Sunseed · Last updated: [publication date]
Draft: this policy is not in effect yet.
Sunseed is a browser extension that reads the questions on a web page and answers them with an AI model (Claude by Anthropic, or ChatGPT by OpenAI). This policy explains what personal data we process when you use Sunseed, why, for how long, and what your rights are.
Sunseed is run by [name or company name], [address, country] (“we”, “us”). We are the controller of your personal data. Contact us at support@sunseed.io about anything in this policy.
| Data | Why |
|---|---|
| Account: your email address, your name if you give one, and your password in hashed form (we never store the password itself), and when you created the account and last signed in | To create your account and let you sign in |
| Plan and usage: your plan, any custom request limit, and how many requests you've made this month | To apply the limits of your plan |
| Request details: for each question you send, the AI provider and model, the reasoning level, the number of tokens used, how long it took, the outcome (answered, declined, failed or cancelled), the size of the request (how many images and files, and how much text) and of the answer (how many answers, and how many the AI marked as sure, likely or a guess), and the time. Not the content itself | To run and improve the service, prevent abuse, and keep track of costs |
| Terms acceptance: which version of the Terms of Service you accepted, and when | To show that you agreed to them |
| Sign-in sessions: a hashed identifier for each device you're signed in on, and the browser's description of itself (its “user agent”) | To keep you signed in, and to detect and stop stolen sessions |
| Changes made to your account by us: when we change your plan or request limit, disable or enable your account, reset your password, sign you out or delete your account, we record what changed, when and by whom | Accountability, and to answer questions about your account |
| Technical data: your IP address, in our server's logs and in the counters that limit how many requests can come from one network | Security, abuse prevention and troubleshooting |
When you click Ask, the extension sends the page's text and pictures, a screenshot if you chose that, any files you attached, and any extra instructions you typed. Our server passes this content to the AI provider you selected and streams the answer back to you.
Saved tests. If Save my tests to my account is on (it is by default), we keep this content together with the answer as a saved test in your account: the page text, the pictures, the screenshot, the attached files, the answer, the right/wrong marks you add, and the explanations you ask for. We keep it so you can review your tests and have answers explained in the Sunseed web app, on any device. Pictures and files are stored encrypted. We keep saved tests until you delete them (one by one or all at once, in the web app) or your account. You can turn saving off at any time in the extension's Settings or in the web app; tests saved before stay until you delete them. You can download all your saved tests as a ZIP file.
With saving off, we don't store this content. It isn't saved on our server or in our database, and it is never written to our logs; it exists on our server only while your request is being answered.
When you ask for an explanation of an answer, we send the saved test, the earlier answer and your question again to the AI provider. The AI provider receives the content and handles it under its own terms (section 4). Your settings and attached files are also kept in your browser, and you can delete them in the extension at any time.
[Lawyer check: saving content that may include third-party test material (copyright), and content from users who may be minors.]
We don't sell your data, share it with advertisers, or use it to show you ads. We use it only to provide Sunseed.
To run the service, we can see your account and usage details (listed in section 2) in our administration tools, for example to change your plan or answer a support request. Our administration tools don't show the content of your questions or your saved tests: only how many tests you have saved and how much storage they use.
Anthropic and OpenAI are based in the United States, so the content of your questions is transferred outside the European Economic Area. These transfers are protected by [the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses: confirm with each provider's data processing terms].
| Data | Kept for |
|---|---|
| Account data | Until you delete your account |
| Sign-in sessions | Each sign-in token expires 30 days after it's issued, and its record is deleted 7 days after that |
| Request details | 90 days. If you delete your account sooner, they're kept until then without any link to you. |
| Saved tests (content, answers, marks, explanations) | Until you delete them, or your account |
| Monthly request and explanation counts | 13 months |
| After you delete your account: a one-way, keyed hash of your email address and the number of requests you made that month | Until the end of that month. If an account with the same email is created that month, it starts from the same count, so the free requests can't be reset by deleting and re-creating an account. |
| Record of changes we made to your account | 2 years. If your account is deleted, the record keeps only a one-way, keyed hash of your email address, not the address itself. |
| Server logs (with IP addresses) | A short time. Logs are rotated automatically and the oldest are deleted first. |
| Per-network request counters | In memory only, for up to 24 hours |
You have the right to:
To use these rights, email support@sunseed.io. We'll reply within one month.
Sunseed doesn't use tracking. The extension stores your settings, your sign-in session and your attached files in your browser's extension storage. Signing out removes the session; removing the extension removes everything in the browser (your saved tests stay in your account). The web app uses one cookie, only to keep you signed in; it's strictly necessary and ends when you sign out.
All connections to our server are encrypted (HTTPS). Passwords are hashed with Argon2id, and sign-in tokens are stored only as hashes. Sessions that look stolen are ended automatically. Pictures and files in saved tests are encrypted at rest, and only you can open your saved tests.
Sunseed isn't meant for children under 16. If you're under 16, you may use it only with the consent of a parent or guardian.
If we change this policy, we'll update the date at the top. If the changes are significant, we'll tell you in the extension or by email before they take effect.