Privacy Policy

CrossChat browser extension v1.0.1 · Effective: 2026-10-19 (v1.0.0 first published 2026-10-16)

1. What the extension does (single purpose)

The extension has one purpose: helping you draft replies to buyer messages inside your own customer-service web pages. It captures a buyer message you actively select, translates it, matches it against your knowledge base, and drafts a reply which it fills into the page's existing reply box. It never clicks send, never schedules messages, and performs no actions in your accounts — every reply is reviewed and sent manually by you, using the platform's own controls.

2. Data stored only on your device

The data below is kept in the browser's local storage (chrome.storage.local). It is never uploaded to any server of ours and is removed by the browser when you uninstall the extension:

The extension does not require an account and does not collect your name, email (apart from the legacy v1.0.0 local-only registration above, which was never uploaded), phone number, or payment information.

3. Every network request the extension makes

3.1 Model requests — sent directly to the provider, never through us

Only when you have configured BYOK with your own key and you actively click Translate/Draft, the browser sends the buyer message and relevant knowledge-base snippets directly to Volcengine Ark (ark.cn-beijing.volces.com, hosted in mainland China) using your own API key. These requests do not pass through, and are not stored on, any server operated by the extension developer. They are subject to Volcengine/ByteDance's own privacy policy. The offline demo mode makes no model requests. Email addresses, phone numbers, card numbers and postal addresses detected in buyer messages are masked before sending and restored locally when you adopt a draft.

3.2 Anonymous usage statistics — disabled in v1.0.1 (no traffic, no secret)

v1.0.0 sent a small set of anonymous counters directly via Google Analytics Measurement Protocol v2. That transport requires a write secret to be packaged inside the publicly distributed extension, and a secret in a public package cannot stay secret. We therefore removed the direct transport completely in v1.0.1: the package contains no analytics secret, requests no host permission for Google Analytics domains, and the configured endpoint is an empty string — regardless of the options toggle, no analytics request is ever sent. If statistics are re-enabled in the future they will go only to a self-operated anonymous relay (secret held server-side, with origin allow-list and rate limiting), defaulting to off with a one-click opt-out. See section 4.

3.3 Requests that never happen

• The extension does not read the web pages you visit: the assistant is injected only on sites you explicitly add and authorize, and injection stops immediately when you remove a site;
• It does not request browser cookies, account sync, or browsing history;
• The bundled knowledge-base seed is a local file inside the extension package, never downloaded.

4. Exactly what the usage statistics contain

Current status (v1.0.1): the channel is disabled — zero requests, zero secrets, zero third-party recipients. The toggle in section 7 of the options page remains in the UI but produces no outbound traffic in either position. The whitelist below is the event schema retained in code: it is the maximum that could ever be sent if statistics are re-enabled in the future through the self-operated anonymous relay. Any re-enabling will be published as a new version of this policy.

Events are restricted by a code-level whitelist to the 4 events and 3 enumerated fields below; any other field is dropped before sending:

• Never included: message text, translations, knowledge-base content, personal data, full URLs, page titles, or API keys.
• The client ID is a random UUID generated at install, linked to no identity; no cookies are set.
• The Google Analytics write secret shipped in v1.0.0 must be treated as exposed: v1.0.1 no longer uses it, and the operator is revoking it in the Google admin console. The secret could only write counter events, never read data, but it is still handled as a leak.
• Future relay architecture: the extension would POST only {measurement_id, client_id, events} over HTTPS to our self-operated anonymous relay — the payload contains no secret; the real analytics secret stays on the relay server, which forwards under an origin allow-list and rate limiting, with relayed fields capped by the whitelist above.
• To opt out: uncheck "Send anonymous usage statistics" in section 7 of the options page (in v1.0.1 neither position sends anything; if the relay ships, it still defaults to off).

5. This website and the store listing

This site is hosted on GitHub Pages; GitHub may log page requests under its privacy statement. The site itself sets no cookies, runs no analytics scripts, and loads no third-party tracking resources. The extension is distributed through the Chrome Web Store, where installs and reviews are covered by the Google Privacy Policy.

6. Your choices and rights

• Opt out of statistics: the channel is disabled in v1.0.1 (zero requests); if it is re-enabled later, the same one-toggle opt-out applies immediately;
• Delete data: clear metering data on the dashboard, remove your key and sites in options, or simply uninstall the extension (all local data is removed);
• Access requests / complaints: email the address below; we respond within 30 days;
• The extension is not directed to children under 13 and does not knowingly collect children's information.

7. Changes

Material changes will be posted here with a new version number and effective date; any new data collection will also be stated explicitly in extension release notes.

8. Contact

Operator: shizhi3620 (individual developer)
Privacy questions and deletion requests: crosschat.app@gmail.com