# Chrome extension privacy This page explains what the Chrome extension sends to Hephaestus and how to control that access. You choose the Hephaestus instance that receives requests and each provider site where the extension may run. The default instance is [hephaestus.build](https://hephaestus.build). Its [privacy notice](https://hephaestus.build/privacy) identifies the operator, legal bases, recipients, retention, and privacy contacts. If you connect to another instance, its operator receives requests instead. This page describes extension behavior across instances. Each instance’s privacy notice applies before you connect to it. [Connect it to your Hephaestus](/user/browser-extension.md#connect-it-to-your-hephaestus) gives the steps. ## What it reads and sends * **Sign-in information.** Sign-in uses your chosen instance and its identity provider. The extension receives account identity and credentials for its own session. It does not read your GitHub or GitLab password, cookies, or personal access tokens. * **The address of the work you open.** Once you allow a site, the extension recognizes supported issue, pull request, and merge request addresses. It sends the canonical work address to your instance immediately to look up the practice review. It sends the address again while the page stays open and the review may change. * **A list row you choose to preview.** On repository or project lists, the extension reads row title-link addresses to add Hephaestus buttons. These lists include pull requests, merge requests, and issues. It sends nothing until you select a row’s button. Then it sends only that row’s canonical work address for lookup. * **Review records.** Your instance returns account and workspace information and records for display. These include comments recorded as posted for you: their locations, practices, delivery times, and addresses, never their text. An open report on the work page also shows your observations: practice, outcome, severity, and one-sentence summary. * **Review requests.** The extension’s only change is a review request, through its own confirmation window. It checks the work and your access again with the instance before you confirm. You cancel reviews, retry observations, and approve or reject feedback in the web app. The canonical address includes provider, repository, and work number. It excludes query strings, fragments, and subpage paths. The extension uploads no page text, source code, form inputs, or screenshots. It does not collect a browser history. The instance resolves only work in accessible workspaces. It matches the address against repositories that the workspace already monitors, and it does not fetch the page itself. Other pages, such as repository pages, searches, and other sites, are never looked up. The extension shows only your records, even if you are a workspace admin. It never shows feedback text. Other developers’ records are in the web app for people with permission. Report content stays in the extension’s frame, not in the provider page’s document. The host page can see the practice review box and list-row buttons. It can observe the box size, which is the same in each state until you open it. It cannot read the review records or open the box. The extension does not hide its installation. ## Storage and retention Chrome stores your chosen instance locally in your profile and remembers granted site permissions. The extension does not sync these preferences. Credentials stay in Chrome session memory, without access from page content scripts. When Chrome closes or you sign out, Chrome removes them. Account and review data stay in memory, not in a persistent extension cache. The instance keeps session and security records, including authentication events. When a session ends, these records stay. The instance’s privacy notice covers their retention and existing records about your work. Removing the extension deletes its local storage. It does not delete server records or work in GitHub or GitLab. ## AI processing and other recipients The extension does not call an AI provider. A practice review lookup does not start an AI review. If you request and confirm a review, the server may process connected-source evidence with the workspace’s AI provider. Your AI choice and workspace controls apply. Feedback may then reach the configured destinations. A self-hosted instance can use an external AI provider. Self-hosting does not imply that all processing stays on that server. [Your AI choice](/user/privacy.md#your-ai-choice) and your instance’s privacy notice explain these limits. The extension contains no advertising, analytics, or third-party error-reporting service. It uses system fonts and bundled scripts and images. Help or privacy links open the named website under that site’s privacy terms. ## Limited Use The extension’s information use follows the [Chrome Web Store User Data Policy, including the Limited Use requirements](https://developer.chrome.com/docs/webstore/program-policies/limited-use). Extension data only supplies and secures the in-page practice review described here. Hephaestus does not sell it or use it for advertising, creditworthiness, lending eligibility, unrelated profiling, or research. Optional research participation does not authorize collection or reuse of extension browser activity for research. ## Your controls and privacy requests Removing a site’s access in extension settings stops the extension on that site. **Sign out** in extension settings ends the extension session. Signing out clears credentials and open review views and asks the instance to revoke the session. If the instance cannot be reached, signing out still completes locally. If the instance was unreachable when you signed out, the session stays active until it expires or you revoke it in the app’s **User settings**. Changing the instance disconnects the old account and removes access to that instance before you connect elsewhere. The app’s **User settings** also lets you revoke the extension session or sign out everywhere. The selected instance’s privacy notice names the contact for access, correction, deletion, or an objection to server processing. A public support issue is public, so it is no place for tokens, private work, or personal data. For the default instance, [hephaestus.build/privacy](https://hephaestus.build/privacy) gives contacts and the rights process. [Hephaestus support](https://github.com/hephaestus-build/Hephaestus/issues) accepts general extension problem reports.