Local-first by design.

What this document covers

Sephir is a Chrome / Firefox extension and a thin web dashboard at sephir.app. This page describes what the extension and the dashboard actually do with data — observed behaviour, not aspirations.

If something in the product disagrees with what's written here, the product is the bug. Email us at hello@sephir.app and we'll fix the side that's wrong.

The short version

• Conversation history lives on your device. Folders, prompts, audit logs, and message bodies are stored in chrome.storage.local. We do not sync them to our servers by default.
• BYOK requests skip our servers. When you bring an API key for OpenAI, Anthropic, Google, Mistral, or OpenRouter, the extension talks directly to that provider from your browser. We never see the prompt or the response.
• ChatGPT Plus OAuth runs on your session. When you sign in with ChatGPT Plus, the Codex endpoint is called with your own browser cookie. Your OpenAI account is the system of record — not ours.
• Telemetry is on by default, and one switch turns it off. Open the side panel, go to Settings → General → Privacy, and flip "Share anonymous usage data". It stops immediately. While it is on we transmit anonymous, aggregated counters — never message bodies.
• The website and the extension are measured separately. The sephir.app marketing site uses ordinary web analytics; the extension does not. Details below.

The website (sephir.app)

This section covers the marketing site and dashboard only. Nothing here applies to the extension, which ships no analytics vendor code at all — Chrome's Manifest V3 forbids loading remote scripts, and we wouldn't want to anyway.

Capsaicin — always on. We self-host our own analytics to count pageviews and referrers. It writes nothing to your device: no cookie, no localStorage entry. Your IP address is never stored — it is mixed with your browser's user-agent and a daily-rotating secret to produce a one-way hash that identifies a session for a single day and then stops matching. Beyond that we keep only coarse location (country, region, city). Because nothing is stored on your device and no personal data is retained, this runs without a consent banner, under the audience-measurement basis regulators carve out for exactly this kind of setup.

Google Analytics and Google Ads — only if you accept. These set cookies and can build a profile, so they stay off until you accept in the cookie banner. Decline and they are never granted storage; the site works identically and we still count your visit through Capsaicin. Analytics and advertising are separate switches — you can accept one and refuse the other. Your choice is stored in your browser and you can change it at any time by clearing site data.

We use Google Ads to measure whether an advert led to an install. If you accepted marketing cookies, the install page reports back that a conversion happened. It reports no identity — Google is told that an install occurred, not who you are.

Account data we store

If you create a sephir.app account (used for the lifetime licence and the eventual encrypted-sync feature), we store:

• Email address — for sign-in, receipts, and the trial-ending reminder.
• Name — display only; you can leave it blank.
• Hashed password — scrypt (N=16384, r=16, p=1) via better-auth, run on the worker's native node:crypto.
• Polar customer ID — to look up your licence and process refunds.

That is it. We do not store payment card numbers (Polar does) and we do not store conversation history, keys, or prompts in any of the dashboards.

Things we deliberately do not collect

• Browsing history. The extension reads page content only when you explicitly invoke a tool against the open tab.
• Tab inventory. We do not enumerate or transmit the URLs of tabs you have open.
• Provider API keys. AES-GCM 256 encrypted in chrome.storage.local on your device; the wrap key is a non-extractable CryptoKey in IndexedDB. Never sent to sephir.app servers in any form.
• Personally-identifying device fingerprints. We do not run a fingerprinting library.

When data does leave your device

There are four narrow cases:

1. You sign in. Email + password go to sephir.app to look up your account and the licence state.
2. You make a Polar purchase or refund. Standard Polar checkout flow handles card data — we never see it.
3. You leave telemetry on. Anonymous event counters are sent to a self-hosted endpoint. It is on by default and you can turn it off in Settings → General → Privacy. We never collect message content.
4. You email us. What you write in an email lives in our inbox like any normal email.
5. You browse sephir.app. The website is measured as described above. Browsing with the extension installed sends nothing.

Third parties we use

• Polar — billing, checkout, refunds.
• Cloudflare Workers + KV — the dashboard backend and CDN.
• better-auth — authentication library (runs on our backend).
• Google Analytics + Google Ads — website measurement and advert attribution. Only after you accept in the cookie banner, and only on sephir.app. Never inside the extension.

Capsaicin is not on this list because it isn't a third party — we run it ourselves on our own infrastructure, which is why we can promise what it does and doesn't keep.

None of these vendors get your conversation history, keys, or tool outputs. They only handle account / billing / website-traffic surface area.

Your rights

You can delete your sephir.app account from the dashboard's account page. Deletion is immediate and irreversible. Polar retains payment records as required by tax law, but your name and email are scrubbed from our side.

You can also disable Sephir entirely by uninstalling the extension. Your local conversation history goes with it — we don't keep a server-side copy.

Changes to this document

If we materially change any of the above, the "Last updated" date at the top will change and existing accounts will get an email. We will not silently weaken the local-first posture.

Contact

Privacy questions, deletion requests, or anything that smells off: hello@sephir.app.