Aside View the project

Privacy Policy

Last updated

Your reading stays in your browser until a feature sends content to the model service you choose.

Aside (旁白) is an open-source browser extension maintained through worldtheater/aside. This policy covers the extension and this policy page. Aside has no developer-operated relay, analytics service, or sync server. Optional encrypted configuration sync is provided through Chrome Sync.

Data on your device

Aside uses browser extension storage and local databases to provide its features. The extension does not send these stores to the developer.

Settings and connections
Your preferences, custom instructions, per-site settings, model service addresses, model names, and API keys. Keys are used to authenticate requests to the service you configure. API keys and their local sync-record copies are encrypted with AES-256-GCM. A separate, non-exportable device key is stored in this browser’s IndexedDB and is not synchronized. It remains available across browser restarts and extension updates. Existing plaintext credentials are converted on upgrade; this does not rewrite old backups or guarantee secure erasure of historical disk data. This protection is not an operating-system keychain and does not prevent access by a compromised extension or someone able to read the full browser profile.
Collections and reflections
Passages you save, original and processed text, page titles and URLs, action names, save dates, and your reflection settings and latest saved reflection.
Request history
Model and connection names, timestamps, status, token counts, instructions, submitted content, and received output. Failed or interrupted calls may retain partial output. Connection credentials and authorization headers are not added to this history. Known configured API keys are redacted from new request details and results, including streamed output. Previously stored history is not rewritten.
Result cache
Previously generated results and cache identifiers, used to avoid repeating the same model request. Results can contain personal information from the source text.
Recent tabs
Tab and window identifiers and their activation order, held in browser session storage so the shortcut can switch between recently viewed tabs. This feature does not maintain a permanent URL history.

Optional configuration sync

When you enable Configuration sync, Aside sends an encrypted copy of your model connections and API keys, actions and custom instructions, and reflection settings to Chrome Sync, operated by Google. Collections, generated reflections, request history, caches, and discovered model lists are not included. Language, theme, display and site preferences, quick-action visibility and order also stay on each device. Default model selections are included as encrypted suggestions, used only to fill unset defaults on another device. Existing choices are kept. Record IDs, modification times and deletion markers are included in the encrypted configuration to merge changes across devices. This feature uses your Chrome account; it does not create an Aside account or send data to an Aside server.

The configuration is compressed and encrypted on your device using AES-256-GCM. A key is derived from your passphrase using PBKDF2-HMAC-SHA-256 with a random salt and 600,000 iterations. Sync storage contains ciphertext, salt, an initialization vector, revision identifiers, and update timestamps. The passphrase is not saved or uploaded. The derived key is held in trusted extension session storage and is cleared when Chrome restarts or the extension is reloaded. The maintainers cannot recover a forgotten passphrase. Local settings remain available while sync is locked. Local API key encryption uses the separate device key described above and does not depend on the sync passphrase.

Chrome manages delivery between devices according to your Chrome account and sync settings. Google's handling of its service is governed by the Google Privacy Policy. You can stop syncing on one device without deleting its local settings. Delete synced settings removes the encrypted copy through Chrome Sync; delivery of that deletion to other devices is controlled by Chrome. Local settings on those devices remain, and need a new sync setup to resume syncing.

Model requests

When you translate, explain, summarize, preview an action, or submit a question, Aside sends the required text and instructions directly to the service URL saved in Model connections. Depending on the feature, this may include selected text, extracted page content, your question, a quoted passage, and context such as page titles, section titles, or table headings. That content may contain personal or sensitive information.

After you start inline page processing, additional visible or nearby passages may be sent as you scroll or the page changes. Quick Q&A prepares a quote from your selection or the page, but does not send the question until you submit it.

Today's thought can run automatically: with a model configured and the reflection area visible, the first visit to Collection each local day can generate a reflection. Preview and refresh also send requests. If Use my collection is enabled, a request includes titles and excerpts from up to five saved passages, together with your instructions and the date.

The recipient is the operator of the model endpoint you choose: for example, OpenAI, Anthropic, Google, xAI, another compatible provider, or a local server you control. The service receives the request content, authentication information, and normal network metadata such as your IP address. Its own terms and privacy policy determine retention, processing location, and any use for model training. Aside does not control those practices.

Testing a connection sends an authenticated request to retrieve its model list; it does not submit page text for generation. Requests do not pass through an Aside server.

Other connections

Website appearance. Dark mode uses the bundled Dark Reader engine locally. It may retrieve stylesheets or images referenced by the page from their original hosts, which receive normal network metadata. Dark mode does not send page content to a model. Site icons are requested through Chrome's favicon interface.

This page and support. This static page is hosted by GitHub Pages. It contains no analytics, advertising, third-party fonts, or scripts. GitHub may process technical visit data, including IP addresses, under the GitHub Privacy Statement. If you open a project link or submit an issue, GitHub handles that interaction, and information you post in a public issue is visible to the maintainers and others.

Your controls and retention

Settings, collections, and request history have no scheduled expiry. They remain in your browser until you remove them, clear extension data, or uninstall Aside. The result cache has a size limit and evicts older results as needed. Session tab records are cleared when the browser restarts or the extension is reloaded. A new saved reflection replaces the previous card; its request may still remain in history.

  • Delete saved passages from Collection.
  • Use Configuration sync to stop this device's synchronization or delete the encrypted synced copy. Local configuration is preserved.
  • Clear request history from Usage to remove both summaries and input/output details. Clear the result cache separately on the same page.
  • Delete a connection from Model connections to remove its saved API key. Revoke the key with its provider if you want to invalidate it.
  • Disable Use my collection to stop including saved passages in future reflections. Hide Today's thought to stop its automatic generation; hiding it does not erase the saved text or history.
  • Stop page processing, restrict site access in Chrome, or disable the extension to stop the corresponding page features. Uninstalling removes the extension's local data.

These stores are independent: deleting a passage or connection does not remove copies already recorded in history or generated results in the cache. Local deletion does not delete requests retained by a model provider. Contact that provider to exercise controls over its copies. The Aside maintainers cannot access or erase data stored only in your browser.

Security

Remote model endpoints must use HTTPS. HTTP is allowed only for loopback addresses on your own device. API keys are kept in restricted extension storage and are not provided to web page content scripts. Local storage is not an encrypted password vault; protect access to your device and browser profile.

Aside uses page access for reading tools and appearance changes, extension storage for local settings, data, and optional encrypted Chrome Sync, and service-specific permissions for model requests. It does not use these permissions to build advertising profiles.

Limited use

Aside uses user data only for the features described in this policy, consistent with the Chrome Web Store User Data Policy and Limited Use requirements. The developer does not sell user data, use it for advertising or credit decisions, or collect reading content to train models. Aside has no telemetry or behavioral analytics. Your chosen model service's separate practices are described above.

Changes and contact

We will update this page and its date when data practices change. Material changes will also be disclosed through the extension or its release information as appropriate.

For questions about this policy, contact the maintainers through the Aside issue tracker. Issues are public: do not post API keys, private page content, or other sensitive information.