Last updated: 2026-09-29 · Applies to version 1.0.0
AIPresso does not collect your information.
This extension has no server. There is no account, no sign-in, and no payment. Nothing reaches any computer operated by the developer.
Summarizing happens in your own browser. The text goes directly to the AI provider you chose — or, if you use Chrome’s built-in AI, it never leaves your computer at all.
To summarize a page, the text has to be shown to an AI. You choose which AI. Where the text goes depends on that choice.
| Your choice | Where the text goes | Leaves your computer? |
|---|---|---|
| Chrome built-in AI (Gemini Nano) | Nowhere. Processed inside the browser | No |
| Anthropic Claude (API) | https://api.anthropic.com/v1/messages |
Yes |
| OpenAI (API) | https://api.openai.com/v1/chat/completions |
Yes |
| Google Gemini (API) | https://generativelanguage.googleapis.com/v1beta/... |
Yes |
| Command-line tools (CLI bridge) | The claude / codex / gemini command installed on your computer sends it to that vendor |
Yes |
What is sent is the text to summarize (YouTube captions or web page body) and the summarizing instructions. Nothing else — not your name, not your email, not your browsing history, not the contents of other tabs.
No developer server sits in the middle. Your browser talks to that provider directly.
⚠️ What the provider does with the text afterwards is governed by their policy. AIPresso has no control over that. Please read theirs:
For sensitive pages, use the Chrome built-in AI. That is the only option where nothing travels over the internet.
This route calls an AI command-line tool that is already installed on your computer. A browser extension cannot run programs directly, so a small bridge program sits in between. That bridge also runs entirely on your computer — it sends nothing to the developer.
The text is sent to the vendor by that command-line tool, using your own account there.
Summarizing a YouTube video requires its captions. The extension requests them directly from
YouTube (https://www.youtube.com/youtubei/v1/next, and the caption URL that response points to).
Your browser makes that request. It does not pass through any developer server, and the developer cannot know which videos you watched.
The extension attaches an Origin: https://www.youtube.com header to that request, because
YouTube will not return captions without it. That header rule applies to that one URL only
(see rules.json).
When you right-click a link and summarize it, the extension fetches that page itself and extracts only the body text.
An API key you enter is stored only inside your browser (chrome.storage.local).
It is never transmitted to the developer, and it is not synced to your other devices.
It is encrypted at rest using the browser’s built-in standard cryptography (Web Crypto, AES-GCM, 256-bit). There are two locking modes; you pick one in settings.
| Mode | Where the unlocking key lives |
|---|---|
| Automatic lock | A key generated by the extension, stored alongside your settings. No password to type |
| Password lock | The key is never written to disk. It is derived from your password each time (PBKDF2, 310,000 iterations). While unlocked it lives in chrome.storage.session — memory only, gone when the browser closes |
The character count of a stored key is kept separately. That is what lets the settings screen show a masked field so you can see a key is present even while it is locked. A length alone cannot reconstruct a key.
Your key goes only to the provider you chose. It is attached as an authentication header on requests to that provider’s address, and nowhere else.
All of it lives in chrome.storage.local — inside your browser. There is no server-side copy.
| Stored item | What it holds | How much | How to remove it |
|---|---|---|---|
| Settings | Chosen AI, language, theme, summary style, encrypted API keys | One record | Uninstall the extension |
| Summary cache | Summary text, page URL, which AI and language made it | Latest 50 · auto-deleted after 7 days | Clear it in settings |
| Recent summaries | URL and title of pages you summarized | Latest 10 | Clear it in the popup |
| Tucked summaries | URL, title and text of summaries tucked into the toolbar icon | Latest 5 | Remove them in the popup |
| Last attempt record | Elapsed seconds and character count. No page text is kept | One record | Overwritten by the next run |
| Built-in model download progress | Percentage downloaded | One record | Disappears once the download finishes |
| Problem log | Raw error text from failures (see section 6) | Latest 30 · 2,000 characters each | Clear it in settings |
| Unlocked key | The unlocked state of a password lock | One record · memory only | Gone when the browser closes |
Uninstalling the extension removes all of the above. No copy remains with the developer.
When a summary fails, the raw error text from the tool or server is recorded. “Summarizing failed” alone tells nobody what went wrong. You can copy the whole log from the settings screen — it exists so you can paste it instead of sending a screenshot.
Because it is built to be copied and shared, key-shaped strings are stripped before it is written. Specifically:
sk-, pk-, api…, key…, token…, or bearer… followed by 16 or more charactersAIzaauthorization:, x-api-key:, and x-goog-api-key: headersEach match is replaced with [redacted].
⚠️ This filtering is not perfect. A secret that does not match those shapes can survive, and raw error text sometimes contains fragments of the page being summarized. Read the log before sending it to anyone.
| Permission | What it is used for |
|---|---|
storage |
Keeping the settings and records in section 5 in this browser |
activeTab |
Reading the text of the one tab you are looking at |
scripting |
Showing the summary card on that page |
contextMenus |
Adding “Summarize” to the right-click menu |
declarativeNetRequestWithHostAccess |
Attaching the Origin header to YouTube caption requests (section 2) |
nativeMessaging |
Talking to the command-line bridge program (section 1) |
The bridge installer is not bundled in the extension. When you click “Get installer”, the extension simply opens this project’s public GitHub Releases page in a new tab.
Site access granted at install time
https://*.youtube.com/* (captions) · https://api.anthropic.com/* · https://api.openai.com/* ·
https://generativelanguage.googleapis.com/* (summary requests)
Site access requested only when needed
http://*/*, https://*/* — asked by the browser only when you right-click a link to summarize
it (section 3). It is not requested at install time.
The first time you use Chrome’s built-in AI (Gemini Nano), Chrome downloads the model. It is roughly 4GB.
OptGuideOnDeviceModel). The extension can neither read nor delete that folder.chrome://components or chrome://on-device-internals.None.
There is no analytics library, no tracking pixel, and no advertising in this extension. It contains no code that connects anywhere other than the addresses listed in sections 1–3.
Your information is never sold or shared — the developer holds none of it to begin with.
This extension does not ask for your age and does not collect personal information. Consequently it does not knowingly collect or process any child’s personal information.
This document will be updated and the “Last updated” date at the top changed. If something material changes — for example if more data starts being sent — it will also be stated in the extension’s update notes.
If you have any questions, please reach out at pickypickyworks@gmail.com.