Privacy Policy
Last updated: November 2026
Key points
- We only collect personal information you choose to provide, such as your email when signing up.
- When you use our browser extension, we extract webpage content strictly upon your action to generate summaries and citations. We never track or record your general browsing history.
- If you provide your own AI provider API keys (Google Gemini, Anthropic Claude, or Groq), your keys are strongly encrypted using AES/Fernet encryption before storage to allow cross-device sync. They are never stored in plaintext, never shared, and never used for model training.
- We do not sell, rent, or trade your personal data or research library to third parties or data brokers.
- All data is processed strictly in accordance with GDPR, CCPA, and Google Chrome Web Store Developer Policies.
1. What information do we collect?
Personal information you disclose to us: We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, join our early-access waitlist, or contact customer support.
Account Identifiers: When creating an account or logging in via Google OAuth2, we receive your email address, display name, and authentication tokens.
Website Content (User-Initiated): When you use the Chiko AI browser extension or web app to summarize a webpage, inspect a PDF, or snip a chart figure, our system processes the text and media of that active document solely to produce the requested summary, data table, and source citations. We do not monitor or log background browsing activity.
Bring-Your-Own-Key (BYOK) Data: Users may enter their own third-party AI model API keys (Google Gemini, Anthropic Claude, or Groq). To allow you to access your personal keys across your devices, keys are stored encrypted at rest using industry-standard Fernet/AES symmetric encryption linked to your authenticated account. Plaintext keys are never logged or exposed in API responses.
2. How do we process your information?
We process your information to deliver, improve, and administer our Services, communicate with you, ensure system security and fraud prevention, and comply with law.
Specifically, we use your data to generate source-grounded summaries, anchor Q&A responses to exact document citations, sync saved research libraries across your devices, and process account subscription tiers.
3. What legal bases do we rely on?
If you are located in the EU or UK, the GDPR and UK GDPR require us to explain the legal bases we rely on. We process your data based on Performance of a Contract (to deliver the Services you requested), Consent (when you opt in), Legitimate Interests (to secure our platform against abuse), and Legal Obligations.
4. When and with whom do we share your personal information?
We do not sell your personal data. We only share information with trusted infrastructure vendors who perform services on our behalf under written data processing agreements.
Our service categories include: Cloud Hosting (Scaleway, Render, Vercel), Database & Authentication (Supabase, Google OAuth2), Payment Processing (Paystack), and Transactional Email (Namecheap Private Email / SMTP).
5. Chrome Web Store single purpose & permissions
Single Purpose: Chiko AI serves one narrow, well-defined purpose: to generate verifiable, source-grounded webpage summaries and interactive side-panel research anchored to exact page citations.
Permissions Justification: We request storage (for local preferences and encrypted BYOK keys), tabs and activeTab (to detect current tab URL/title upon click), sidePanel (to show research tools without obstructing content), scripting (to extract text on demand and highlight verified quotes), and identity (for optional Google sign-in).
No Remote Code: All extension code is packaged locally in accordance with Manifest V3 policies. We do not load or evaluate remote scripts.
6. How long do we keep your data and how is it secured?
We retain personal information only as long as necessary to fulfill the purposes set out in this notice or as required by law. You can delete individual documents or request complete account deletion at any time.
We use organizational and technical measures including HTTPS encryption in transit, cryptographic hashing for tokens, and encrypted local storage for client-side API credentials.
7. What are your privacy rights?
Under GDPR, CCPA, and global privacy standards, you have the right to access, correct, export, or delete your personal data. You may also object to or restrict certain processing activities.
To exercise any of these rights, email us at privacy@chikoai.com. We respond to all verified requests promptly.
8. Contact us
If you have questions or concerns about this privacy notice, you can contact our privacy team at privacy@chikoai.com or general support at support@chikoai.com.