Privacy Policy
In short: the extension sends nothing to our servers. The texts of your AI chats, your folders and the index are stored only in your browser. We do not sell data or share it for advertising, we use no trackers, and the extension collects no analytics. Below is what data lives where and how to delete it.
Who we are
Chatsavo (chatsavo.com). For any data question, write to hello@chatsavo.com.
This policy covers the Chatsavo extension (Chrome, Edge, Yandex Browser, Opera, Brave, Arc, Vivaldi and Firefox) and the chatsavo.com website.
What stays only in your browser
| Data | Where it is stored |
|---|---|
| Texts and titles of chats the AI site's page loaded for you | Extension storage (IndexedDB) on your device |
| Folders, pins and prompts | Same place. A copy of folders, chat placement and prompts can sit in the browser’s sync storage if you press Push yourself — see below |
| Search index | Same place |
| Panel settings | Extension storage (chrome.storage) |
This data never reaches us. The extension reads only the AI site responses with the chat list and chat content that the page itself already requested. It does not modify requests and never reads or forwards cookies, passwords, tokens or authorization headers of the AI sites.
Local data is not encrypted: anyone with access to your browser profile can read it. If other people use your computer, use a separate browser profile.
Version 0.1.1. The early version 0.1.1 was built before Chatsavo became entirely free and keeps housekeeping data for its built-in trial on your side: a random install ID and the trial start date in extension storage, and the date also in the browser's synced storage (chrome.storage.sync). If browser sync is on, the browser itself carries that copy (for example, through your Google account). We have no access to this data, and it is not sent to our servers. The current build does not create them and deletes both entries on update; "Delete all data" in Settings also erases them. That is an old build: if it is still installed, replace it with the current build.
Which sites the extension can open
The build asks for access only to chatgpt.com, chat.openai.com, claude.ai, gemini.google.com, grok.com, alice.yandex.ru, chat.deepseek.com and perplexity.ai (including www.perplexity.ai). ChatGPT and Claude are supported. The panel on Gemini, Grok, Alice, DeepSeek and Perplexity is in this build; their support is in testing. The extension cannot see other sites you visit.
The Alice page at alice.yandex.ru loads reply text from rpc.alice.yandex.ru. The extension sees those replies inside the Alice page. There is no separate host permission for rpc.alice.yandex.ru. Alice has no separate chat list. A chat shows up when you open it, or when its link is visible in the sidebar. Search by message text covers chats opened after install; titles from the site list can show up sooner.
Folder sync (only if you turn it on)
Settings has Push and Pull. They encrypt, on your computer, folders, which chat sits in which folder, prompts, tags, bookmarks, chains and auto-file rules. Chat texts and titles are not part of that copy.
The cipher is AES-GCM. The key is derived from a passphrase (PBKDF2-SHA-256, 210,000 iterations). The passphrase is not stored. Only ciphertext is written to the browser’s synced storage. If the browser’s own sync is on, the browser vendor carries that ciphertext, not Chatsavo. It is not sent to chatsavo.com, and we cannot read it without the passphrase.
If you lose the passphrase, that copy cannot be decrypted. Deleting a folder, tag, bookmark or rule on one computer does not delete it on the other. A chat that is not in the second browser yet is filed and tagged when it shows up there. The local database is still not encrypted.
What reaches our servers
Nothing. The extension sends nothing to our servers: there is no account, no key, no license server and no payment.
AI site recognition rules are built into the extension; fixes ship as a new extension version.
If a paid feature that needs a server appears (for example, an AI summary), we will update this policy before any data is collected: what exactly, why, for how long and who processes it. Only you will be able to turn such a feature on. The folder sync described above does not use a Chatsavo server.
The chatsavo.com website
| Data | Processed by | Why | Retention |
|---|---|---|---|
| IP address, browser data, requested page — in technical logs | Site host Vercel Inc. (USA) | Delivering pages and defending against attacks | No longer than the provider's retention period |
| Aggregate visit statistics: page views, referrers, button clicks | Vercel Web Analytics | Understanding which pages are useful; no cookies and no identifiers that could recognize you | Aggregates, for the Vercel Web Analytics retention period; we keep no raw events of our own |
No third-party trackers, pixels or ads. See the cookie policy.
We do not sell data or use it for advertising. We disclose data to authorities only when the law requires it.
Legal bases
- Legitimate interest: hosting logs to deliver and protect the site, anonymous visit statistics.
- Consent: if you write to us through a website form, once such forms exist. You can withdraw consent at any time.
- If you e-mail us, we use your address and message only to reply.
Users in the EU and UK (GDPR)
You have the right to:
- access: learn what data we hold about you and get a copy;
- rectification of inaccurate data;
- erasure ("right to be forgotten"), except data we must keep by law;
- restriction of processing and to object to processing based on legitimate interest;
- portability: get your data in a machine-readable format. Folders, saved chats and the index can be downloaded as JSON at any time;
- withdraw consent at any time, without affecting the lawfulness of earlier processing;
- lodge a complaint with the data protection authority in your country.
The site host is located in the USA. Transfers outside the EU rely on the European Commission's Standard Contractual Clauses or other mechanisms provided by the GDPR. We respond to requests within one month. We make no automated decisions with legal effects on you.
Users in Russia (152-FZ)
You may request information about the processing of your data, its correction, blocking or destruction, withdraw consent, and appeal to Roskomnadzor or a court. The site host (Vercel) is in the USA, and hosting logs are processed there. Where consent is required, it is given in a separate document (in Russian). For questions about your data, write to hello@chatsavo.com.
How to delete your data
- Local data: in the extension, open Settings → Your data → Delete all data. You can click "Download all (JSON)" first. Removing the extension also erases its local data (for version 0.1.1, except the copy of the trial start date in your browser's sync storage). Chats on the AI sites themselves are not affected.
- Our servers hold no extension data. For questions about site logs or your correspondence with us, write to hello@chatsavo.com.
Security
The site is served over HTTPS only. The extension does not send your data over the network, so its security depends on the protection of your device and browser profile.
Children
The service is not intended for children under 14 (under 16 in the EU unless permitted by local law). We do not knowingly collect their data.
Changes to this policy
If we change what data we process, we will update the date at the top and announce it on the website and in the extension in advance. Earlier versions are available on request.