Crodal Research — Privacy Policy

Crodal (also "Crodal Research") is an early prototype (beta) offered for general testing and feedback, on an "as is" basis. It lets you highlight, annotate, capture, transcribe, and organize content, and optionally sync it across your devices. This policy explains what data the service handles and how. Your use is also governed by our Terms of Use & Acceptable Use, which you accept on the consent screen shown when you first use Crodal.

1. What we collect

• Content you create: highlights, notes, screenshots, screen recordings, and files you upload, plus the page URL and title they are associated with.
• Account information (only if you sign in): your Google account email, display name, and profile photo, obtained through Google Sign-In.
• We do not collect browsing history, keystrokes, passwords, or analytics/tracking data. There are no third-party ad or tracking SDKs.

2. How your data is stored

• Without signing in: the content you create (highlights, notes, screenshots, recordings, files) is stored only in your browser's local storage on your device. We do not upload it to our servers.
• If you sign in: your content is synced to a private, per-user area of our Google Firebase (Firestore + Cloud Storage) backend so you can access it on other devices. Each user can only access their own data. Screenshots, screen recordings, and uploaded files are stored in Firebase Cloud Storage; highlights, notes, and metadata in Firestore.
• Sharing: if you explicitly send a share request and the other person approves it, the two of you can view each other's shared highlights, screenshots, files, and recordings. Sharing never happens automatically and is limited to people you connect with.

2a. Network activity (even without signing in)

To provide certain features, the extension makes a few network requests regardless of whether you are signed in. These do not upload your saved content to our servers:

• Site icons: we fetch favicons from Google's public favicon service to display next to your highlights (this sends only the website's domain).
• On-device AI models: OCR (Tesseract) and transcription (Whisper) download their model files once from public CDNs (jsDelivr / Hugging Face) and then run entirely on your device — your images and audio are processed locally and are not sent to those services.
• Voice-to-text ("Speak" buttons): the live voice input uses your browser's built-in Web Speech API. In Chrome and Edge this means the audio is sent to the browser vendor's (Google's) speech-recognition service to convert it to text. Use typing instead if you prefer not to send audio. (We are moving voice input to fully on-device transcription; where that is active, audio is processed locally and not sent anywhere.)
• Cloud / online AI features (optional): if you use them, the content you submit is sent to the AI provider that powers the feature — the managed "Crodal Cloud" (processed through our secure backend using providers such as Google Gemini or OpenAI) or, if you bring your own key, the provider you configure (stored only on your device). On-device AI options process locally and send nothing.
• Desktop in-app browser: pages you visit in Crodal's in-app browser load directly from those websites. We do not collect or store your general browsing history — only the items you explicitly choose to save.

3. How we use your data

Your data is used solely to provide the extension's features — storing, displaying, syncing, and (where you choose) sharing your own content. We do not sell, rent, or share your data with advertisers or any third party for marketing.

4. Permissions

• identity — Google Sign-In for optional cloud sync.
• storage, unlimitedStorage — save your highlights/notes/files locally and manage sync.
• activeTab, tabs, scripting, host access — to display highlights and the toolbar on the pages you choose to annotate.
• contextMenus — right-click highlight shortcuts.

5. Data retention & deletion

You can delete any item at any time from within the extension. Deleting an item removes it from your device and, if synced, from the cloud. To remove all cloud data, delete your items or contact us to request account-data deletion.

6. Third-party services

• Google Firebase (Authentication, Firestore, Cloud Storage) — sign-in and optional cloud sync. Governed by the Google/Firebase Privacy Policy.
• Google favicon service — to display site icons (receives website domains only).
• jsDelivr / Hugging Face CDNs — one-time download of on-device AI model files; no user content is sent to them.
• Browser Web Speech API — voice-to-text; audio is processed by your browser vendor's speech service (e.g., Google in Chrome/Edge), where on-device transcription is not used.
• AI providers (only if you use cloud AI features) — the content you submit is sent to the managed Crodal Cloud backend (using providers such as Google Gemini or OpenAI) or to a provider you configure with your own key, solely to generate the requested result.

7. Acceptable use & your responsibility

Crodal Research is a personal research and note-taking tool. You are responsible for using captured content lawfully — including respecting copyright and obtaining consent before recording other people. Crodal Research is not for unauthorized redistribution of others' content. Misuse is the user's responsibility, not the developer's. See our full Terms of Use & Acceptable Use.

8. Children

Crodal Research is not directed to children under 13 and does not knowingly collect their data.

9. Changes

We may update this policy; material changes will be reflected by the "Last updated" date above.

10. Contact

Questions or data requests: adminvnote@gmail.com (the Crodal Research Team).