Privacy policy

1. Who is responsible

Controller/publisher: Mathieu Gravey

Privacy contact: Contact privacy support

2. Information the extension handles

• Authentication information: OAuth authorization results, a refresh credential, short-lived access credentials, and an account-routing identifier needed to authenticate the user-selected provider account.
• User-provided model content: prompts, conversation context, model settings, selected workspace tool inputs/results, and project text explicitly included in a request.
• Workspace conversation history: resumable transcripts saved only in the user-selected workspace under .loom/conversations/. Sidebar deletion controls remove one conversation or all Loom-owned workspace metadata.
• Operational information: extension version, enabled/authenticated state, request identifiers, bounded byte counts, and sanitized error codes required to run or troubleshoot the bridge.
• Deployment metadata: the non-secret Chrome extension ID remembered by the companion website.

The extension does not request browsing-history, cookies, geolocation, advertising, analytics, or content-script access. It does not inspect unrelated pages or tabs.

3. Why information is used and where it goes

Information is used only to authenticate a user-initiated Loom session and let the authorized workbench perform a direct-first model request with a short-lived credential and relay it through the extension only after a pre-response browser failure.

No information is sold, used for advertising, credit decisions, or transferred to data brokers. No developer analytics or telemetry endpoint is present in the current build. Human access is not permitted except with the user's specific consent, when required for security or abuse response, or when required by law.

No user data is sent to a server operated by the publisher. Authentication data is exchanged directly with OpenAI authentication services. During fallback relay only, model requests and responses pass transiently through the extension between the approved workbench and OpenAI/ChatGPT and are not retained by the extension.

4. Storage, security, and retention

• The refresh credential and account-routing ID use trusted extension session storage by default and are cleared when Chrome exits. If you explicitly choose “Remember sign-in on this Chrome profile” after the private-computer warning, that pair remains in trusted local extension storage. The authorized workbench can request a short-lived access token for its direct-first model fetch; it cannot request the refresh or ID token, and access and ID tokens are not persisted by Loom.
• If direct browser access fails before an HTTP response, the extension relay processes the prompt, selected project context, tool traffic, and response stream. HTTP errors, stream failures, and cancellation are not retried through the relay.
• Pending browser-login state is stored in Chrome session storage and removed after a completed callback, handled failure, retry, logout, disable, or browser shutdown. An abandoned tab may retain its exact tab-scoped rule until one of those cleanup events.
• Exact website origins approved by the user are stored in trusted local extension storage until revoked or the experiment is disabled. Pending origin requests remain session-only. A manifest match alone does not authorize credential delivery.
• Provider network traffic uses HTTPS. Credentials are never intentionally written to website storage, workspaces, browser runtimes, logs, or diagnostic errors.
• Authentication state remains until logout, disable, provider revocation, credential rejection, browser shutdown when remembrance is off, extension-data clearing, or uninstall. Persistent local storage is not an encrypted credential vault; anyone able to use the same unlocked Chrome profile may be able to use the connected account.
• The companion website may retain the non-secret extension ID and OPFS project selected by the user; these can be removed through browser site-data controls.

Local deletion does not itself revoke a provider-side authorization grant. Follow the provider's verified account-security instructions if revocation is required.

5. Your controls

• The bridge is disabled by default and handles authentication only after explicit opt-in and button activation.
• Remove stored authorization and disabling the experiment delete extension-owned authorization state from both session and persistent storage.
• Turning off Remember sign-in on this Chrome profile removes the local copy and keeps any current authorization only until Chrome exits.
• Uninstalling the extension removes its Chrome storage.
• The user chooses which project directory or uploaded archive the website may access.
• The sidebar selects read or read/write access before a direct folder opens. Chrome requests that permission when the folder is selected; later agent and browser-runtime operations follow it without another prompt for every run. Read-only execution discards filesystem changes.

6. Privacy rights and international processing

Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing, and to complain to a privacy authority. Contact the publisher to exercise applicable rights. Provider processing and international transfers are also governed by the terms and privacy policy of the provider account you choose.

This extension is not directed to children and should not be used by anyone who cannot lawfully agree to the provider and publisher terms.

7. Contact and policy changes

Privacy/support: Contact privacy support

Security: Report a security issue

Material changes to data practices require an updated policy and prominent in-product disclosure before the changed practice begins.