Privacy Policy

Sending a page to an AI service

When you choose a prompt and an AI service, the extension builds a short message containing:

• the address of the page you are on,
• the page’s title,
• any text you had highlighted, if you chose to include it,
• the wording of the prompt you picked.

Sign-in codes are taken out of the address first. Web addresses sometimes carry a credential — the token in a password-reset link, the code that comes back after signing in with Google, the signature on a private file link, or a password written into the address itself. Sending one of those to an AI service would leave a working credential in someone else’s chat history, so the value is replaced with REDACTED before the message is built, and the extension tells you it happened. Nothing else in the address is altered.

That message is placed either into a link that opens the AI service, or on your clipboard when the service provides no such link. Which AI service receives it is entirely your choice, made at that moment. No service is contacted until you pick one, and no service is set as a default.

Once the message reaches the service you chose, that service’s own privacy policy applies to it. This extension has no relationship with any of them and no visibility into what they do. The supported services are ChatGPT (OpenAI), Claude (Anthropic), Gemini and Google AI Mode (Google), Copilot (Microsoft), Perplexity, Grok (xAI) and Scira.

Copy as Markdown

This is the only feature that reads the content of a page, and it does so only when you explicitly ask for it — from the floating button’s menu or the right-click menu.

The page’s text is converted to Markdown, placed on your clipboard, and shown on a page inside the extension so you can check, edit, copy or save it. Specifically:

• The text is handed to that page through your browser’s local storage, never the synchronised kind, so it does not leave your computer.
• The address is not redacted here, unlike when sending to an AI. Nothing is leaving your computer, and a link you cannot follow would be no use in your own notes. If you save a capture of a page whose address held a token, that token is in your file.
• That hand-off is deleted the moment the page reads it. Captured page content is not kept.
• The preview pane renders inside a locked-down frame that is not permitted to make any network request at all — not for images, not for fonts, not by a script, and not by following a link you click in it. This is deliberate: a preview that loaded images, or that followed a link, would quietly tell whatever servers the captured page referenced that you had read it. Images therefore appear as placeholders, and links are inert; the addresses are all still there in the text beside the preview.
• Nothing captured is sent to an AI service unless you separately choose to do that.

Settings, prompts and preferences

Stored using your browser’s extension storage:

• Synchronised by your browser (storage.sync): your prompts, which AI services you have enabled and their order, your appearance choice, your blocklist, and which prompts sit on the floating button. If you are signed in to your browser account, your browser syncs these to your browser account so they follow you between computers. That transfer is performed by the browser, not by this extension, and is covered by your browser vendor’s privacy policy.
• Kept on this computer only (storage.local): where you dragged the floating button, which AI you used last, and the short-lived Markdown hand-off described above.

Your use of the extension is not counted. No tally is kept of which prompts you pick or how often, and the menu never reorders itself based on what you do — its order is the one you set in Settings. An earlier version did keep such a count on this computer; if you are upgrading from it, that count is deleted the first time the new version starts.

The floating button does not appear, and nothing can be captured or sent, on:

• sites served from your own computer (localhost, 127.x.x.x, and similar),
• any page containing a password field, so sign-in and payment pages stay clear,
• the AI services’ own websites,
• your browser’s own pages,
• any site you add to the blocklist in Settings, which starts with a list of banking, health-portal, webmail and password-manager domains.

• activeTab — to ask the tab you are looking at for its address and title when you use a menu, shortcut or the toolbar button.
• contextMenus — to add the right-click menu.
• storage — to keep your prompts and settings, as described above.
• clipboardWrite — to copy a message or Markdown to your clipboard.
• Access to websites — the floating button has to be present on pages for you to be able to click it. Page content is read only when you use Copy as Markdown.

The extension requests no host permissions, cannot read your browsing history, and does not use the tabs permission.

The extension is not directed at children and collects nothing from anyone.

None. There is no server and no stored copy of anything you do, so there is nothing that could be disclosed, sold, or produced in response to a request.

Material changes to this policy will be accompanied by a version update, and this date will change.

Questions about privacy? Contact us at support@zocab.app.