Privacy Policy

Last updated: July 25, 2026

What data Refract handles

AI provider credentials (API key)

You supply an API key for the AI provider of your choice. The key is stored locally on your device using chrome.storage.local and is sent only to that provider, only to authenticate the requests you trigger. It is never transmitted anywhere else.

Selected images and website content

When you explicitly pick an image on a webpage (via the picker or the right-click menu), Refract captures that image region and sends it to the AI provider you configured, solely to generate the prompt text. If you save an optional Personalization profile, your subject photo and direction text are stored locally and included in those provider requests for the same purpose.

What Refract does not do

• No collection of browsing history, clicks, or usage analytics.
• No data is sold, shared with, or transferred to any third party other than the AI provider you yourself configured.
• No data is used for advertising, profiling, creditworthiness, or lending.
• Nothing runs in the background: images are captured only in response to your explicit action.

Data retention and control

All settings — provider configuration, API key, prompt mode, and the Personalization profile — live in your browser's local extension storage. Captured images are held transiently in session storage and discarded when consumed. Removing the extension deletes all of this data. You can also clear the Personalization profile at any time from the extension's settings.

Requests sent to your chosen AI provider are governed by that provider's own privacy policy and terms.

Changes to this policy

If this policy changes, the updated version will be published at this address with a new "Last updated" date.

Contact

Questions about this policy: open an issue at github.com/zjywill/refract or email [email protected].