TermPilot Privacy Policy

Data stored on your device

TermPilot uses chrome.storage.local to store primary and fallback API keys, model names and endpoints, translation preferences, theme and feature settings, glossary entries, annotation records, and floating button position.

Chrome extension storage is local browser storage. It is not an encrypted password vault, so you should use provider keys with appropriate limits.

BYOK direct mode and official Credits

In BYOK direct mode, the extension Service Worker sends the request directly to the provider endpoint you selected. The API key is placed in that provider request Authorization header and is never sent to or through https://api.termpilot.top.

Depending on the action, the provider request can contain selected or extracted webpage text, your question, translation direction, domain settings, style settings, and matching glossary terms. Consistency checks, polishing, and long-document synthesis can send current model output back to the same provider for revision.

When you use official Credits, the same task content is sent over HTTPS to https://api.termpilot.top, which forwards it to the official model provider using a TermPilot-managed API key. TermPilot processes the task content and model response transiently to return the result and does not persist them as prompt or response content.

The model provider handles request content under its own terms and privacy policy. The current default official model provider is DeepSeek (deepseek-flash); TermPilot may change the official provider to keep the service reliable. TermPilot stores the account entitlement, signed-in vocabulary synchronization data, and bounded usage metadata described below. When you save a vocabulary entry, that synchronization data can include its bounded source context and sanitized source URL; other page or selected text used for a task is not persisted by TermPilot.

Account authentication and device identifiers

When you sign in, the extension stores account access and refresh tokens in chrome.storage.local. The access token is sent in the Authorization header only to https://api.termpilot.top for account, entitlement, official Credits, cloud-sync, and vocabulary requests. The refresh token is sent only to refresh the session. TermPilot stores token hashes rather than the raw tokens.

The extension also creates a stable random installation identifier in chrome.storage.local and sends it to https://api.termpilot.top with account, Credits, and sync requests. It is used to limit duplicate Credits grants and distinguish sync writers. It is not included in analytics or used for advertising; TermPilot can retain a one-way claim hash for entitlement enforcement and the identifier as account-linked sync mutation metadata.

When you sign in on the website, the website creates a separate random device identifier in browser local storage and sends it to https://api.termpilot.top with account and entitlement requests. It is used only to grant the free sign-in Credits once per device, and TermPilot stores its one-way claim hash rather than the identifier itself.

To limit free-Credits abuse, TermPilot also stores a daily HMAC hash of the connection IP with a grant count. It cannot be reversed to the raw IP and is deleted after the Beijing calendar day ends.

When you sign in on the website, TermPilot sets an HttpOnly session cookie on the API host so the browser can stay signed in. The extension uses bearer tokens in chrome.storage.local instead of that website cookie.

Google sign-in uses Google OAuth. Google receives the authentication request under its own terms and privacy policy; TermPilot receives the account email (or an equivalent verified identity claim) needed to create or restore your TermPilot account.

Email verification codes and support reply notifications are sent through Resend, which processes the destination email address and message content needed to deliver the email under its own terms and privacy policy.

Membership payments

Membership checkout happens on the TermPilot website. Payments are processed by Paddle.com Market Ltd. as merchant of record. TermPilot does not collect or store card numbers, bank details, or other raw payment credentials.

Paddle can receive payment details, billing email, tax location, and transaction records under its own terms and privacy policy. When a checkout is created, TermPilot sends an internal checkout reference together with the internal account and plan identifiers to Paddle to attribute the subscription. TermPilot stores only Paddle customer, subscription, and transaction identifiers, an internal checkout reference, membership plan, billing-period timestamps, webhook event identifiers, and membership Credits ledger entries needed to provide the subscription.

Unused membership Credits expire at the start of the next membership month. Sign-in Credits are separate and are not removed when a membership period refreshes.

Local exports and annotations

PDF and vocabulary CSV exports are generated by your browser from the current result and are not uploaded to TermPilot.

Annotation records are kept in local extension storage for up to 48 hours so the extension can restore your notes on the page, after which they expire locally.

Extension analytics

The extension can send metadata events to https://api.termpilot.top/analytics for AI task and official-trial lifecycle events (starts, completions, failures, exhaustion, and trial login/configuration), button and panel interactions, settings, model setup and API-key test interactions, assistant and selection actions, exports, annotation saves and deletions, glossary actions, vocabulary learning/library/import/export/capacity actions, authentication and account sync. When you start a full-page translation, the extension processes the top-level document and accessible same-origin child frames as one user-initiated task. Cross-origin embedded frames are not included automatically and are processed only when you directly invoke an action within or targeting that frame.

Each event is limited to aggregate metadata without user identifiers: event and action type, page or selection scope, export format, success or failure, coarse error code, model name, provider hostname, translation direction, source and target language, professional domain, character count, segment count, glossary count, request duration, batch count, extension version, browser locale, content region, character-count bucket, and country/region or Cloudflare data-center code derived by Cloudflare.

To estimate daily active browser profiles, eligible events include a fresh random signal each UTC day. The server stores only its one-way hash for that day and cannot link it across days.

These analytics do not contain API keys, webpage text, selected text, translations, questions, glossary terms or notes, generated notes, vocabulary lists, full webpage URLs, account IDs, emails, or persistent local client identifiers.

Website analytics

When you view the TermPilot website, use its vocabulary workspace, or click a Chrome Web Store link, it can send aggregate page-view, vocabulary-activity, or store-CTA click events to https://api.termpilot.top/site-analytics.

Each event is limited to page key, event placement, interface locale, coarse referrer category, allow-listed UTM summary, and country or region derived by Cloudflare. Referrer categories are limited to direct, search, social, other, or unknown.

Website analytics does not store raw IP addresses, cookies, persistent website identifiers, full URLs, full referrers, referrer query strings, User-Agent strings, or extension analytics identifiers. The device identifier described above is used only for the Credits grant and is never attached to analytics events.

Chrome Web Store Limited Use

TermPilot's use and transfer of information received from Chrome APIs complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

The data is used only to provide or improve user-facing extension features and is not sold, used for advertising, or used to determine creditworthiness or lending purposes.

Retention

Local settings remain until you change them, clear extension data, or uninstall TermPilot.

TermPilot retains extension and website analytics metadata without user identifiers for up to 90 days, after which it is automatically deleted.

Verified account data, including your email, account record, entitlement and credit data, and encrypted cloud sync data such as synced settings and terms, remains while the account remains active. These account records do not currently have an automatic expiration.

Active vocabulary entries remain until you delete them or request account deletion. Deleted vocabulary entries may remain for up to 1 year, and removal records for up to 2 years for sync consistency; support conversations may remain for up to 1 year. Expired, used, or revoked authentication token audit records are cleaned no later than 30 days after creation, and unverified accounts are cleaned after 24 hours.

Signing out only revokes active web and extension sessions; it does not delete your account or cloud data.

Open Account and choose “Delete my account”, then enter your account email to schedule deletion. Your account and cloud data are permanently deleted at the scheduled time shown in Account, after at least a 7-day grace period. If paid access ends later, deletion waits until that access expires. You can cancel from Account before the scheduled deletion. Local extension data stays on your device until you clear it or uninstall TermPilot. If you cannot access your account, email xiexuanzheng602@gmail.com from your account email, state that you want the TermPilot account and all cloud data deleted, and complete ownership verification. We process these requests manually; limited records may be retained only where required for security or legal obligations and then deleted under the applicable retention period.

Your privacy rights

Depending on context and applicable law, personal data is processed on the basis of contract, legal obligations, legitimate interests, or consent where required. Legitimate interests include service security, fraud prevention, and reliability. You may withdraw consent at any time without affecting earlier lawful processing.

Subject to applicable law, you may request access, copy, correction, deletion, portability, restriction or objection to processing, and an explanation of our processing rules.

Send a request from your account email to xiexuanzheng602@gmail.com and state the right you want to exercise. We may verify account ownership before responding. You may also complain to the competent data protection or consumer authority in your place of residence.

Children

The service is intended for users aged 16 and above. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has created an account, contact us so we can delete it.

Operator

TermPilot is operated by an independent service provider reachable at xiexuanzheng602@gmail.com.

Contact

For privacy questions, contact xiexuanzheng602@gmail.com.