Privacy Policy

Account data: email address, profile preferences, subscription and trial status, and onboarding answers you provide.

Study content: notes, canvas blocks, saved AI responses, and how you organise material by medical area and topic.

AI sessions: questions you ask, page context sent with queries, AI responses, session summaries, and feedback ratings.

Extension context: text you highlight on a webpage and a truncated excerpt of page text (up to 4,000 characters) when you open the side panel.

Usage data: query counts, feature usage, access limits, auth outcomes, payment recovery status, and other analytics events to improve the product (no prompt or page content is sent to analytics tools).

Structured data is stored in Supabase PostgreSQL in Australia (ap-southeast-2). Notes, chat history, and canvas images are stored in Cloudflare R2. Access is protected by row-level security so you can only read and write your own data.

• Supabase — authentication and database
• Google Gemini — primary AI responses (server-side only)
• Groq — fast AI tasks such as chips and summaries (server-side)
• PostHog (EU) — product analytics and session replay
• Sentry — error monitoring, performance tracing, and replay on errors
• Creem — subscription payments
• Resend — transactional email
• Cloudflare R2 — file storage
• Vercel — application hosting

AI and payment API keys never ship in the browser extension or client bundles. All sensitive calls go through capsapp.xyz API routes.

The extension requests these permissions:

• Storage — keep your login session and highlighted page context
• Active tab — read text you select on the page you are studying
• Side panel — show the CAPS study assistant beside your tab
• Alarms — periodically sync your login session with the web app
• Site access — connect to capsapp.xyz and work on qbank and study sites

Questions about this policy: tmk@capsapp.xyz