Privacy Policy

Last updated: September 22, 2026 · Effective: September 17, 2026 · Applies to the Summate Chrome extension and to https://summate.tecyang.com

1. Who we are and what this policy covers

Summate is an independent browser extension that summarises web pages (the "Service"). It is operated by an individual developer ("we", "us", "our"). This policy explains what personal data the Summate Chrome extension and our website at https://summate.tecyang.com handle, why, and what rights you have. It also serves as the privacy policy linked from the Chrome Web Store listing.

We are not affiliated with, endorsed by or sponsored by Anthropic, OpenAI, Google, Notion or any other AI model provider or platform mentioned on this site.

2. Summary at a glance

• Local by design. Your API configuration, saved summaries, feed list, usage counters and licence key live in your browser's own storage — not on our servers. We cannot read them.
• Free summaries run on your device. Summate's default free engine uses the on-device model built into your browser. The page text and the resulting summary never leave your computer and are never sent to us or to anyone else. If you add your own AI provider API key to use cloud models, the text of the page you summarise (and any follow-up question) is sent to the provider you configured — still never to us.
• Our free cloud tier (when the on-device engine is unavailable). If your browser or device cannot run the built-in model, Summate can still summarise for you without an API key: in that case the page text you ask to summarise is sent to our server and passed on to the AI model provider we use for that tier, solely to generate your summary. That provider processes it under its own terms and privacy policy. We do not use it to train anything and we do not keep it after your summary is returned.
• We run no third-party analytics and no ads. No Google Analytics, no pixels, no behavioural profiling, no data sold or rented. The free cloud tier counts a few anonymous events (install, summary, quota reached, error) with no page content attached — see section 5.
• Payments via Creem. Creem (Merchant of Record) collects your payment and contact details to sell you a licence and email your key. We receive limited order information (such as your email address, licence key, plan and subscription status) — never your card number.
• Support email. If you email us, we keep that correspondence so we can help you.

3. Data the extension stores on your device

The extension stores the following in your browser's extension storage (chrome.storage.local and, where you enable sync, chrome.storage.sync). It stays on your device (or in your own browser-sync account) until you delete it:

• API configuration: the endpoint URL, model name and API key you enter;
• Summary history: the page titles, URLs and summaries you choose to save;
• RSS data: the feed URLs you subscribe to and any summaries generated for new articles;
• Usage counters: how many summaries have been generated, used to apply your plan limits;
• Licence data: the licence key you activate and the plan tier it unlocks;
• Preferences: language, summary length, theme and shortcut settings.

Deleting the extension's data (or uninstalling the extension) removes all of it. We have no access to it and no copy of it.

4. Data sent off your device when you use the extension

• On-device engine (default, free). Summaries produced by the model built into your browser are generated locally. For those summaries no page content, prompt or output is transmitted anywhere — there is no network request involved. This is the engine Summate uses unless you configure your own API key.
• Our AI model provider (free cloud tier only). When you use Summate without your own API key and without a usable on-device model, our server sends the page text you asked to summarise to the AI model provider that powers that tier, so it can generate the summary. We send nothing else about you, the content is not used to train models by us, and it is not retained after the summary is returned. No page content is ever sent when the on-device engine handles your request.
• Your AI provider. When you summarise a page or ask a follow-up question using the cloud engine with your own API key, the extracted text of that page (and your question) is sent directly from your browser to the API endpoint you configured. That provider processes the content under its own terms and privacy policy. We do not proxy, log or retain that content. If you use a provider's free tier, note that some providers may use submitted data to improve their models — check your provider's policy.
• Feed publishers. RSS articles are fetched directly from the publishers whose feeds you subscribe to.
• Notion (optional). If you enable Notion export, the summary you export is written to your own Notion workspace using the integration token you provide.
• Our licence server. When you activate or verify a licence, the extension sends your licence key to our server at summate.tecyang.com/verify, which forwards it to Creem's licence API and returns your plan status. No page content is ever included.
• Creem checkout. If you buy a plan, your browser is redirected to Creem's hosted checkout, where Creem collects the payment and contact details it needs as Merchant of Record.

5. Data we process on our servers

• Licence verification requests. The licence key, the plan returned and the time of the request, plus ordinary request metadata that our hosting provider (Cloudflare) processes to deliver the request and protect the service: IP address, user agent, requested URL and country. This is used solely to verify entitlements, rate-limit abuse and keep the service running.
• Payment and subscription events from Creem. Webhooks tell us that a subscription was created, paid, cancelled, past due or expired, and include the related order/transaction identifiers and the customer email address. This keeps your licence status correct. No card or bank data is included.
• Anonymous usage counters (free cloud tier). To run the key-less free tier and prevent abuse we count events — install, first summary, summary, quota reached, error — and the number of tokens the AI provider billed us for, keyed to a random device identifier that the extension generates in your browser. These counters contain no page text, no titles, no URLs and no prompts, and they are not linked to any account or email address. They expire automatically after 400 days. Reinstalling the extension creates a new identifier.
• Support correspondence. Emails you send to me@tecyang.com, together with our replies.

6. Data we never collect

• We do not track your browsing history, the pages you visit, or which pages you summarise.
• We do not store the page content you summarise, or the summaries you generate, on our servers.
• We do not run third-party analytics, advertising or social-media trackers, and we do not build advertising profiles.
• We do not sell, rent or share your personal data for marketing purposes.
• We do not collect your payment card or bank details — Creem does.
• We do not knowingly collect data from children (see section 13).

7. Why we are allowed to process your data (legal bases)

• Performance of a contract — verifying and maintaining your licence, delivering paid features and answering support requests.
• Legitimate interests — keeping the service secure and available, preventing fraud, licence sharing and abuse, and debugging problems. We balance these against your rights.
• Legal obligation — retaining transaction records where tax and accounting law requires it; Creem holds the seller-of-record records for purchases.
• Consent — where you have explicitly agreed to something (for example optional product emails), which you can withdraw at any time.

8. How long we keep data

• Extension data on your device: until you delete it or uninstall the extension.
• Server request and security logs (Cloudflare): a short period, per Cloudflare's standard log retention.
• Licence and subscription records (email address, plan, order ID, status): while your licence is active and afterwards as long as needed to honour the licence, resolve disputes and meet accounting obligations.
• Support emails: up to 24 months after the last message in the thread.
• You may ask us to delete licence/support data sooner (see section 12); we will comply unless we must keep something for legal reasons.

9. Who we share data with

We share the minimum necessary with the service providers that make Summate work. Each processes data under its own terms. When Summate uses the free on-device engine, nothing is shared with anyone — the model runs inside your browser:

We may also disclose data if required by law, to enforce our Terms of Service, or to protect the rights and safety of users and of the service. We do not sell personal data.

10. International transfers

Our website and licence server run on Cloudflare's global network, so requests may be processed in the region closest to you or in another country. Creem may process payment and subscription data in the United States, the European Union or other locations where it operates, using appropriate safeguards such as standard contractual clauses. If your AI provider is in another country, the page content you submit is transferred there under that provider's own safeguards.

11. Security

Our site and licence server are served over HTTPS. Your Creem API credentials and webhook secret are kept server-side and are never exposed to the extension or to your browser. Licence keys are personal secrets; treat them like a password. Uploaded or stored data cannot be made perfectly secure, so we keep the data we hold to a minimum — the most sensitive things (your API key, your summaries) never leave your device. If you suspect misuse of your licence key or a security issue, email me@tecyang.com and we will deactivate the affected key.

12. Your privacy rights

Depending on where you live (for example the EU/EEA, the UK, Switzerland, California, Brazil or other jurisdictions with data-protection laws), you may have the right to: access the personal data we hold about you; have it corrected; have it deleted; restrict or object to certain processing; receive it in a portable format; withdraw consent; and not be discriminated against for exercising these rights.

To exercise any of them, email me@tecyang.com. We respond within 30 days and may ask you to verify your identity. Because most data is stored only on your device, the fastest way to delete it is to clear the extension's data or uninstall the extension. You also have the right to complain to your national data-protection authority. Under California law, we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use sensitive personal information for advertising.

13. Children

Summate is not directed to children under 13 (or the minimum age applicable in your country), and we do not knowingly collect personal data from them. If you believe a child has used the Service and provided us personal data, email me@tecyang.com and we will delete it.

14. Cookies and tracking

Our website and licence server set no advertising or analytics cookies and we use no tracking pixels. Creem's hosted checkout pages may set their own cookies on Creem's domain to complete your purchase and prevent fraud; those are covered by Creem's privacy policy. Google's Chrome Web Store pages are governed by Google's policies. The extension itself sets no cookies.

15. Changes to this policy

We may update this policy as the Service evolves or the law changes. The "Last updated" date at the top of this page always shows the current version, and material changes will be highlighted here. Continuing to use the Service after the effective date means you accept the updated policy.

16. Contact

Questions, requests or complaints about privacy: me@tecyang.com. Support is provided by email and we aim to reply within 2 business days. For payment data held by our Merchant of Record, contact Creem at creem.io/contact.

See also our Terms of Service and our pricing.