Privacy Policy - PageMod

1. About Us

PageMod ("we", "us") is a browser extension that helps users create user scripts, customize webpage appearance and functionality, and generate standalone utility apps using natural language. This privacy policy explains how we collect, use, store, and protect information when you use the PageMod extension and services.

2. Information We Collect and Access

2.1 Information You Provide

Authentication Information: OAuth login tokens (Google/GitHub/Microsoft). Used to authenticate with the PageMod backend service.
AI Conversation Content: Natural language instructions and chat messages you enter in the side panel.
User Scripts and App Code: AI-generated or manually written user scripts (with // ==UserScript== metadata) and standalone HTML applications.
Model Provider Configurations: API Keys, Base URLs, and model lists for AI model providers you configure.

2.2 Extension Permissions and Data Access

PageMod requests the following browser permissions to enable its core functionality. The table below explains the purpose of each permission and the types of data accessed:

Permission	Purpose	Data Accessed
storage / unlimitedStorage	Store scripts, apps, settings, and API Keys locally	All extension data stored locally in Chrome Storage
userScripts	Register and manage user scripts, inject them into matching web pages	Script metadata match rules (@match/@exclude), script source code
activeTab / host_permissions <all_urls>	Run user scripts on web pages you visit, inject CSS styles, execute script manager functions	Tab URL, page DOM structure. Only active on pages matching user script rules
scripting	Dynamically inject and execute user scripts into target web pages	Target page DOM and JavaScript execution environment
webRequest	When you activate network monitoring, capture request metadata (URL, method, status code)	Request URL, HTTP method, status code, response headers. Sensitive headers (Authorization/Cookie/X-API-Key) are automatically redacted to ***. Only active on the monitored tab with filters applied, auto-stops after 5 minutes
cookies	User scripts can read/write cookies for specific domains via the GM_cookie API	Only accessed when a user script explicitly calls GM_cookie. You control all script code and permissions
clipboardWrite	User scripts can write text to the clipboard via GM_setClipboard	Only writes to clipboard on explicit script request; never reads clipboard contents
notifications	User scripts can send desktop notifications via GM_notification	Notification content defined by user scripts; only triggered on explicit script call
contextMenus	User scripts can register right-click menu items via GM_registerMenuCommand	Menu item name and click events, defined by user scripts
sidePanel	Provide the side panel UI for AI chat, script editing, and management	Side panel content runs in the extension's own page context; does not access webpage data
identity	Support OAuth third-party login (Google/GitHub/Microsoft) for API Key retrieval	OAuth user identifier (email, display name, avatar URL)
alarms	Schedule periodic script update checks, subscription sync, and other background tasks	Does not access user data; scheduling only
offscreen	Create offscreen documents in the background for operations requiring a DOM environment	Does not access user data

3. How We Use Information

AI Processing: Your natural language conversations and relevant page context (DOM element info, screenshots — only when you use frontend tools) are sent to the PageMod AI backend for processing to generate or modify user scripts and app code.
User Script Execution: User scripts you create or install run on matching web pages; you have full control over the script code. When scripts use GM_* APIs, calls are forwarded to the extension background to perform corresponding operations (such as storing data, making network requests, writing to clipboard, etc.).
Network Monitoring: Network monitoring is only activated at your explicit request to assist with debugging and script development. Sensitive fields (passwords, tokens, keys, etc.) in captured request/response data are automatically redacted.
Authentication: Your API Key is sent with each request to the backend for authentication and quota management.
Usage Metering: The backend counts requests for quota management only; conversation content and script code are not logged.

4. Data Storage

Local Storage: All your script code, app HTML, settings, and model provider configurations (including API Keys) are stored locally in your browser using the Chrome Storage API. This data is never automatically uploaded to any server.
Backend Processing: AI conversation content is transmitted to the PageMod backend during active sessions and is not persistently stored after processing. Session data is cleared once the session ends.

5. Data Sharing and Third Parties

We do not sell, rent, or share your personal data with third parties.
AI conversation content and script code are forwarded through the PageMod backend to the AI model provider you have configured (e.g., Anthropic, OpenAI, DeepSeek, etc.) to perform AI inference. Data is used solely to generate responses and is not used for model training (unless otherwise specified by your model provider's terms).
If you use OAuth login, the authentication process interacts directly with the respective provider (Google, GitHub, Microsoft). We do not store your OAuth passwords or access tokens.

6. User Script Data Access Controls

PageMod implements the standard Greasemonkey API (GM_*). User scripts may access data through the following APIs:

GM_setValue / GM_getValue / GM_deleteValue / GM_listValues: Store key-value data locally in your browser. Data is scoped per-script and not shared across scripts.
GM_xmlhttpRequest: Make cross-origin HTTP requests. The target URL, method, and content of requests are defined by the script code; you bear full responsibility for script behavior.
GM_cookie: Read/write cookies for specific domains. Only effective when explicitly called by a script.
GM_setClipboard: Write text to the system clipboard.
GM_notification: Display desktop notifications.
GM_download / GM_saveImage: Download files or save images locally.

You should carefully review the @grant permissions declared by installed user scripts (listed in the script header metadata) to ensure they do not access data beyond your expectations.

7. Frontend Tools and Page Data

When you use frontend tools during AI conversations, all frontend tool invocations are triggered by you or the AI during conversation; none execute automatically.

8. Data Retention and Deletion

Local data (scripts, apps, settings, etc.) remains in your browser until you actively delete it.
You can export all local data using the extension's built-in backup feature, or clear extension storage through browser settings.
Backend AI conversation data is not retained after the session ends.
Uninstalling the extension deletes all local data.

9. Security Measures

API Keys are stored as SHA-256 hashes on the backend; plaintext is never logged.
User scripts execute in the browser's user script sandbox (MAIN world), isolated from other scripts and extensions.
The network monitoring feature automatically redacts sensitive request headers (Authorization, Cookie, X-API-Key) and sensitive fields in request bodies (password, token, secret, etc.).
All communication with the backend uses HTTPS encryption.

10. Your Rights

Access and Export: Export all local data at any time using the extension's built-in backup/restore feature.
Deletion: Delete scripts/apps within the extension, clear extension data through browser settings, or uninstall the extension to remove all local data.
Stop Processing: Pausing a session or closing the side panel stops data transmission to the AI backend.
Right to Know: To inquire about any data we hold about you on the backend, contact us (see below).

11. Children's Privacy

PageMod is not directed to children under 13. We do not knowingly collect personal information from children. If you are a guardian and believe a child has provided us with information, please contact us for deletion.

12. Privacy Policy Updates

We may update this privacy policy from time to time. Material changes will be notified through extension update notes or website announcements. Continued use constitutes acceptance of the updated policy.

13. Contact

For any questions or comments about this privacy policy, or to exercise your data rights, contact us at:

Email: aipagemod@gmail.com

Discord: AIPageMod