Last updated September 23, 2026

Privacy Policy

Caveatly is a Chrome extension that reads a website’s Terms of Service and Privacy Policy with AI and flags what matters. It has no server, no account, and no analytics. This page explains exactly what it handles.

What Caveatly sends, and to whom

When you scan a site, Caveatly sends two things to Google’s Gemini API (generativelanguage.googleapis.com), using the API key you entered:

• the text of the site’s Terms of Service and Privacy Policy pages, and
• the site’s domain name (for example, example.com), so the summary can name it.

That is the only data that leaves your browser. Caveatly never sends your browsing history, the contents of other pages, form entries, passwords, or anything that identifies you. Google handles this data under the Gemini API Terms of Service. If you use Gemini’s free tier, those terms allow Google to use submitted content to improve its products; a paid Gemini key changes that.

To find and read the legal pages, Caveatly also loads them directly from the website you are on, just as your browser would if you clicked the links.

What Caveatly stores on your device

• Your Gemini API key, in chrome.storage.local. It stays on this device, is never synced, and is only ever sent to Google’s Gemini API.
• Scan reports for the sites you scanned, in chrome.storage.local, so you don’t have to re-scan. These include the site’s domain and the flagged clauses.
• Prompt choices, such as dismissing the on-page scan prompt for a domain, in chrome.storage.local.
• Your settings (the on/off toggles and scan mode), in chrome.storage.sync. If you use Chrome sync, Google syncs these toggles between your devices. Your API key is never included.

Removing the extension deletes all of this.

Privacy features

Depending on your settings, Caveatly clicks “necessary only” or “reject all” on common cookie banners, sends the Sec-GPC: 1 Global Privacy Control signal to sites you visit, and removes tracking parameters such as utm_*, gclid and fbclid from links you open. All of this happens locally, in your browser.

What Caveatly does not do

• It does not sell or share your data with anyone.
• It does not use your data for advertising, credit decisions, or anything unrelated to explaining the legal pages you scan.
• It has no analytics, tracking, or crash reporting, and it runs no remote code.

Why it needs access to all websites

Terms and privacy links can appear on any website, and the cookie-banner, Global Privacy Control and tracking-parameter features apply wherever you browse. Caveatly reads a page only to find those links and banners; it never collects or sends page contents except the legal documents you choose to scan.

Children

Caveatly is not directed at children under 13 and does not knowingly collect any information from them.

Changes and contact

If this policy changes, the new version will be posted on this page with a new date. Caveatly is open source, so you can check every line of the code on GitHub. Questions? Open an issue on GitHub.