What the extension stores and sends

Stored in your browser

• A sign-in token — created when you approve the extension on the device page. It lets the extension read your browser shortcuts, search artifacts you can already open, and add a shortcut when you press Save. It cannot rename or remove a shortcut, publish, install, review or change anything else, and it expires after 90 days.
• A short-lived copy of your shortcut list — the alias, title and status of each shortcut, kept for about a minute so the list opens quickly. It is held in memory and is gone when the browser closes.

The text of an artifact is fetched when you choose a shortcut and is never written to disk.

Sent to Deftro

• Sign-in requests — a request for a sign-in code, and checks for whether you have approved it.
• Requests for your own shortcuts — the list of your shortcuts, and the text of the one you choose. Each request carries your sign-in token so Deftro can check that you may still read that artifact.
• Searches and saves — in the Browse tab, the words you type after // are sent as a search, the most-used public tags are fetched for the filter chips, and pressing Save adds that artifact to your shortcuts.

These requests go only to Deftro. When a shortcut points to an organisation's artifact, Deftro records that you used it in that organisation's Activity. Nothing is sent to anyone else.

Never

• Reads or sends your conversations — the extension looks only at the few characters before your cursor in the message box, to notice //. It does not read the chatbot's answers or your earlier messages. Apart from a Browse search, what you type is never sent to Deftro.
• Tracks your browsing — it runs on the named chatbot websites only, keeps no history and has no analytics.
• Sells or shares data — nothing it handles is sold, shared with advertisers or given to another company.
• Loads remote code — every script it runs ships inside the extension.
• Sends a message for you — it inserts plain text into the message box. You read it and press send yourself.

Permissions, and why

• storage — to keep the sign-in token and the short-lived shortcut list.
• alarms — to check, while you are signing in, whether you have approved the code.
• Access to Deftro — to sign in, fetch your shortcuts, search and save.
• Access to chatgpt.com, chat.openai.com, claude.ai, gemini.google.com and grok.com — to show the shortcut list above the message box on those sites and insert the text you choose. The extension has no access to any other website.

Revoke it

Open Settings and find the browser under Connected devices. Revoking it ends the extension's access on its next request. You can also remove the extension from your browser, which deletes everything it stored there.

Contact

Questions about the extension, or about your data: sales@baton-vault.vercel.app. The service itself is covered by the privacy page.