This page is the complete privacy policy for the Osmolog Chrome extension.

Privacy Policy for Osmolog

Effective date: August 19, 2026

Osmolog records active and passive language-immersion time on supported media websites and from activities the user adds manually. This policy explains the information the extension handles and how it is used.

Information handled

To provide tracking, the extension processes:

Fully manual counting treats eligible supported-site playback as the selected target language without performing language checks. Automatic mode identifies spoken language from player-provided audio and caption metadata. It does not capture, transcribe, or analyze audio. Weak page-title evidence may suggest an option when asking the user, but does not automatically confirm the spoken language.

The extension does not read passwords, payment information, or cookie contents, and it does not inspect pages outside the supported media services declared in its manifest. When a supported provider exposes artwork only through its own signed-in page session, Osmolog may make a same-provider request from that page to obtain the artwork URL; it does not copy or transmit the provider's cookies elsewhere. Twitch and YouTube Music are labelled Beta and are available by default. Spotify, supported podcast web players, and additional streaming services are labelled Experimental and shown only when the user enables the Experimental list. Generic webpage audio is not enabled because arbitrary pages cannot reliably separate content from ads or interface sounds.

### Channel, artist, show, and artwork information

Osmolog's Sources view can group locally retained sessions by a bounded channel, artist, or show identity and display the readable name, recorded time, share, session count, and available provider artwork. For episodic services, the local session title may also contain the season, episode number, and episode name exposed by the player. Provider logos, such as the YouTube, Netflix, and Twitch marks, are packaged inside the extension and do not require a network request.

When a supported player exposes a channel avatar, artist image, or show artwork, Osmolog may retain the provider-hosted image URL with the local session. It does not retain a separate individual-video thumbnail. The dashboard displays available artwork by requesting that retained URL directly from the provider or its image-delivery service. That provider receives the ordinary image request, which can include the user's network address and standard request information under the provider's own privacy practices. Osmolog does not proxy the request, copy the image into an Osmolog-operated image library, or send the image or its URL to the Osmolog cloud mirror, product analytics, feedback, or Groups. The URL stays in local extension storage and is included only if the user deliberately exports a local JSON backup; it can be removed by deleting the session, resetting data, or removing the extension.

How information is used

Information is used only to:

Local storage and Chrome Sync

Tracker history and settings are stored in Chrome extension storage on the user's device. Compact daily totals, cumulative totals by general source, goals, reset markers, language settings, and explicitly saved tracking rules may be stored through chrome.storage.sync, which is operated by Google and subject to the user's Chrome and Google account settings.

Synced language settings are limited to language codes and display names, the selected tracking and dashboard languages, which languages are shown or hidden, and chart colours. A saved video, channel, show, or website rule syncs its target/not-target decision under a pseudonymous hashed matching key. It also syncs the readable label shown in the Rules manager so the user can identify and manage that rule on another Chrome installation. Those labels can reveal viewing interests to anyone with access to the user's Chrome Sync data. The extension syncs a readable label only after the user explicitly saves the corresponding rule; it does not sync page URLs, searches, general browsing history, subtitle or page text, or titles merely because a page was visited.

The popup's collapsed Detection details panel is transient and local. Its sanitized copy action includes only the provider and adapter names, detected language codes/names, decision/conflict state, and scan timing. It excludes page URLs, video titles, channel/source names, content identifiers, and account/profile data. The extension does not keep a diagnostic event log or transmit these details.

Osmolog has no advertising SDK and no in-extension payment integration. It does not sell or rent tracker data. The dashboard and popup read the same extension data. See "Product analytics" below for the separate, off-by-default, consent-based analytics contract.

Optional account and cloud mirror

Signing in is never required. Local tracking, goals, history, and exports work without an account and remain available without Pro access or after the user signs out.

Supabase is used as the third-party authentication and database provider. Supabase stores the account email and authentication credentials. The extension never stores the account password beyond forwarding it in the authentication request.

Creating an account or signing in enables the account connection. The sign-in and create-account forms display the stored and transmitted data immediately above their submit button, so the disclosure is shown before the decision is made. Signing in stores the account identifier, a randomly generated per-device identifier, and a generic device label derived from it. Daily aggregate backup and language-list synchronization begin only while the account has an active Pro subscription. Those uploads contain:

Supabase also stores the account's cloud-activation time and server-owned plan/entitlement status so the service can enforce paid access without trusting the device. Obsolete time-limited-access fields are retained as empty database columns temporarily for compatibility with older extension builds; the service does not use them to authorize uploads.

The cloud mirror never receives video or channel titles, URLs, searches, subtitle or page text, or manual-entry descriptions. The device's local copy remains primary. Signing out stops all further uploads without deleting existing rows. A signed-in user may explicitly restore current-generation daily aggregate totals and the account's language codes/display names. Restore can recover dates, languages, general sources, active/passive seconds, and session counts, but not individual session details that were never uploaded. Losing Pro access stops future uploads and starts a 90-day recovery window shown in Account; mirrored totals remain restorable during that window and are then deleted by a bounded server cleanup job. Returning to eligible Pro access before the deadline cancels the scheduled deletion.

Cloud data is protected by Supabase Row Level Security so ordinary authenticated clients can access only rows belonging to their account. Authorized infrastructure operators retain the access necessary to operate the service. The extension never embeds a Supabase service-role key.

Cloud aggregate rows are removed when the corresponding local aggregate is deleted and cloud sync confirms the change, when a 90-day recovery deadline expires, when the signed-in user resets tracker data, or when the account is deleted. Account deletion removes the profile, registered devices, cloud-stored daily totals, and associated shared-space records according to database ownership and cascade rules without affecting local tracking history.

Optional Groups and Pair

Groups and Pair require a signed-in account. When a user creates or joins a private shared space, Supabase stores the space name, type, language, period and status; account identifiers, membership role/state, a chosen display name and membership timestamps; hashed invitation codes and their expiry/use limits; and eligible aggregate contribution rows containing a stable contribution identifier, automatic/manual origin, broad activity, language, date, active/passive seconds, revision and timestamps. Titles, URLs, page text, subtitles, searches, account email and manual-entry descriptions are never included in a contribution.

Members of the same space can see member display names, roles/state, aggregate standings, recent aggregate contributions and reaction counts. Reactions store the contribution, reacting account, selected reaction and time. A safety report stores the space, reporting and reported account identifiers, one selected reason and status timestamps; it has no free-text field. Reductions to shared contribution totals are audited, and automatic contribution totals cannot be increased after their first accepted value.

Invitation, contribution, reaction and report writes are rate-limited. Row Level Security and server-owned functions restrict shared-space access to eligible members and administrators. If group sponsorship ends, the group remains active for a 14-day grace period and then becomes read-only; its existing history is not silently rewritten. Account deletion remains available from Account, subject to ownership and integrity rules needed to keep other members' shared records consistent.

Product analytics

Product analytics are off by default and are entirely separate from the account and cloud mirror described above — enabling or disabling either one never affects the other. This control lives in the Account page's Privacy & data card and is independent of signing in.

If a user turns analytics on in Settings, the extension shares small, anonymous usage events containing only:

Product analytics never collect or transmit video or content titles, URLs, search terms, subtitles or captions, page text, or anything typed into a manual entry. A stored analytics event contains no account ID, device ID, session identifier, or stable per-install identifier, and the separate rate-limit hash described below is never stored with or joined to an event.

Analytics events dated more than 12 months in the past are eligible for permanent deletion. The analytics endpoint runs this bounded cleanup at most once per day when it next processes analytics traffic, so deletion can occur later if the endpoint receives no subsequent traffic.

To prevent abuse of this anonymous endpoint, the server temporarily checks how many events are arriving from the same network address, using a one-way hashed version of that address that is stored separately from analytics events and is never linked to them. The hash affects only its fixed one-minute rate-limit bucket. Buckets older than an hour are removed when later analytics traffic runs cleanup; if there is no later traffic, a stale hash can remain stored until that cleanup next runs, but it no longer affects request limits. This check exists only to slow down automated flooding of the endpoint. It does not identify a user, is not used to build any profile, and is not connected to target language, platform, or activity data in any way.

Product analytics can be turned on or off at any time from Account → Privacy & data. Turning it off stops any further events from being shared; because events are never linked to an account or device, previously shared events cannot be individually identified or removed. On-device charts and insights operate from local tracker data regardless of this setting.

User-submitted feedback

The FAQ page includes an optional feedback form. Submitting it sends only the selected category, the message the user types, and the extension version to Supabase. The form asks users not to include passwords, email addresses, URLs, or private viewing details. Feedback is not linked to an account and the endpoint does not accept titles, browsing history, tracker totals, or arbitrary metadata fields. Submitted messages remain stored until they are reviewed or deleted by the operator.

To prevent automated flooding, the feedback endpoint allows at most five submissions per hour from one network address. It stores a one-way hash of that address in a separate rate-limit table, never in the feedback row. Expired buckets are removed when later feedback is submitted; a stale bucket may remain until that cleanup next runs, but it no longer affects the request limit and is not used for profiling.

Data control and retention

Daily totals, dates, and source breakdowns remain on the device until edited, reset, or the extension is removed. Daily records contain date, language, general source, active time, passive time, and session count—not titles or URLs.

Completed local session records may include readable video and manual-action titles, their general source and origin, a bounded channel/show source identity and readable label, a provider-hosted channel avatar or show-artwork URL when the supported player exposes one, and exact active/passive timeline segments. These details stay on the device until the user deletes the session, replaces or resets local data, or removes the extension. Osmolog does not download or maintain its own image library; the dashboard requests the retained provider image URL when it needs to display available artwork. The dashboard reveals complete local History progressively in 50-row batches; popup History remains a latest-ten summary. Local JSON backups include retained session details, bounded source identity, and timelines; when available, they also include the provider artwork URL. CSV exports remain daily aggregates and do not include sub-day timelines. Separate per-video identifiers are not retained in History.

Remembered exact-video, channel, and related-content choices use pseudonymous hashed identifiers for functional matching. As disclosed above, an explicitly saved rule may also retain and Chrome-sync its bounded readable label so the Rules manager remains understandable across devices. These identifiers minimize readable matching data; they are not claimed to provide cryptographic anonymity. Unconfirmed playback time exists only in memory while a language question awaits an answer and is discarded if the user rejects it or leaves the video.

Users can export tracker data as JSON or CSV.

Reset all data clears local and Chrome Sync tracker data. When signed in, it first requests deletion of cloud-mirrored totals and does not clear local data unless server deletion is confirmed. A user who previously used the cloud mirror but signed out must sign in again before resetting if they also want the account's remote rows deleted. Account deletion remains available separately from the Account page.

Security

The extension uses Chrome Manifest V3, executes only packaged code, restricts website access to declared supported services, and transmits tracker totals only to the optional user-account cloud provider after the user reviews the disclosure, signs in, and has active Pro access. Authentication tokens are stored separately from exportable tracker state.

Limited Use disclosure

Osmolog's use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including Limited Use requirements. Information is used only to provide or improve user-facing immersion-tracking features. It is not used for advertising, creditworthiness, lending, or sale to third parties, and is not made available for humans to read except when the user explicitly supplies specific information for support or when required by law or security needs.

Changes and contact

Material changes will be published with an updated effective date. Questions can be submitted through the support channel on the extension's Chrome Web Store listing.