Privacy
What actually happens to your data
This page is written for a human, not a regulator. The binding version, with the legal detail a lawyer needs, is at /legal/privacy-policy. This one just tries to be accurate and readable at the same time.
True, and we'll say it plainly
- Reading detection works with no camera and no permission prompt.
- The camera is off by default, and only starts when you turn it on.
- No video, image or webcam frame ever leaves your device (verified by an automated test that inspects every outbound request.
- No raw gaze coordinates are stored or transmitted. Aggregates only.
- Reading receipts are built on your machine and shown to you before anything happens with them, never submitted in the background.
- There is no covert mode, and there will never be one.
What does leave your device
Passage text (the paragraph you're reading, and sometimes the one before it for context) is sent to a server to generate questions and explanations. That's the trade: the questions have to come from somewhere. We're saying it here at the same size as the privacy wins above, not in a footnote, because burying it is the thing that would actually break trust.
If you turn the camera on, one more thing changes: the extension loads a face-detection model from a Google-operated host the first time it needs one. That request can disclose your IP address to Google, the same way loading any third-party resource would. It only happens on the camera path, which stays off unless you turn it on.
On your device, never sent anywhere
A local history you can see, and currently clear by uninstalling
alcoia keeps a list of pages you've read on your own device, so it can show you your own session history (page titles, how long you spent, which state you were mostly in). It is never transmitted. As shipped, clearing it means uninstalling the extension; we'd rather say that plainly than imply a delete button that isn't there yet.
The receipt
"Unaltered since issued," not "verified"
A signed receipt proves the file hasn't changed since alcoia issued it. It is not proof the reading happened: the figures inside come from your own browser, and a modified extension could produce anything. That caveat travels with the file itself, as a field of the receipt, not just as something we say here.
No camera, verifiable
The client is open source. There is no camera in v1
Everything above is verifiable in code you can read: the extension manifest lists every permission, and in v1 there is no camera. This isn't a promise. It's a fact you can check. Read more on the licence →