Privacy policy

Contact: support@refleks.dev. Updated: 14 October 2026.

On your device

The extension stores your filter preferences, topics, custom rules, exceptions, cached decisions, feedback and local statistics in Chrome extension storage. These preferences are not uploaded wholesale. Debug diagnostics stay on your device.

Smart filtering

Only after you give permission to use smart filtering, selected page text, titles, bounded context and relevant rules/topics/categories are sent over HTTPS to our filtering service and onward to the configured Jev provider through OpenRouter or TypeSafe. Text may include public personal information present in a post. Editable fields, passwords, private message routes and known sensitive page areas are excluded; exclusion is best effort and site changes can affect coverage. Full page HTML, cookies, passwords and form values are not included in classification payloads.

Public YouTube video IDs are used to retrieve captions from YouTube, sometimes through our server. Selected caption text is analyzed by Jev. If you enable shared sponsor timestamps, video IDs are disclosed to SponsorBlock through our service. The extension can analyze nearby loaded content before it becomes visible.

Optional image filtering (preview)

Image sharing requires separate permission in the extension and is off by default. With that permission and smart filtering enabled, supported public pictures can be checked in posts, comments, articles and cards, including X or Reddit posts and YouTube thumbnails. In current versions, the Check pictures choice includes other public websites. Permissions previously limited to X, Reddit and YouTube keep that scope until you explicitly enable broader coverage. Each checked block has at most one selected picture, which is fetched without cookies or a referrer and converted to a metadata-free PNG. Larger pictures are resized proportionally, normally to a maximum 1024-pixel long edge, without enlarging smaller pictures. Very narrow pictures can retain a longer edge so the short edge stays at least 64 pixels. Source pictures must be no larger than 2048 by 2048 pixels and 4 MB, and the prepared PNG must also fit the 4 MB limit; hidden, animated, private, signed or credential-protected, oversized or unavailable media is skipped. The image pixels, visible caption and relevant rules or topics are sent over HTTPS to our service and to Perplexity Decider v1.1 through OpenRouter. Image URLs, full-page screenshots, private messages, videos, form values and cookies are not included. Only image hashes and decisions are cached persistently in extension storage. For repeated checks in the same document, a prepared PNG may be reused in memory for up to 30 seconds, only after the image server confirms an unchanged source with a matching strong validator or newly downloaded source bytes match. Identical source bytes can share conversion work between independently approved checks. Weak or missing validators and sources that prohibit revalidation require fresh source bytes. This temporary cache is limited to eight pictures and an 8 MiB encoded-pixel memory budget, and is cleared when filtering permissions or policy change, pages navigate or tabs close. Picture pixels are never saved in extension storage. Our application does not store raw images in its account database or application logs; model and hosting providers have their own retention practices. Turning off image permission stops new image checks; turning off smart filtering stops both text and image checks. Detection can make mistakes and does not guarantee coverage.

Accounts and payments

We store your verified email address, an internal user ID, salted password hashes (if you choose a password), hashed session credentials and operator-issued access codes, Paddle customer/subscription identifiers, subscription status and aggregate checking usage. Paddle processes payment details and billing information as merchant of record; our service does not store card numbers. Our configured SMTP provider receives your email address and one-time sign-in or password verification codes to deliver transactional mail. Payment and login data are separate from page text.

Service security

Our server processes request IP addresses to rate-limit sign-in and filtering requests and prevent abuse. Hosting infrastructure also receives connection IP addresses and may retain operational logs under its own retention practices. We do not request GPS coordinates or use IP addresses for advertising.

Retention and sharing

Sign-in and password verification codes expire in 10 minutes and can be used once. We never store your password in plain text. Setting or resetting a password signs out other sessions. Sessions expire after at most 30 days. Operator-issued access codes expire on their stated date, within 120 days, and can be revoked sooner. Webhook deduplication records are kept up to 90 days and aggregate usage up to about 13 months. Account and subscription records are kept while needed to operate the account and meet billing obligations. The service does not persist raw classification text or images in its account database or application logs. Hosting, model, email and payment providers apply their own retention practices; backups may retain data until rotated.

We use this information to provide filtering, authenticate accounts, manage subscriptions and prevent abuse. We do not sell browsing text or use it for advertising. Chrome Web Store Limited Use requirements apply to data received through the extension.

Your choices

You can turn off smart filtering, pause filters or uninstall at any time. These actions stop new extension uploads but do not cancel a paid subscription. Cancel through Manage subscription. Contact support@refleks.dev to request access, correction or deletion of account data. Any records legally required for payment compliance may be retained.