What we receive
When you press Scan, the extension sends the analysis API exactly three things:
- the text of the page you're scanning, cleaned of navigation and page furniture,
- the page's title,
- the page's URL.
Nothing else. No browsing history, no other tabs, no form data, no credentials.
What we store
Nothing. The page text lives in memory for the duration of the analysis, the report is sent back, and the memory is released. There is no database, no file storage, no cache, no queue. Reload this claim against the source: neither the API nor the analysis code imports a storage library.
What the logs contain
The API's only log line is its own startup message. Request bodies are never logged. Our hosting provider (Vercel) records invocation metadata — time, status code, duration — not page text.
AI providers
The API we host runs with AI disabled. Scoring and detection are performed by fixed rules on our own infrastructure — no third-party AI service receives your text.
For completeness: the codebase supports optional semantic analysis for people who self-host. If you enable it with your own API key, up to 80 paragraphs (500 characters each) of the scanned page are sent to the AI provider you configure, and what comes back is paragraph numbers and category names. Exetazo's own hosted API sends nothing to anyone.
Browser permissions
activeTab— run the extractor on the page you're scanning, and only after you click Scan.scripting— that's what inserts the extractor.sidePanel(Chrome) / sidebar (Firefox) — shows the report next to the page. The same UI in both browsers.storage— remembers your last report for this browsing session.
No host permissions beyond the analysis API it talks to. No remote code — the extension executes only its own bundled files.
What the extension keeps
Your most recent report — the findings, plus the page's URL and title — in the browser's session storage. It is never synced anywhere and is erased when you close the browser. Close the browser, and Exetazo has no memory of you.
Analytics and telemetry
None. Not in the extension, not in the API, not on this site. No accounts, no cookies, no tracking pixels, no crash reporting.
One disclosure in the spirit of full honesty: this website loads its typeface from Google Fonts, which is the only third-party request the site makes. The extension and the API make none.
Retention and deletion
There is nothing to delete, because there is nothing retained. Server-side: nothing survives the request. Browser-side: session storage clears on close, and clearing a site's data in your browser settings removes the rest.
If this ever changes
This page is the contract. If a future version of Exetazo handles data differently, this page changes with it — and the open-source history shows exactly what changed and when.