Privacy Policy

Last updated 28 July 2026

AI Overclock is a browser extension that answers questions about the web page you are looking at. Doing that requires sending parts of that page to a language model. This page explains exactly what gets sent, what gets stored, and what never leaves your browser.

The short version

• We do not sell your data, and we do not use it for advertising.
• We do not train models on your data.
• Page content is read when you ask a question — and, if you pin a live panel, on the refresh interval you asked for. Never otherwise.
• We never see your card details, and we never store your passwords.

What is sent when you ask a question

The extension is idle until you open the panel and send a message. When you do, it sends to our server: your question, the URL and title of the current tab, and whatever the assistant reads from the page in order to answer — typically the page text, a table you asked to extract, or a screenshot if you asked something visual.

Our server adds no data of its own. It forwards the request to our model provider, OpenRouter, which routes it to the model you selected. We hold the model API key on the server precisely so it is never shipped inside the extension.

Conversations are not stored on our servers. The request is proxied and the response streamed back to you. Your chat history lives in your browser. What we retain is the metering record described below.

Live panels

If you ask the assistant to pin a live panel, that panel keeps working after the conversation ends. On the interval you agreed to, it re-reads the part of the page it is tracking and re-fetches any data endpoint it was built against — otherwise it would only ever show you the value from the moment you created it.

This is the one thing the extension does without you asking each time, so it is bounded deliberately. A panel only polls sources that were approved when it was created; a source that crosses to another site had to be approved by you, by name, at that point. It stops as soon as you close it or leave the page. Refresh ticks are not sent to the model. No question is being asked, so the refreshed values are rendered in the page and go no further — not to our server, and not to OpenRouter.

Network capture

Some data is never in the page as text: a dashboard draws a chart, and the numbers behind it arrived over a request. To answer questions about that data — and to build a panel that tracks its real source instead of scraping stale pixels — the assistant can record the requests the page itself makes: the URL, the method, and a truncated snippet of the request and response bodies.

This runs only during a question you asked, for an observation window of a few seconds. It is removed from the page as soon as that window closes, and it never blocks or alters a request. Values under credential-shaped names — anything naming a token, secret, password, session, card number, CVV, or one-time code — are redacted at the moment of capture, before the recording exists, and tokens are stripped by shape wherever they appear. What survives that is sent to the model as part of your question.

The limit is worth stating plainly: that redaction is based on what credentials are conventionally named and shaped, so it catches those rather than everything a response body could conceivably hold. Treat the assistant as something you are showing the page to, network traffic included.

What we store

• Your account: email address and a user id, held in Supabase, so you can sign in and so your credit follows you between devices.
• Your credit ledger: one row per credit change — the free signup grant, any top-ups, and one usage row per question with the token counts and cost. This is how the balance is calculated and how you can audit what you were charged for. It records that a request happened and what it cost, never what it said.
• The hostname of the page you asked about. Each usage row carries it — github.com, not the full URL and nothing in its path or query. It is there so a charge is recognisable when you review your activity.

Those hostnames add up to a partial record of where you have used the assistant, so to be unambiguous about it: we store hostnames only, only for pages you actually asked a question on, and we neither build a browsing profile from them nor share them. We disclose this to the Chrome Web Store under web history.

What stays on your device

• Your conversations, in the extension’s local storage.
• Site notes. The assistant can save a note about a site (a useful selector, an endpoint it found) so it doesn’t rediscover it next visit. These live in the extension’s local storage, per site; we never upload them and we cannot read them. They are not, however, private from the model: when the assistant looks a note back up, that note becomes part of the question and is sent with it like any other context.

Credentials

The assistant can read a page’s own local storage, because applications often keep state there that never appears on screen. Values stored under credential-shaped keys — anything naming a token, secret, password, session, or API key — are redacted inside the page before anything is sent. The model receives the key name and the value’s length, never the value. The extension never asks for, fills, or transmits your passwords.

Permissions, and why each is needed

• Access to the sites you visit. The assistant has to be able to read the page you are asking about, and that page could be any page. It reads when you ask a question, and on the refresh interval of a live panel you pinned — not otherwise.
• Tabs. To answer questions that span more than one open tab, and to open a link you asked it to follow. Reading a tab other than the one you opened the assistant on always asks you first, naming that tab.
• Context menus. For the right-click “Ask AI Overclock about this selection” entry.
• Downloads. To save an extraction as a CSV or JSON file when you ask for one.
• Storage. For your conversations, settings, and site notes.
• Scripting. To run the extension’s own packaged tools against the page. The extension does not download or execute any code from the internet.

Payments

Card payments are processed by our merchant of record. They handle the payment form and collect any VAT or sales tax due in your country. Your card details never reach our servers. We receive a confirmation that a payment succeeded, and keep it as an audit row so a disputed charge can be reconciled: the amount, the currency, the transaction reference, the billing email, and the status.

The card behind the payment is removed before that row is written — not only the number and CVV, which the processor never sends us in the first place, but the cardholder name, the expiry, the brand, and the last four digits, which it does. None of it is anything we need in order to credit your account.

Sub-processors

• OpenRouter — routes your question to the selected model provider.
• Supabase — accounts and the credit ledger.
• Cloudflare — runs our API.
• Vercel — hosts this website.
• Our merchant of record — payment processing.

Retention and deletion

Account and ledger records are kept while your account exists, and afterwards only as long as needed for tax and accounting obligations. You can ask us to delete your account and we will remove your personal data. To delete everything held locally, remove the extension.

Your rights

You can request a copy of your data, ask for corrections, or ask for deletion, by emailing us. If you are in the EU or UK, the GDPR rights of access, rectification, erasure, restriction, portability, and objection apply.

Children

AI Overclock is not directed at children under 13 and we do not knowingly collect their data.

Changes

If this policy changes materially we will update the date at the top and, where the change affects how your data is used, tell you in the product.

Contact

The data controller for AI Overclock is Saad Zafar, trading as AI Overclock — saadzafar.support@gmail.com