Extension Privacy Policy

This policy applies to the LinguaFlow extension for Google Chrome and Microsoft Edge. Its single purpose is to let you intentionally look up selected or typed vocabulary, hear pronunciation, save words to LinguaFlow collections, view saved lookup history, and see review-due reminders.

The extension does not continuously collect the text of pages you visit. A page lookup is sent only after you select text and activate the LinguaFlow lookup icon or context-menu action. A lookup typed in the popup is sent when you submit it.

Account and authentication data: your LinguaFlow user identifier, email address, access token, refresh token, token type, and token expiry. The private tokens are stored in extension-local storage and are used by the background service worker; they are not exposed to webpage content scripts.

Lookup and browsing context: the selected or typed term, active learning language, lookup time, and—when the lookup starts on a webpage—the full source URL and source domain. The term, URL, and domain can reveal website content or browsing activity, so we treat them as user data.

Learning and save data: matched dictionary word identifiers or custom terms, target collection, saved state, collection metadata needed by the picker, recent saved lookup history, and review-due information returned by LinguaFlow.

Local reliability data: the latest selection for handoff between extension views, active language, cached history and collections, realtime connection status, and an offline save queue containing the term, source URL/domain, collection target, account identifier, timestamps, retry count, and last error.

We use this data only to authenticate your extension session; perform dictionary lookup and suggestions; play or select pronunciation; save and synchronize vocabulary; show saved history and collection state; display review-due reminders; retry user-requested saves after reconnection; prevent duplicate saves; secure the service; and measure aggregate reliability and feature usage.

LinguaFlow administrators can access aggregate counts of normalized lookup terms and source domains for product operations. That aggregate report does not return user identifiers or full source URLs. We do not use selected text, URLs, domains, or account data for personalized advertising, retargeting, credit decisions, or sale to data brokers.

The extension stores its session and feature state in chrome.storage.local and short-lived authentication/selection handoff data in chrome.storage.session. User-requested lookups, saves, history, collection state, and realtime updates are transmitted over HTTPS or WSS to LinguaFlow's Supabase-hosted Auth, Database RPC, and Realtime services.

If you choose Google sign-in, Google participates in the OAuth authentication flow under Google's own privacy terms. Chrome or Edge provides the extension APIs and local extension storage under the browser provider's terms. The extension does not download or execute remotely hosted code.

Authentication tokens remain locally until sign-out, expiry/refresh failure, extension removal, or browser-storage clearing. The latest selection is session-scoped. Offline save items remain locally until they synchronize, are cleared on sign-out, belong to another signed-in account and are discarded, or extension storage is cleared.

Server-side lookup records—including the term, source URL/domain, language, account owner, and lookup time—may remain while your LinguaFlow account is active. Saved collection entries remain until you remove them. Deleting the LinguaFlow account deletes account-owned extension lookup records through the platform's account relationship. Aggregate records that no longer identify an account may be retained for security and product operations.

You can sign out, uninstall the extension, or clear extension storage to remove local data. Use LinguaFlow's account controls for collection data. For full account/data deletion or a privacy request, contact the developer through the support channel shown on the Chrome Web Store or Microsoft Edge Add-ons listing.

We share data only with service providers needed to operate the user-facing extension—currently Supabase for authentication, database, and realtime delivery, and Google when you choose Google sign-in—or when required for security, legal compliance, or a corporate transaction with appropriate safeguards.

Human access to identifiable user data is prohibited except with your specific consent for support, when necessary for security or abuse investigation, when required by law, or after data is aggregated and de-identified for internal operations.

LinguaFlow's use and transfer of information received from browser extension APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

We use HTTPS/WSS in transit, extension-owned token storage, background-only private-token access, authenticated RPCs, and row-level ownership controls. No system can guarantee absolute security.

We may update this policy when the extension's behavior, providers, or legal obligations change. The effective date below will be updated, and material changes will be reflected in the store listing or extension experience where required.