Privacy Policy
100% BYOK Architecture
Bring Your Own Key: You connect your personal API key directly from Google Gemini, OpenAI, or Anthropic Claude.
Zero Data Collection
No telemetry, no tracking scripts, and no intermediate proxy servers. We never see, store, or sell your data.
Isolated Shadow DOM
Your user interface and active prompts run within a secured Shadow DOM boundary, completely isolated from webpage scripts.
Lightning AI ("we", "our", or "the extension") is an all-in-one browser extension designed to enhance your web reading and writing experience with AI capabilities. We are fundamentally committed to protecting your privacy and ensuring complete transparency regarding how your data is handled.
1. Core Principle: Bring Your Own Key (BYOK) & Zero Data Collection
Lightning operates strictly on a Bring Your Own Key (BYOK) client-side architecture:
- No Intermediary Servers: We do not own, operate, or route through any backend proxy server that processes, logs, or intercepts your prompts or data.
- Direct Client-to-API Communication: All AI requests are transmitted directly from your browser client to the official API endpoints of your chosen provider:
- Google Gemini (
generativelanguage.googleapis.com) - OpenAI (
api.openai.com) - Anthropic Claude (
api.anthropic.com) - OpenRouter (
openrouter.ai)
- Google Gemini (
- No Analytics or Telemetry: We do not track your browsing habits, sell user data, or inject any tracking scripts, cookies, or analytics into your browser.
Summary: Lightning is completely serverless from our side. Your tokens, API keys, and prompts flow exclusively between your browser and the AI provider you explicitly configure.
2. Information We Access and How It Is Used
A. API Keys and Settings
- What is stored: Your chosen AI provider, API key, model selection, custom actions, and language preferences.
- Where it is stored: Exclusively inside your browser's local extension storage (
chrome.storage.local). - Access scope: Only the Lightning extension running in your browser has access to this data. It is never synced to external servers or accessible to third parties.
B. Selected Text and Webpage Content
- When it is accessed: Only when you explicitly perform an action (e.g., highlighting text and clicking an action on the Floating Toolbar, right-clicking for a Context Menu action, or clicking "Summarize this page").
- How it is used: The selected text or extracted article content is sent directly to your configured AI provider to fulfill your request (e.g., translation, explanation, grammar correction, or summarization).
- Retention: We do not log, retain, or store your text snippets. Once the AI response stream completes, the text is discarded from temporary memory.
3. Chrome Extension Permissions Justification
In accordance with Google Chrome Web Store policies, here is why Lightning requests specific permissions:
| Permission | Justification & Purpose |
|---|---|
storage |
Stores user configuration, preferred languages, and API keys locally in chrome.storage.local. |
activeTab & scripting |
Extracts readable article content on demand when you explicitly click "Summarize this page" using Mozilla Readability. |
sidePanel |
Displays the persistent companion AI chat panel alongside your web browser tab. |
contextMenus |
Adds quick-access AI options (Translate, Explain, Summarize) to the browser right-click menu. |
<all_urls> (Host Permissions) |
Enables the floating selection toolbar across websites you visit and permits direct network requests from the browser to the official AI provider APIs without intermediate servers. |
4. Third-Party Service Providers
When you use Lightning, your interactions are processed by the AI provider you have configured. Each provider adheres to its own strict enterprise and privacy commitments:
- Google Generative AI: Subject to Google Privacy Policy and Google Generative AI Terms of Service.
- OpenAI: Subject to OpenAI Privacy Policy and OpenAI Terms of Use.
- Anthropic: Subject to Anthropic Privacy Policy.
We recommend reviewing the privacy policies of the respective AI providers you choose to connect.
5. Security & Isolation
- Shadow DOM Isolation: Lightning renders its floating toolbar and modal dialogs inside an isolated Shadow DOM (
mode: 'open') to guarantee that host webpage scripts cannot inspect or interfere with extension UI states or API key prompts. - Secure Token Handling: API keys are never printed to console logs or exposed to host web pages. Direct browser access headers (such as Anthropic direct access headers) are strictly confined to API calls.
6. Children's Privacy
Lightning does not knowingly collect or solicit any personal information from children under the age of 13.
7. Changes to This Policy
We may update this Privacy Policy from time to time to reflect improvements or regulatory requirements. Any updates will be published with an updated "Last updated" date in this document and in the project repository.
8. Contact & Open Source
If you have questions, feedback, or concerns regarding this Privacy Policy, please open an issue or reach out through our official repository: