# SmartPage AI — Privacy practices

简体中文摘要：本扩展在您浏览器本地保存设置与可选的 AI 历史记录（独立存储键 `smartpage-ai-history`，与设置项分离）；API Key 不与 SmartPage AI 运营方同步。AI 请求由扩展直接向各厂商官方 HTTPS API 发送。权限与域名清单见下文「Permissions」及「Network requests」。

This document describes how the SmartPage AI Chrome extension handles data. It is intended for users and for Chrome Web Store review. The extension is Manifest V3.

Chrome Web Store listing: The publisher-hosted URL submitted for review is https://gist.github.com/yuxiangxs/29943dfda762ce870b5970146fd705b8. Keep this repository copy and the Gist in sync when you edit either one.

## Summary

- No SmartPage AI backend for your keys or prompts: The extension does not send your API keys or page content to servers operated by the SmartPage AI project. You configure provider API keys in the extension; they are stored locally in the browser using Chrome’s extension storage.
- Direct connections to AI providers: When you run Summarize, Translate, Rewrite, Explain, or Ask, the extension sends HTTPS requests directly to the official API endpoints you selected (for example OpenAI, Google Gemini, Anthropic, DeepSeek, xAI, or Alibaba DashScope). Those providers process requests under their privacy policies.
- Local-only optional history: If you enable history in Privacy & data, successful results may be appended to a local history list under the storage key `smartpage-ai-history` (separate from your settings blob). You can view, export, or delete entries in the side panel. This data stays on your device unless you copy or export it yourself.

## Data stored on your device

| Data | Where | Purpose |
|------|--------|---------|
| Connection profiles (provider, model, API key, preferences) | `chrome.storage.local` (SmartPage settings blob) | Configure and persist your AI providers and UI preferences. |
| Side panel UI preferences (e.g. theme, locale, history section open/closed, last-used AI tab) | Same settings blob | Restore UI behavior across sessions. |
| Optional local history entries | `chrome.storage.local` (key `smartpage-ai-history`) | Implemented in-app when history is enabled; lets you review past successful AI outputs locally. |

Keys are treated like passwords in the UI (masked inputs). Do not share screenshots of your options page if they expose secrets.

## Network requests

The extension communicates over HTTPS with only the hosts listed under `host_permissions` in the published extension `manifest.json` (the built package Chrome installs). At the time of writing, those patterns are:

- `https://api.openai.com/*`
- `https://api.deepseek.com/*`
- `https://api.x.ai/*`
- `https://api.anthropic.com/*`
- `https://generativelanguage.googleapis.com/*`
- `https://dashscope.aliyuncs.com/*`
- `https://dashscope-intl.aliyuncs.com/*`
- `https://dashscope-us.aliyuncs.com/*`
- `https://cn-hongkong.dashscope.aliyuncs.com/*`

There is no project-operated proxy; traffic goes to the vendor you chose.

## Permissions (why they exist)

The published manifest does not include the `tabs` permission. Page URL and title for selection metadata come from the page context (content script / injected script: `location.href`, `document.title`), or from the context-menu API’s `pageUrl` where applicable—not by reading restricted `Tab` fields.

| Permission | Why |
|------------|-----|
| `storage` | Save settings and optional local history on device. |
| `sidePanel` | Show SmartPage AI in Chrome’s side panel. |
| `contextMenus` | Offer a context-menu entry when text is selected (e.g. open the side panel). |
| `activeTab` | Work with the current tab when you invoke the extension (toolbar, menu, shortcut); pairs with `scripting` / the content script for selection without broad site `host_permissions`. |
| `scripting` | When needed, run a small script in the active tab to read selection reliably (e.g. across frames); page URL/title are taken from script-visible properties in that tab. |

Opening extension pages (Options, `chrome://extensions` shortcuts help, etc.) uses `chrome.tabs.create` and does not require the `tabs` permission.

## Page content and selection

A content script runs on `http://*/*` and `https://*/*` pages so it can respond when the extension asks for the current text selection. The extension does not request `<all_urls>` as `host_permissions` for reading arbitrary page HTML; normal operation focuses on user-selected text you explicitly act on.

## Children’s privacy

SmartPage AI is not directed at children; AI features depend on user-supplied keys and adult-oriented configuration.

## Changes

When permissions or data practices change, this file and the Chrome Web Store listing should be updated before publishing a new release.

## Contact

English: For privacy questions about this privacy policy, please email 622yuyong@gmail.com.

简体中文：如有关于本隐私政策的疑问，请发送邮件至：622yuyong@gmail.com。