BuddyWolfyBuddyWolfy

Privacy Policy for BuddyWolfy Extension

Last updated: October 8, 2026

1. Information We Collect

1.1 Account Information

  • The extension has no email and password form. You sign in with Google or Apple on buddywolfy.com (/extension-login), and the website then hands a session token to the extension. The extension never sees your Google or Apple password.
  • Your account details (account ID, username, email, role, email verification status) returned by our server after sign-in
  • A session access token issued by our server (the extension does not store a refresh token)

1.2 Content You Explicitly Submit

  • Words or phrases you select on a webpage and explicitly choose to analyze (sent to our server for vocabulary analysis)
  • Text you select and explicitly choose to translate (sent to our server for translation)

1.3 Preferences and Local Settings

  • Selected vocabulary group and last-used language
  • Translation source and target language preferences
  • Theme preference (system, light, or dark)
  • List of websites where you have disabled the extension
  • Temporary "disable for 1 hour" timestamp

2. What We Do NOT Collect

  • We do not read or collect the content of webpages you visit. The extension only reads the text you explicitly select.
  • We do not track your browsing history, URLs, clicks, scroll, or typing.
  • We do not collect device identifiers or your location. Like any website, our server sees your IP address when the extension sends it a request; our main Privacy Policy explains how server logs are kept.
  • We do not use analytics, telemetry, error tracking, or advertising SDKs of any kind.
  • We do not read or write browser cookies. The extension does not request the cookies permission.

3. How We Use Information

  • To authenticate you with your BuddyWolfy account
  • To analyze words you submit and add them to your vocabulary groups
  • To translate text you explicitly request to translate
  • To remember your preferences locally between sessions

4. Data Storage

All extension data is stored locally on your device using the browser's extension storage API (chrome.storage.local). The extension does not use browser cookies, localStorage, or sessionStorage.

The following items are stored locally:

  • accessToken — Your session access token. The extension does not store a refresh token.
  • customer — Your account details (account ID, username, email, role, email verification status).
  • accountOwnerId — The ID of the signed-in account, used to clear account-specific items (last vocabulary group, selected word, pending action) when a different account signs in.
  • lastLanguage, lastGroupId, lastGroupName — Your last-used learning language and vocabulary group.
  • lastSourceLang, lastTargetLang — Your translation language preferences.
  • theme — Your UI theme preference (system, light, or dark).
  • excludedSites — List of hostnames where you have turned off the extension's floating UI.
  • disabledUntil — The time at which a temporary pause of the extension ends.
  • selectedWord — The word you picked from the right-click menu, kept until the popup shows it.
  • pendingAction — A one-time action for the popup to carry out when it next opens.

Signing out clears accessToken, customer, accountOwnerId, lastGroupId, lastGroupName, selectedWord, and pendingAction.

You can clear all extension data at any time by removing the extension or by using your browser's extension storage controls. Doing so will sign you out.

To delete your BuddyWolfy account and the data stored on our servers, use your account settings on buddywolfy.com or the mobile app (Profile → Delete account), as described in our main Privacy Policy. The extension is then signed out on its next request and clears accessToken and customer; the remaining preferences stay in your browser until you remove the extension.

5. Data Sharing

  • We do not sell your data or use it for advertising. Our server shares the text you submit with the service providers below, which process it on our behalf.
  • Text you choose to translate is sent from our server to the Google Cloud Translation API.
  • Words you choose to learn are analyzed by AI models, which also translate the word and its examples into other languages: our server sends them to OpenAI and, through OpenRouter (a routing service), to models from Google (Gemini), Mistral AI, Deep Cogito, OpenAI, and Anthropic.
  • Pronunciation audio for your words is generated with Google Cloud Text-to-Speech.
  • The extension sends your data only to https://buddywolfy.com, over HTTPS. Its only other request is for the fonts below.
  • The extension popup loads the "Nunito" and "Nunito Sans" fonts from Google Fonts (fonts.googleapis.com, fonts.gstatic.com) for display only. As with any web font, Google receives your IP address and browser details when the fonts load. No account details or text you select are sent to Google.
  • We do not use third-party analytics, advertising networks, or marketing trackers.

6. Permissions Explained

  • storage — Required to save your session token, account details, and preferences locally on your device, as described in section 4.
  • activeTab — Used only to read the hostname of the current tab so the extension can check whether you have disabled it on that site. The extension does not collect URLs or page content.
  • contextMenus — Required to add the "Learn … with BuddyWolfy" option to your right-click menu when you select text.
  • Host permission for https://buddywolfy.com/* — The only domain the extension is allowed to communicate with.

7. Content Script Behavior

The extension runs a content script on webpages so it can respond when you select text. It only reads the text you have explicitly selected (when between 1 and 800 characters and not inside an input or editable field). It reads the page's hostname to check whether the site is on your excluded list. No other page content, metadata, or browsing activity is accessed or transmitted. Data is only sent to our server when you explicitly click the "Learn" or "Translate" button.

A second content script runs only on the buddywolfy.com/extension-login page. After you sign in with Google or Apple there, it passes the session token from the website to the extension. In Chrome, the website can instead hand over the token through the browser's extension messaging.

8. Contact

For questions about this privacy policy, contact: [email protected]