AI Summary Helper
Privacy Policy
Your API keys, article history, and highlights stay on your device. Page content is only ever sent to the AI provider you choose — including a fully local model, if that's what you pick.
Last updated: October 2026
This Privacy Policy explains what data AI Summary Helper handles, where it goes, and why. The short version: your API keys, your article history, and your highlights stay on your device. Page content is only ever sent to the AI provider you choose to connect — including, if you choose it, a fully local model where nothing leaves your machine at all. We do not run ads, do not sell data, and do not require an account for any core feature.
If you disagree with any part of this policy, please do not install or use the extension.
Who is responsible
The controller within the meaning of Art. 4(7) GDPR is Phil Wornath. The full name and address for service are in the legal notice; you can reach us at the contact details at the end of this policy.
No Account Required for Core Features
AI Summary Helper does not require you to create an account, sign in, or provide any personal information to summarize pages, highlight, follow feeds, or keep your archive. Your API key (if you use your own) and your entire article history live in your browser's local storage.
An account is only needed for the hosted services: byphil Cloud (summaries without your own key) and Send to Kindle. Signing in works with your email address and a one-time code. We store that email address, your plan or license status and basic usage counters (for example the number of requests and Kindle sends) so we can apply plan limits.
What Data We Handle, and Where It Goes
Your AI provider connection
You choose how summaries are generated:
- Bring your own key (BYOK) — OpenAI, Google Gemini, Mistral AI, DeepSeek, or a custom endpoint. Your API key is stored locally on your device only (never synced, never sent to us). Page content you choose to summarize is sent directly from your browser to the provider you selected, using your own key and subject to that provider's own privacy policy. We do not see, log, or store this content.
- Local model via Ollama — if you run a model locally, page content is sent only to your own machine. Nothing leaves your device.
- byphil Cloud (optional, paid) — a hosted option for people who'd rather not manage an API key. If you choose this tier, the text you ask to summarize passes through our backend, which relays the request via OpenRouter to an underlying model provider on your behalf and returns the summary. It is only relayed: we do not store page content, URLs or summaries. What we record per account is usage metadata: the number of completed requests, token usage, the time of the last request and the model used. The account itself is optional; all other features work without one.
License and subscription status
If you activate a Pro license or byphil Cloud subscription, your license key is stored locally on your device (never synced) and used to verify subscription status with our backend. Basic account/billing metadata is handled by our payment processor and backend; we do not store your page content or reading history on our servers.
Uninstall feedback
When you uninstall the extension, Chrome opens a short feedback page on this website. The address contains only the extension version and the number of days it was installed — no identifiers, no page content, no history. What you choose or type in the form (a reason, an optional comment) is recorded as an event in our self-hosted, cookieless analytics, together with the extension version and the days installed, and is only used to improve the extension. If your browser sends Do Not Track or you opted out of analytics, nothing is sent. There is no email field; for a reply, open a GitHub issue. You can close the page without answering.
Article history, highlights, and settings
Everything you save is stored locally in your browser, using Chrome's built-in storage APIs — never on our servers:
| Data | Storage | Synced via Chrome? |
|---|---|---|
| Saved articles & summaries | Local | No |
| RSS feed subscriptions & items | Local | No |
| API keys / provider config | Local | No — sensitive, device-only |
| License key | Local | No — sensitive, device-only |
| LocalSend network IP | Local | No |
| Text highlights & AI ghost highlights | Local (per page) | No |
| Default prompt, language, summary length | Sync | Yes, via your own Chrome account |
| Highlighting on/off preference | Sync | Yes, via your own Chrome account |
Items marked "Sync" use Chrome's own built-in sync tied to your Google account — this data passes through Google's infrastructure, not ours, exactly like your bookmarks would. We have no separate access to it.
You can export your data at any time via Settings → Library & Data → Backup & restore. Backups omit API keys, sign-in details, license keys, and install identifiers by default; including them is an explicit opt-in with a warning because anyone with that file can use them. Keep exported files private, and remember that older backups may contain secrets. In the same place, the Danger zone lets you delete, by category and with a count of what will go: summaries and archive, highlights, feeds, podcasts, API keys / sign-in / license, send targets (Kindle, LocalSend) and preferences. Delete all data removes everything the extension stores on the device and starts it fresh. Removing the extension also removes its data. These actions delete local data only. Your account and the records we hold on our server (see below) you manage at byphil.eu/#account: there you can export your data and delete your account. The extension and the Android app link to it from the account settings.
RSS feeds
The built-in Feeds reader stores your subscriptions and the fetched feed items locally in your browser — never synced, never sent to us. When you add or refresh a feed, the extension requests that feed's address directly from the publisher's server, just like your browser would when visiting the site, so the publisher can see the request. We do not proxy, log, or see your subscriptions or reading list. OPML import is processed entirely on your device. If you turn on background checks (off by default), the extension re-requests your feeds on the interval you choose, only to show a count on the toolbar icon. Summarizing a feed item works like summarizing any other page: its content is only sent to the AI provider you chose, and only when you trigger a summary. The optional AI day recap and AI tone scoring work the same way: only when you click them, the extension sends item titles, source names and short snippets (not full articles) to the AI provider you chose, and the resulting recap is cached on your device. Podcast episodes in a feed are streamed directly from the publisher's server when you press Play.
Sending articles: Kindle, LocalSend, and the share sheet
There are two different paths, and only one of them touches our server:
- Send to Kindle goes through our server. Amazon only accepts documents by email from approved senders, so the extension sends the article (title, summary, text, highlights and source address) to the byphil backend, which emails it to the Kindle address you entered. You add our sender address (kindle@byphil.eu) to your approved senders list in your Amazon account. The content is used only to create and send that email. Kindle delivery requires being signed in or having a license; the free tier includes 3 sends.
- LocalSend and the system share sheet (for example AirDrop) are direct. The file goes from your browser straight to the device you picked on your local network, or to the app you chose in the share sheet. We are not involved and do not see or store this content. LocalSend works with phones, tablets, computers and e-readers that run a compatible app.
Analytics & cookies
Short version: this website sets no cookies and uses no advertising or cross-site trackers. We count anonymous visits with a self-hosted Matomo instance, and you can switch that off at any time.
The browser extension itself contains no analytics, telemetry or tracking code. Its only network requests go to the AI provider you configured, the feeds you subscribed to, the pages you ask it to fetch, and (if you use them) the byphil backend for byphil Cloud, sign-in, license checks and Send to Kindle.
What we measure
Page views, the page language, referrer, approximate country/browser/device class, and which parts of the site you interact with (for example clicks on "Add to Chrome", the pricing toggle, FAQ items, sections you scroll to, and steps of the bookmarklet generator). Events never contain e-mail addresses, API keys, one-time codes, page content or article data.
How it is configured
Matomo runs on our own server (analytics.philwornath.de, Germany), not at a third party. It is loaded with cookies disabled and without browser-feature fingerprinting; IP addresses are anonymised before storage; no user ID or cross-site identifier is assigned, so visits cannot be linked across days or devices. Data is not sold or shared with third parties.
Because nothing is stored on or read from your device for tracking purposes, this measurement is based on our legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR) and does not require a cookie consent banner under § 25 TDDDG / the ePrivacy Directive. You have the right to object (Art. 21 GDPR) at any time.
Your choices
Analytics is switched off automatically if your browser sends Do Not Track or Global Privacy Control. You can also opt out manually via Analytics settings (also in the footer of every page).
What is stored in your browser
Only functional preferences, never for tracking: aish_analytics (your opt-out choice), aish_analytics_notice (that you dismissed the info notice), and, if used, the theme choice, the language-suggestion dismissal and the bookmarklet generator settings. These stay on your device and are not sent to us.
Fonts & external resources
Fonts (Inter, Space Grotesk, JetBrains Mono; SIL Open Font License) are served from this site itself, so your IP address is not passed to Google or any font provider just by visiting. The only external requests are links you click, and the optional byPhil account / Stripe checkout pages you choose to open.
Legal bases and retention
Almost everything is processed on your device and never reaches us. Where we do process data, this is the basis and how long we keep it:
- Account and sign-in (email address, one-time code, license key, plan status) — to provide the account you asked for, Art. 6(1)(b) GDPR. Kept as long as the account exists; when you delete the account it is deleted.
- byphil Cloud (relaying the text you summarize, usage counters, token usage, last request, last model) — to perform the service, Art. 6(1)(b). The text is only relayed and not stored. The usage metadata is kept as long as the account exists and deleted with it.
- Send to Kindle (the article you send, your Kindle address) — to perform the sending you trigger, Art. 6(1)(b). Used only to create and send that email.
- Payments and license verification — to perform the contract and meet accounting duties, Art. 6(1)(b) and (c). Billing records are kept as long as the law requires.
- Website analytics and uninstall feedback — our legitimate interest in improving the site and the extension, Art. 6(1)(f). The data is anonymous (see Analytics & cookies).
You can export your account data and delete your account at any time at byphil.eu/#account. Deleting the account deletes the data stored for it.
Permissions We Request, and Why
| Permission | Why we need it |
|---|---|
activeTab | Read the content of the page you actively choose to summarize |
storage | Save your settings, article history, and highlights locally |
contextMenus | Provide right-click actions (Summarize, Highlight, etc.) |
notifications | Show timed reminders for articles you've saved for later |
alarms | Schedule those reminder notifications |
tabs | Close the tab automatically after "Summarize & Close" |
sidePanel | Support Chrome's native side panel as a viewing option |
scripting | Inject the content script needed to read and summarize a page |
offscreen, tts | Play podcast audio and read summaries aloud in the background while the popup is closed |
unlimitedStorage | Keep a large local archive of articles and highlights without hitting the default storage quota |
host_permissions (<all_urls>) | Let you summarize any page you visit — content is only read and transmitted when you actively trigger a summary, never passively |
We do not use these permissions to track your browsing, build an advertising profile, or collect data beyond providing the features described above.
What We Don't Do
- We don't run or serve ads, and we don't sell, rent, or trade your data to advertisers or data brokers.
- We don't require an account or sign-in for any core feature.
- We don't log or retain the content of pages you summarize via your own API key or a local model, and we never see what you send over LocalSend or the share sheet.
- We don't have access to your locally stored article history, highlights, or API keys — they never leave your device unless you explicitly export them.
Third-Party Services
Depending on how you configure the extension, your page content may be sent to:
- OpenAI, Google (Gemini), Mistral AI, or DeepSeek — only if you've entered your own API key for that provider, and only for the page you actively summarize.
- Our byphil backend, hosted by IONOS SE in Germany — only if you sign in, use byphil Cloud or Send to Kindle.
- OpenRouter, through which byphil Cloud connects to the models, and the model provider it routes to — the text you summarize is relayed to the model you use, for that request only.
- Stripe — payments and subscription management, as Merchant of Record.
- Amazon — if you send an article to your Kindle, Amazon delivers it under its own privacy terms.
- Your own local Ollama instance — not a third party; stays on your machine.
We are not responsible for the privacy practices of third-party AI providers you choose to connect. We encourage you to review their policies before connecting an account.
You decide which model processes your text. Whether you use your own key or byphil Cloud, you choose the provider and model in the settings, and you are responsible for checking that provider's terms and where it processes data. OpenRouter, the model providers behind it and Amazon may process data outside the EU/EEA under their own safeguards (for example standard contractual clauses); we do not transfer your data to third countries ourselves.
Data Security
We use reasonable technical measures appropriate to the data involved — most of which never reaches our servers in the first place, since it's stored locally in your browser. Communication with our backend (for byphil Cloud and license verification) is encrypted in transit. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we do not collect more than what's needed to provide the described features.
Children's Privacy
AI Summary Helper is not directed at children under 13 (or the relevant minimum age in your jurisdiction), and we do not knowingly collect personal information from children.
Your Rights (GDPR / CCPA and similar)
Since almost all of your data is stored locally on your own device, you already have direct control over it — you can view, export, or delete it at any time via the extension's Settings, or by uninstalling the extension. For any data we do hold on our servers (byphil Cloud subscription/billing metadata), you can manage and export it, and delete your account, at byphil.eu/#account, or contact us below.
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), and to withdraw consent at any time. You also have the right to lodge a complaint with a supervisory authority (Art. 77), in particular in the member state of your residence. We do not use your data for automated decisions with legal effect or for profiling.
Changes to This Policy
We may update this Privacy Policy as the extension's features change. Material changes will be reflected here with an updated "Last updated" date. Continued use of the extension after a change constitutes acceptance of the updated policy.
Contact Us
Questions about this Privacy Policy? Contact us at info@byphil.eu, or via GitHub Issues.