← Back to home

Privacy Policy

Last updated: February 3, 2026

1. Responsible Entity

Responsible for data processing on this website and within the browser extension is:
Jasper Schmidt
Email: hello@hyphos.app

2. Data Collection and AI Processing

hyphOS provides AI-supported analysis of web content. Data is processed as follows:

• Data Extraction: The extension captures text content from websites visited by the user only when an analysis function (e.g., "Summarize") is actively triggered.
• Central API Access: To generate analyses, extracted texts are transmitted to our server and forwarded to the Google Gemini API (Google Ireland Limited).
• Purpose: The transmission serves exclusively to provide the contracted analysis service. We do not permanently store the transmitted source texts on our servers unless explicitly requested by the user for a function (e.g., saving a memo).

Legal basis: Art. 6 (1) (b) GDPR (Performance of a contract).

2.1 Extension-Specific Data Processing

Local Data Collection

The hyphOS browser extension collects and processes the following data locally in your browser:

Browsing History (Research Graph)

• Visited URLs, page titles, and favicons
• Visit timestamps
• Navigation type (link click vs. manual entry)
• Purpose: Visualization of your research journey
• Storage location: Locally in your browser (chrome.storage.local)
• Transmission: Only when Cloud Sync is enabled (see below)

Memos and Notes

• Text notes and highlights created by you
• Tags and metadata
• Storage location: Primarily local, optionally encrypted in the cloud

Settings and Preferences

• UI language, sidebar position, feature toggles
• Storage location: Locally in your browser

Secure Cloud Synchronization (Optional)

When you enable Cloud Sync:

• Your memos are encrypted with AES-256-GCM locally in your browser
• Encryption is handled automatically and tied to your secure user identity
• Only your authenticated browser session can decrypt and access your data
• The encrypted data is stored at Supabase (EU/US)

Privacy Protection (Blacklist)

The extension does NOT collect data from the following categories:

• Banking and financial websites (PayPal, Stripe, banks)
• Email services (Gmail, Outlook)
• Messengers (WhatsApp Web, Telegram)
• Internal pages (localhost, /login, /checkout, /banking, /wallet)

A complete list of protected domains can be found in our documentation.

2.2 Browser Extension Permissions

The extension requires the following permissions:

Permission	Purpose	Data Transmission
storage	Local storage of memos and settings	No (local)
tabs	Access to title and URL of current page	Only during AI analysis
activeTab	Extract text from active webpage	Only during AI analysis
webNavigation	Track browsing history for Research Graph	Local, optional cloud
host_permissions	Works on all websites (research tool)	No

2.3 Caching and Performance

To reduce costs and increase speed, we cache AI analyses locally in your browser:

• Cache keys are based on URL or text hash
• Caches are NOT transmitted to our servers
• You can delete caches at any time in the extension settings

2.4 No Third-Party Analytics

We do NOT use tracking tools like Google Analytics, Facebook Pixel, or similar.

The only metrics we collect:

• Number of AI requests (for billing and rate limiting)
• Last activity (date, for account management)
• Extension version (for support purposes)

This data is stored exclusively server-side in our Supabase database and never shared with third parties.

3. Cloud Infrastructure and Synchronization (Supabase)

We use Supabase (Supabase Inc.) for user account management and storage of your created content (memos, graphs).

• Authentication: Login is secure via Google OAuth or Magic Link.
• Data Storage: Your synchronized data is stored in a secured database at Supabase to enable access across multiple devices.
• Encryption: All memos are encrypted client-side before being transmitted to Supabase.

4. Payment Processing (Lemon Squeezy)

Subscription sales and management are handled via the reseller Lemon Squeezy (Lemon Squeezy, LLC).

When a purchase is made, your payment data is processed directly by Lemon Squeezy.

We only receive confirmation of a successful purchase and your email address to unlock Pro features in your account.

5. Data Transfer to Third Countries

Processing of data by Google (AI), Supabase (Database), and Lemon Squeezy (Payment) may involve transfer to the USA. We select providers certified under the EU-U.S. Data Privacy Framework or who use Standard Contractual Clauses to guarantee an adequate level of protection.

6. Your Rights

You have the right to access, rectification, deletion, and restriction of processing of your data. Since you use an account, you can manage or delete much of your data directly in the extension. For complete account deletion, please contact us at hello@hyphos.app.

Withdrawal of Consent: You can withdraw your consent to data processing at any time by disabling Cloud Sync or deleting your account.