Privacy Policy — ZhiyuOnline

1. Introduction

ZhiyuOnline ("we", "our", or "the extension") is a Chrome extension that helps users capture, understand, and apply knowledge from web content. This privacy policy explains what data we collect, how we use it, and how we protect it.

2. Data We Collect

We only collect data that is necessary for the extension to function.

Data Type	When Collected	Purpose
Email address	When you log in	Send a one-time passcode (OTP) to verify your identity
Page content (URL, title, text, images)	When you click "Capture this page"	AI analysis to generate structured knowledge from the article
Active tab URL and title	On tab switch or page load	Classify the page and check for related knowledge you've previously studied
JWT authentication token	After successful OTP verification	Authenticate API requests; stored locally on your device only

We do not collect browsing history, bookmarks, passwords, financial information, or any other personal data beyond the above.

3. How We Use Your Data

Authentication: Your email is used solely to send an OTP for login. We do not store your email in association with browsing data or sell it.
Content analysis: Captured page content is sent to our backend for AI-powered summarization, concept extraction, and knowledge structuring.
Knowledge matching: Tab URLs and titles are sent to our backend to check whether you've previously captured related content, enabling contextual recall.
We do not build advertising profiles, track your activity for marketing, or share your data with third parties for their own purposes.

4. Data Storage and Transmission

Local storage: Your JWT token and session state are stored in chrome.storage.local and chrome.storage.session on your device.
Backend server: Captured content is transmitted over HTTPS to our backend hosted on AWS (ap-northeast-1 region) for processing and storage.
WebSocket: A secure WebSocket (WSS) connection is used for real-time updates when content processing completes.
No remote code: The extension does not load or execute any code from remote servers. All logic is bundled and shipped with the extension.
No third-party analytics: We do not use Google Analytics, tracking pixels, or any third-party analytics services.

5. Data Sharing

We do not:

Sell your data to any third party
Share your data with advertisers
Use your data for purposes beyond the extension's core functionality
Transfer your data to third parties for their independent use

Your data is processed only by our own backend infrastructure (AWS Lambda, API Gateway) to provide the extension's features.

6. Chrome Permissions

The extension requests only the permissions required for its core features:

Permission	Why It's Needed
`activeTab`	Access the current tab's URL and title when you click the extension icon to capture a page
`sidePanel`	Display the knowledge base UI in Chrome's side panel
`storage`	Store your JWT token and session state locally on your device
`scripting`	Extract article text and images from the active tab when you initiate a capture
`tabs`	Monitor tab changes to check for related knowledge as you browse

7. Host Permissions

Host	Why It's Needed
`<all_urls>`	Inject a content script to extract page text when you capture any website
`https://api.zhiyu-online.com`	Our backend API for content analysis and knowledge storage
`wss://ws.zhiyu-online.com`	WebSocket connection for real-time processing status updates

The extension also injects a content script on chatgpt.com, chat.openai.com, and gemini.google.com to let you import conversations from those AI chat services into your knowledge base.

8. Data Retention and Deletion

You can delete individual captured content and knowledge cards through the extension's UI at any time.
Uninstalling the extension removes all locally stored data (token, session state) from your device.
To request deletion of server-side data associated with your account, contact us at the email below.

9. Security

All data transmission uses HTTPS or WSS encryption.
Authentication uses one-time passcodes (OTP) delivered via email; no passwords are stored.
JWT tokens are stored only in local Chrome storage and are never exposed to web pages.
The extension does not execute remote code and complies with Chrome's Manifest V3 security requirements.

10. Children's Privacy

ZhiyuOnline is not intended for children under 13. We do not knowingly collect data from children under 13.

11. Changes to This Policy

We may update this policy from time to time. Changes will be reflected by the "Last updated" date at the top of this page. Continued use of the extension after changes constitutes acceptance of the updated policy.

12. Contact

If you have questions about this privacy policy or your data, please contact:

Email: lewei.me@gmail.com