PrivacyPolicy.

Last updated: August 5, 2026

1. Overview

Hey Genie is a Chrome extension that provides an AI-powered side panel to answer questions about the web page you are currently viewing — by text or by voice — using your own existing ChatGPT, Grok, Gemini or Pi login. It reads the open page (or a file you attach) and passes that context to the AI provider you select, then displays and optionally speaks the answer.

Key Point: Hey Genie does NOT collect, store, or sell any personal browsing data. All queries are routed directly from your browser to the AI provider you are already logged into. None of your data is sent to, or stored on, any server operated by the developer.

2. What the Extension Reads

When you ask a question, the extension reads the following data locally in your browser:

  • Page Text: The visible text of the page you are viewing — headings, paragraphs, lists, tables, code blocks, quotes, link text, and the alt / aria-label / title text of images. Pixels of images on the page are never read. How much text is collected is capped by your "Context Length" setting (4,000 / 8,000 / 12,000 / 15,000 characters).
  • YouTube Captions: On YouTube, the extension also reads the video's own caption track when one is published.
  • URL & Title: The URL and title of the active tab are read at the moment you ask a question, so the answer can be attributed to the right page.
  • Attached Files: Files you explicitly attach with the paperclip button: PDF, images, Word (.docx), Excel (.xlsx), PowerPoint (.pptx), RTF, and plain text or source files. A PDF already open in a browser tab is read the same way without an extra click. All file parsing happens locally inside the extension.
  • Images: Text inside an attached image is extracted by Chrome's built-in on-device AI model. The image never leaves your device.
  • Voice Input: When you activate voice input, the extension captures your speech and converts it to text using Chrome's built-in Web Speech API. Important: On Chrome, that API transmits the captured audio to Google's speech recognition service for transcription. This is browser-provided functionality; the extension does not record, store, or transmit audio itself.

3. Where Your Data Goes

Page text, attached file text, and your question go only to the one AI provider you have selected — chatgpt.com, grok.com, gemini.google.com, or pi.ai — using that provider's own session inside your own browser.

None of it is sent to, or stored on, any server operated by the developer.

Your data is therefore subject to the privacy policy of whichever AI provider you choose:

Spoken replies are produced either by the provider's own text-to-speech endpoint or by the browser's built-in speech synthesis.

4. Data We Collect

Personally Identifiable Information

Email address, collected only if you choose to create a Hey Genie account or sign in (including Sign in with Google). This is used solely to identify your account and to determine whether you have an active subscription. Accounts are handled by Appwrite Cloud (sfo.cloud.appwrite.io) acting as the authentication backend. No name, address, age, phone number or ID number is requested at any point.

Authentication Information

The password you choose for your Hey Genie account is transmitted over HTTPS to Appwrite Cloud, which stores it hashed. The extension never stores or logs it.

Separately, the extension reads your existing browser session cookies for chatgpt.com, grok.com, gemini.google.com and pi.ai in order to make requests to those services on your behalf. These cookies are used only inside your own browser and are never transmitted to any developer-owned server or third party.

What We Do NOT Collect

  • Financial & payment information: Subscription payments are taken on Dodo Payments' own hosted checkout page, opened in a normal browser tab. The extension never sees or handles card numbers, billing addresses or any other payment details.
  • Health information: Not collected.
  • Personal communications: The extension does not read your email, messages or chats with other people. The only conversations it handles are your own questions to an AI assistant and that assistant's replies.
  • Location: Not collected.
  • Web history: The extension does not read, build or transmit a record of the sites you visit. It reads the URL and title of the currently active tab only at the moment you ask a question.
  • User activity: No clicks, mouse positions, scroll depth or keystrokes are recorded. A per-day count of how many replies you have generated is kept to enforce the free-tier daily allowance; it is a number only, with no content attached.

5. Subscription & Payment Processing

An account is optional. If created, the email address and a hashed password are held by Appwrite Cloud (sfo.cloud.appwrite.io). Sign in with Google is also offered.

Subscription payments are taken on Dodo Payments' own hosted checkout page (checkout.dodopayments.com). The extension never sees card or billing details. Subscription management uses customer.dodopayments.com.

6. Local Storage

chrome.storage.local and chrome.storage.sync hold your preferences only:

  • Selected AI provider, provider order and which providers are hidden from the switcher
  • Per-provider voice choice, speech rate, reply tone and persona
  • Reply language, response length, context length (4,000 / 8,000 / 12,000 / 15,000 characters)
  • Custom system prompt and saved prompt templates
  • Follow-up suggestion settings including your own custom suggestions
  • Theme preference
  • Whether page context is enabled, whether chat history is enabled
  • Chat history itself (when that setting is on)

Nothing stored here is transmitted to a developer-owned server. Settings can be exported to a JSON file and imported again from Settings, and everything above can be cleared from the same screen.

Usage Cookie (hg_usage)

A daily reply count is kept, mirrored in a cookie named hg_usage on the four AI provider domains (chatgpt.com, grok.com, gemini.google.com, pi.ai), so the free-tier daily allowance survives a reinstall of the extension (since chrome.storage is wiped on uninstall). It stores a date and a number — no content, no identifiers.

7. External Resources

The Inter and Newsreader typefaces are fetched from Google Fonts (fonts.googleapis.com, fonts.gstatic.com) when the panel opens, which means Google receives the request. These are CSS and font files only — no executable code, and no user data is sent.

All icons, logos and images are packaged locally inside the extension.

8. Local File Access

The extension requests access to file:/// URLs so a PDF opened from your own disk can be read and its text extracted locally, exactly as an online PDF is. This has no effect unless you separately switch on "Allow access to file URLs" in chrome://extensions. Users who do not enable it can still attach the same file with the paperclip button, which needs no permission at all. Files are read locally and never uploaded anywhere.

9. Chrome Permissions Justification

Hey Genie requests the following browser permissions to function:

sidePanel

Displays the entire interface alongside the page you are reading — the answer appears next to the source instead of in a separate window. The panel holds the chat transcript, the question composer with voice input and file attachment, the AI provider switcher, the connection and usage status card, chat history, and all settings.

scripting

Used to inject the extension's own content script (content.js) into the active tab on demand, in the one case where the declared content script is not already present — for example a tab that was already open before the extension was installed or updated. Only content.js, which ships inside the extension package, is injected. No code is generated at runtime.

storage

Used to save your own preferences and conversations on your device. Nothing stored here is transmitted to a developer-owned server. In chrome.storage.local: selected AI provider, provider order, voice choices, speech rate, reply tone, reply language, response length, context length, custom system prompt, saved prompt templates, follow-up suggestion settings, theme, and chat history. In chrome.storage.sync: the daily reply count.

declarativeNetRequest

Used only for dynamic session rules created at runtime. When the extension sends your question to chatgpt.com, grok.com or gemini.google.com, it must issue that request the way those services' own web clients do. Session rules set headers like Origin, Referer, Sec-Fetch-Site, and provider-specific headers for the duration of the request. Each rule is scoped to a single provider's URL pattern, added immediately before the request, and removed immediately afterwards. Rules are never applied to any other website.

cookies

1. Reading AI provider session cookies: The extension reads the existing session cookies for chatgpt.com, grok.com, gemini.google.com and pi.ai so it can send your question using your existing login. Cookies are read, used to authenticate that one request, and discarded. They are never modified, never stored by the extension, and never transmitted to any developer-owned server.

2. Writing one usage cookie: A cookie named hg_usage on those same four domains holds today's date and the number of replies generated today — nothing else. Its only job is to make the free-tier daily allowance survive a reinstall. No cookies belonging to any other website are read, written or inspected.

offscreen

Used to create a single offscreen document that provides the DOM context the service worker does not have. Its only job is to compute the SHA3-512 proof-of-work token that ChatGPT's web client is required to attach to a conversation request. The offscreen document renders nothing the user can see, holds no user data, is created on demand only when a request to ChatGPT is being prepared, and makes no network requests of its own.

contextMenus

Adds three right-click menu items: "Ask AI about the selected text" (appears when text is selected), "Summarize the selected text" (appears when text is selected), and "Ask AI about this page" (appears on any page). Text is captured only from the selection you made when you chose the menu item. No menu item reads anything on its own.

Host Permissions

The extension requires permission to access these specific domains:

  • https://*/* & http://*/* — To read page content from any website you choose to ask questions about. The content script extracts only the visible text plus the page's title and URL, and only at the moment you ask a question.
  • chatgpt.com — To send requests to ChatGPT's conversation and text-to-speech endpoints using your own session.
  • gemini.google.com — To send requests to Gemini using your own session.
  • grok.com — To send requests to Grok's conversation and text-to-speech endpoints using your own session.
  • pi.ai — To send requests to Pi's conversation and text-to-speech endpoints using your own session.
  • file:///* — To read a PDF opened from your own disk. Only works if you separately enable "Allow access to file URLs" in chrome://extensions.
  • sfo.cloud.appwrite.io — Authentication backend for account creation, sign in, sign out, password reset, and subscription status check. Page content, questions and AI replies are never sent here.
  • checkout.dodopayments.com & customer.dodopayments.com — Opened in a browser tab for subscription checkout and management. The extension never sees payment details.
  • fonts.googleapis.com & fonts.gstatic.com — The Inter and Newsreader typefaces. Stylesheet and font files only.

10. Data Sharing

Hey Genie does NOT:

  • Sell or transfer user data to third parties, outside of the approved use cases
  • Use or transfer user data for purposes unrelated to the extension's single purpose
  • Use or transfer user data to determine creditworthiness or for lending purposes
  • Build user profiles or use data for behavioral targeting

11. Your Controls

You have full control over your data. From within the extension's Settings:

  • Turn off page reading (disable page context)
  • Turn off voice input
  • Turn off chat history
  • Turn off follow-up suggestions
  • Export all settings to a JSON file, or import them
  • Clear all locally stored data
  • Delete your account

Uninstalling the extension permanently clears all local storage. The hg_usage cookie on provider domains can be cleared manually from your browser's cookie settings.

12. Security

All communication with Appwrite authentication services and DodoPayments endpoints uses industry-standard HTTPS encryption. The extension operates under a strict Content Security Policy (CSP). Every executable file ships inside the extension package — no remote code is loaded or executed. The extension contains no eval(), no new Function(), no remote importScripts(), and no <script src> pointing at an external URL.

13. Children's Privacy

Hey Genie is not designed for children under 13. We do not knowingly collect or store any information from children.

14. Changes to This Policy

We may update this privacy policy occasionally. Updated terms will be marked by the new "Last updated" date at the top of this page. Continued use of the extension constitutes acceptance of the updated terms.

15. Contact

For any questions or support queries regarding this Privacy Policy, please contact us at: contact@heygenie.live