Privacy Policy

• Account and identity data: email address, display name, profile photo URL (if any), email verification status, and a stable Firebase user ID (UID) obtained via Firebase Authentication. Email may change and is not the sole primary identifier.
• Session and authentication credentials: an HttpOnly session cookie on the website (for example, askalong_session); short-lived AskAlong API bearer tokens in the extension (the server stores only hashes and enforces expiry). We do not require long-lived tokens in localStorage readable by third-party scripts.
• Subscription and billing metadata: plan type; normalized status such as trialing, active, past due, or canceled; billing period; external subscription and billing event IDs. Card numbers and full sensitive payer details are handled by Paddle; we do not store full payment card data.
• Usage and entitlement data: counts for Q&A turns, user ASR, and uncached media ASR seconds, plus related quota events.
• Media context metadata: media identifiers/fingerprints, page or source URLs when needed to recognize public media, playback position, epoch, time ranges, segment transcripts, and rolling summaries. Segment transcripts for public media may be reused across users in de-identified form.
• Voice and audio data: microphone and tab/media audio processed briefly after you explicitly enable capture, for ASR, Audio LLM, TTS, or compatibility paths. Raw audio is not written to the database by default and is not retained long-term.
• Conversation history: your question text, assistant answers, media position, and the summaries or evidence segments used for the answer. When “Save conversation history” is enabled, these text records are retained locally in the extension and synced to your account for the website history page. Raw microphone or media recordings are not uploaded as part of history sync.
• Technical and diagnostic data: IP address (as logged by infrastructure), user agent, extension version, error codes, request stage, latency, and limited operational logs. We do not intentionally log Authorization headers, OpenRouter keys, full raw audio, or sensitive request bodies.
• Preferences: barge-in mode (pause/duck/text-only), voice profile tier, resume offset, whether to play AI audio, language preference, and similar product settings.

• Tab media and/or microphone input are processed only after you click AskAlong or otherwise start a session. We do not silently monitor your system audio in the background.
• Web media and the user microphone are separate pipelines: the former builds timeline context for answers; the latter captures questions.
• We prefer media-element captureStream(); when needed, user-triggered tabCapture plus an Offscreen Document is used, with tab audio re-played so capture does not mute the original content.
• The timeline is sliced on media time (about 15 seconds, with an 8–30 second range and overlap), preferably at silence points. Playback rate and seeks map to media time so unplayed ranges are not treated as heard.
• ASR results for the same public media and time range may be shared across users. Cache hits do not re-call upstream models and do not re-charge media ASR allowance.
• Where feasible, the server reads public media from the source URL and extracts only needed ranges; short uploads may occur when the source cannot be fetched or media is private/restricted.
• Answer context includes only content at or before the current position (hot context, rolling summaries, precise segments, and recent personal dialogue)—never future spoilers.
• Before Audio LLM calls, the browser may decode WebM/Opus locally into the required PCM/WAV format; server-side user ASR may be normalized with ffmpeg. After processing, raw audio is deleted under the default policy and is not archived long-term.
• We do not support DRM media, private meetings, or payment/medical call pages; sensitive sites should not be used for capture.

We use the information described above for the following purposes:

• Creating and maintaining accounts, verifying identity, and syncing the same entitlements and allowances between the website and extension.
• Providing real-time voice and text Q&A, media understanding, shared timelines, summaries, session state, and playback control.
• Metering usage, enforcing plan limits, processing subscription activation, renewal, cancellation, and reinstatement, and preventing double billing or double quota deduction.
• Security: authentication, rate limiting, fraud and abuse detection, troubleshooting, and auditing (with minimization).
• Improving reliability and quality (for example latency, error rates, and compatibility). We do not sell your personal identity information.
• Complying with legal obligations, responding to lawful requests, and protecting users, the public, and our rights and safety.
• Sending transactional service notices (security, billing status, and similar) where consented or otherwise permitted by law.

• Authentication: Google Firebase Authentication (including Google sign-in and email/password).
• Payments: Paddle (checkout, customer portal, subscriptions, and tax handling). Payment details are governed by Paddle’s terms and privacy policy.
• Models and speech capabilities: upstream model services accessed through our controlled server gateway (for example OpenRouter and its downstream providers) for ASR, text LLM, TTS, and Audio LLM. The browser never holds the OpenRouter API key; clients cannot freely choose models or override system prompts.
• Infrastructure: cloud hosting, PostgreSQL databases, logging, and network providers, only as needed for hosting and secure operations.
• Legal requirements: we may disclose information when required by law, valid legal process, or to prevent serious harm.

• Website: HttpOnly, Secure session cookies with appropriate SameSite settings maintain sign-in. Auth and billing write requests are constrained by same-site/origin checks.
• Extension: chrome.storage and related extension storage hold session tokens, settings, and local history. After extension reload, invalidated page scripts should stop messaging.
• We use these technologies to maintain sessions, remember locale preference, and complete security checks—not for cross-site advertising profiles.
• You can manage cookies in browser settings; disabling necessary cookies may prevent website account features from working.

• Raw web media and microphone audio: deleted after processing by default; not archived long-term in the database.
• Account, subscription, billing events, and usage records: retained while the account is active and for reasonable legal/financial periods thereafter.
• Shared public-media segment transcripts and summaries: retained to power cross-user caching and context, decoupled from personal identity.
• Extension-local ASR is retained under transcript settings. Account conversation history is retained locally and server-side for the selected 1, 7, or 30 days, and can be cleared from the extension or website history page.
• Security and diagnostic logs: typically kept for a limited period (on the order of about 30 days) for troubleshooting and abuse prevention, with minimization.
• Session tokens: expire by configuration; sign-out, password changes, or account disablement should invalidate related sessions.

• View plan, usage, and subscription status on the account page, and manage renewal or cancellation through billing portals.
• Adjust privacy-related settings in the extension, clear local history, or stop capture and sessions.
• Revoke microphone and related browser/system permissions.
• Request account deletion: we delete or anonymize personal profile data, personal session/Q&A history, and subscription linkage; de-identified shared public-media transcripts may remain.
• Submit privacy requests through account channels or published support contacts. We may need to verify your identity before responding.