, a closed provider identifier (YouTube, Netflix, or Crunchyroll), bounded shown, dismissed, or resolved timestamps, and a short-lived pending-claim expiry used to ensure a guide or tip was actually displayed. It contains no URL, title, content or source identifier, language, account data, or detection evidence, and is excluded from Chrome Sync, backup/export, cloud sync, analytics, and diagnostics.

Osmolog has no advertising SDK and no in-extension payment integration. It does not sell or rent tracker data. The dashboard and popup read the same extension data. See "Product analytics" below for the separate, off-by-default, consent-based analytics contract.

Free Basic Sync reset advances a shared generation so older entries cannot restore previous progress. Older-generation physical items may remain in Chrome Sync until overwritten; Osmolog does not delete reused keys during retry because another device may already have stored new progress there. This is logical reset protection, not a claim to erase Google's historical copies.

Optional account, Pro Sync, and recovery backup

Signing in is never required. Local tracking, goals, history, and exports work without an account and remain available without Pro access or after the user signs out.

Supabase is used as the third-party authentication and database provider. Supabase stores the account email and authentication credentials. The extension never stores the account password beyond forwarding it in the authentication request.

Creating an account or signing in enables the account connection. The sign-in and create-account forms prominently disclose the Pro Sync and Backup fields immediately above their submit button. An account already signed in under an older aggregate-only disclosure must make a one-time explicit choice before full-detail synchronization begins. Signing in stores the account identifier, a randomly generated per-device identifier that is not a hardware identifier, and a generic device label derived from it.

While the account has active Pro access, the extension synchronizes complete supported session records by permanent session ID and keeps three separately validated, compressed, full-history recovery points: the latest, one from about a week earlier, and one from about a month earlier. The synchronized and backed-up tracker state includes:

Live Pro Sync can include retained provider-artwork URLs that are part of supported sessions. Automatic cloud recovery snapshots omit those cosmetic artwork URLs; they retain source identities, labels and the custom-video origins described above. Local JSON exports include retained artwork URLs. Restoring a cloud snapshot preserves supported history and settings but may not restore artwork. For a completed reading session, the retained source and generated session label contain the enabled hostname, but never the page title, full URL, path, or query. It includes text labels that the user explicitly teaches to audio tracking, but never the audio itself. It excludes audio, passwords, cookies, searches, subtitles, page text, reading selections and scroll positions, local language-detection ratios, authentication tokens, account entitlements, analytics queues, and local cloud-transport bookkeeping. Reading-site permissions and the reading-site allowlist are device-local, as are Chrome host-permission grants, keyboard shortcuts, Anki connection secrets, in-progress timers, and overlay screen position. Provider logos and packaged icons are extension assets rather than user backup data.

Supabase also stores the account email and authentication data, display name, the short ID of a selected packaged profile avatar, cloud-activation time, server-owned plan/entitlement status, registered device metadata, reset generation, mutation receipts, change cursors, minimal deletion fences, conflict records, and account setting revisions. The avatar artwork itself remains packaged inside the extension. Legacy aggregate/backup rows may remain during the guarded rollout under the same account, reset, entitlement and recovery controls; current clients use per-session Pro Sync plus the three recovery points.

Pro synchronization is automatic on browser startup, sign-in, connectivity recovery, dashboard/popup activity, background alarms, and whenever a local session is saved. Local tracking never waits for the network. The client downloads cloud changes before uploading its durable pending queue, merges sessions by ID and revision, and treats absence as no deletion. If two devices edit the same session before seeing each other's change, Osmolog keeps the synced version active and retains the other edit locally for an explicit comparison choice. Signing out stops further uploads without deleting the server copy. Sync now is a manual retry, and full JSON export/import remains available on every plan.

Backup transport uses HTTPS. Supabase encrypts the project at rest, and Row Level Security restricts ordinary authenticated clients to the backup row belonging to their account. Authorized infrastructure operators retain the access necessary to operate and recover the service. This design is not zero-knowledge or end-to-end encryption: it deliberately allows password/account recovery to remain seamless without a second recovery secret or private key. The extension never embeds a Supabase service-role key.

Losing Pro access stops cloud writes and new recovery points immediately and starts the disclosed 90-day recovery window shown in Account. Existing cloud session history and recovery points remain read-only and exportable during that window and are then permanently removed by bounded trusted server cleanup. Returning to eligible Pro access before the deadline cancels scheduled deletion and resumes with a download before any pending local uploads. Local tracking is unaffected. Account reset advances the reset generation and permanently removes live cloud data and all product recovery points before local data is cleared; account deletion removes the profile and owned cloud data without affecting local history unless the user separately resets it.

Optional Groups and Pair

Groups and Pair require a signed-in account and a display name explicitly chosen during creation or joining. That name is shared across the account's spaces and can be changed in Account. Supabase stores group names and optional descriptions, selected languages, Friendly/Competitive mode, counting rules, period/timezone/target settings, status, memberships and their timestamps, and hashed invitations with expiry and use limits. Members see identities and daily/period totals split into automatic/manual active/passive time, including categories excluded from scoring. No sources, titles, URLs, private notes or individual-session feed are shared.

Private server evidence uses opaque stable identifiers, bounded start/end intervals, language, automatic/manual origin, active/passive seconds and revisions to reject duplicate or overlapping automatic recordings and increases. This evidence is not exposed to other members. Reduced values are audited while results remain editable. On a later contribution sync, evidence for locked periods is pruned while daily totals remain. Reactions store the daily progress item, reacting account and chosen reaction. Safety reports retain only account/space identifiers, a closed reason and status timestamps, without free text.

Writes are rate-limited; database permissions and server functions enforce membership, management roles and counting rules. Results lock 24 hours after a period ends. Existing Group sponsorship grace/read-only behavior remains. Spaces persist until archived or the final member leaves. Leaving or removal stops access and new sharing; earlier aggregate contributions remain as Former member. Account deletion removes private evidence and reactions and anonymizes retained daily totals. Local Group caches, pending transport and acknowledgements are account-scoped and excluded from tracker exports, Basic Sync and Pro backups. Previously downloaded or copied results cannot be remotely recalled.

Product analytics

Product analytics are off by default and remain separate from Pro access and full backup — enabling sync does not enable analytics, and enabling analytics does not enable sync. This control lives in the Account page's Privacy & data card. When a user is signed in, the on/off preference is included in the account-settings sync so their signed-in browsers use the same choice; the analytics events themselves remain anonymous and are not linked to that account.

If a user turns analytics on in Settings, the extension shares small, anonymous usage events containing only:

Product analytics never collect or transmit video or content titles, URLs, search terms, subtitles or captions, page text, or anything typed into a manual entry. A stored analytics event contains no account ID, device ID, session identifier, or stable per-install identifier, and the separate rate-limit hash described below is never stored with or joined to an event.

MPV companion sessions are not submitted through product analytics in v1.

Analytics events dated more than 12 months in the past are eligible for permanent deletion. The analytics endpoint runs this bounded cleanup at most once per day when it next processes analytics traffic, so deletion can occur later if the endpoint receives no subsequent traffic.

To prevent abuse of this anonymous endpoint, the server temporarily checks how many events are arriving from the same network address, using a one-way hashed version of that address that is stored separately from analytics events and is never linked to them. The hash affects only its fixed one-minute rate-limit bucket. Buckets older than an hour are removed when later analytics traffic runs cleanup; if there is no later traffic, a stale hash can remain stored until that cleanup next runs, but it no longer affects request limits. This check exists only to slow down automated flooding of the endpoint. It does not identify a user, is not used to build any profile, and is not connected to target language, platform, or activity data in any way.

Product analytics can be turned on or off at any time from Account → Privacy & data. For a signed-in user, the updated choice follows the account to their other synced browsers. Turning it off stops any further events from being shared; because events are never linked to an account or device, previously shared events cannot be individually identified or removed. On-device charts and insights operate from local tracker data regardless of this setting.

Anonymous error reports

Anonymous error reporting is a second, independent choice. It is off by default in the welcome tutorial and can be changed later from Account → Privacy. Enabling product analytics, an Osmolog account, Basic Sync, or Pro Sync does not enable error reporting. This preference is local to the browser where it was chosen.

When enabled, Osmolog may report a detected storage or dashboard failure using only six fixed fields: a closed error code, a closed component name, the extension version, the local-data schema version, whether automatic recovery succeeded, and a coarse affected-count bucket (none, 1, 2–5, 6–20, or 21+). The server adds the receipt time. The endpoint does not accept error messages, stack traces, session IDs, account or device IDs, titles, URLs, source labels, viewing history, subtitles, page text, manual descriptions, or other typed text.

The extension applies the same closed allowlist before an error report can leave the browser. It keeps at most 20 pending reports locally, suppresses the same report for 24 hours after a successful submission, and deletes pending reports when the user turns the option off. Submitted diagnostic rows are eligible for permanent deletion after 90 days.

To prevent abuse, the diagnostic endpoint limits total traffic and allows at most 60 reports per hour from one network address. It stores a one-way hash of that address in a separate rate-limit table; the hash is never included in or joined to a diagnostic row. Expired rate-limit buckets are removed by later diagnostic traffic and are not used for profiling.

User-submitted feedback

The FAQ page includes an optional feedback form. Submitting it sends only the selected category, the message the user types, and the extension version to Supabase. The form asks users not to include passwords, email addresses, URLs, or private viewing details. Feedback is not linked to an account and the endpoint does not accept titles, browsing history, tracker totals, or arbitrary metadata fields. Submitted messages remain stored until they are reviewed or deleted by the operator.

To prevent automated flooding, the feedback endpoint allows at most five submissions per hour from one network address. It stores a one-way hash of that address in a separate rate-limit table, never in the feedback row. Expired buckets are removed when later feedback is submitted; a stale bucket may remain until that cleanup next runs, but it no longer affects the request limit and is not used for profiling.

Data control and retention

Phone remote beta

The optional Phone remote requires a confirmed Osmolog account and works with free accounts during the beta. The phone saves its active timer, completed sessions, and custom source names in Supabase. A timer includes its source, optional title, language, active/passive mode, start and pause times, time zone, and immersion-day boundary. Completed sessions include duration and dated time segments. Recording works while the computer is off; internet access is required to save changes.

When a signed-in extension opens, it collects waiting sessions for the same account and saves them through its normal local history and synchronization settings. Each session is assigned to one Chrome installation to prevent duplicate contributions across computers. Supabase stores that installation's random identifier, name, and collection status; a local receipt stored alongside history prevents duplicate imports after interruptions. Your existing extension sync handles other computers. Custom watching-source names merge between the phone and extension.

Signing out revokes that endpoint's access but keeps timers, completed sessions, and custom sources in the account. Phone records remain until the account is deleted, including records already collected by Chrome; deleting a local History entry does not delete that retained phone record or collect it again. If the receiving installation is removed before confirming collection, the saved session remains assigned to it. Command request identifiers and responses support safe retries and are pruned after seven days when that account next submits a command.

The phone stores its account session and any unconfirmed save request in browser storage. The unconfirmed request can include the source, title, language, duration, and date being saved; it is removed when confirmed. The account session is removed on sign-out. Only public app files are cached for installation; passwords, account sessions, and timer data are not stored in the service-worker cache. A private beta preview may also require its owner's ChatGPT sign-in.

Earlier beta versions used a computer relay. That compatibility endpoint sends the selected computer's name, manual-timer state, language list, and extension version to Supabase. Relay commands expire after one minute and are cleaned up when the account next submits a command after a day. Disabling the legacy relay deletes its endpoint and queued commands.

Daily totals, dates, and source breakdowns remain on the device until edited, reset, or the extension is removed. Daily records contain date, language, general source, active time, passive time, and session count—not titles or URLs.

Completed local session records may include readable video and manual-action titles, their general source and origin, a bounded channel/show source identity and readable label, a provider-hosted channel avatar or show-artwork URL when the supported player exposes one, and exact active/passive timeline segments. Reading records contain a generated label and source based only on the enabled hostname; they never contain the article title or page address beyond that hostname. All individual details are retained by default. Account settings offer an optional limit from 100 to 5,000, with confirmation before reducing retention. Only when a finite limit is explicitly chosen are older sessions replaced by statistical summaries preserving original counts, dates, language, activity, source/channel identity, active/passive time, numerical duration distributions, and hourly totals. Individual titles and exact playback timelines are removed; increasing the limit cannot restore them. Sessions still recording are protected until they finish. Users can also permanently delete a session, replace or reset local data, or remove the extension; with active Pro access, supported session fields are synchronized and backed up subject to the artwork exclusion disclosed above. Osmolog does not download or maintain its own image library; the dashboard requests the retained provider image URL when it needs to display available artwork. The dashboard reveals retained individual History progressively in 50-row batches; popup History remains a latest-ten summary. Local JSON backups include retained session details, bounded source identity, and timelines; when available, they also include the provider artwork URL. Imports create a local recovery copy of the prior history before replacement. These copies remain on this device until an explicit all-data reset, browser storage removal, or uninstall; users can download them from Account. JSON import and export support files up to 256 MiB. Spreadsheet exports prefix formula-like text cells with a tab to reduce formula execution when opened in spreadsheet software. CSV exports remain daily aggregates and do not include sub-day timelines. Separate per-video identifiers are not retained in History.

Remembered exact-video, channel, and related-content choices use pseudonymous hashed identifiers for functional matching. With Pro full backup, saved rule state and its bounded readable manager label are included in the account snapshot; Basic Sync does not contain rules. These identifiers minimize readable matching data; they are not claimed to provide cryptographic anonymity. Unconfirmed playback time exists only in memory while a language question awaits an answer and is discarded if the user rejects it or leaves the video.

Users can export tracker data as JSON or CSV.

Deleting one session is permanent after a simple confirmation; a minimal anonymous deletion fence may remain so an offline device or older backup cannot restore the private content. Reset this device clears only the current installation and its Free Basic Sync contribution. Reset all account data permanently clears the account generation, cloud sessions, recovery points, and synchronized account data across devices. Both bulk reset actions require the user to type reset, and no trash or 30-day undo copy is retained. A signed-out user must sign in again before an account-wide reset can remove the remote copy. Account deletion remains available separately from the Account page.

Security

The extension uses Chrome Manifest V3, executes only packaged code, restricts default website access to declared supported services, and gains access to a custom video or reading website only after the user adds that host and approves Chrome's site-access prompt. Optional tab-audio access is requested separately and is used to analyze bounded audio windows of unclear playback after explicit approval, with capture staying connected until identification or session termination; analysis runs in an extension offscreen document and capture is explicitly stopped. It transmits full-detail tracker records only to the optional user-account provider after the user reviews the disclosure, signs in, and has active Pro access. Authentication tokens are stored separately from exportable and backup tracker state. Transport encryption, database-at-rest encryption, per-account RLS, protocol/version gates, payload limits, compression and backup integrity hashes are enforced; the service is not represented as zero-knowledge encrypted.

Limited Use disclosure

Osmolog's use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including Limited Use requirements. Information is used only to provide or improve user-facing immersion-tracking features. It is not used for advertising, creditworthiness, lending, or sale to third parties, and is not made available for humans to read except when the user explicitly supplies specific information for support or when required by law or security needs.

Changes and contact

Material changes will be published with an updated effective date. Questions can be submitted through the support channel on the extension's Chrome Web Store listing.