# Privacy Policy — HideGPT

_Last updated: July 15, 2026_

HideGPT ("the extension") is designed to protect your privacy. This policy explains what the extension does and, just as importantly, what it does **not** do.

## The short version

**The extension does not collect, transmit, or share any personal data.** Everything it stores stays on your device, inside your browser's local storage. There are no servers, no analytics, no trackers, and no third parties involved.

## What the extension does

The extension hides your ChatGPT activity from people looking at your screen by:

- Blurring conversation titles and messages on `chatgpt.com`.
- Collapsing the ChatGPT sidebar.
- Removing `chatgpt.com` visits from **this browser's local history**.

Access to hidden content is protected by a PIN that you set.

## Data we collect

**None.** The extension does not collect any personally identifiable information, browsing data, usage statistics, or any other data about you.

## Data stored on your device

All data the extension keeps is stored locally in your browser via `chrome.storage.local` and **never leaves your device**:

| Data | Purpose | Stored as |
|---|---|---|
| Your PIN | Verifies you when you unlock | A **salted SHA-256 hash**. The PIN is never stored in plain text, and the hashing happens entirely on your device. |
| A random salt | Makes the PIN hash resistant to precomputed attacks | A random value generated on your device. |
| Feature toggles | Remembers which features you enabled (e.g. blur, collapse, history deletion) | Plain on/off flags. |
| Lock state | Whether the extension is currently unlocked | A single boolean. Reset automatically when the browser restarts. |

## Your PIN

- The extension stores your PIN only as a **cryptographic hash** (salted SHA-256), never as readable text.
- Hashing and verification happen entirely on your device.
- The PIN never leaves your device and is not transmitted anywhere.
- The hash cannot be reversed to recover your PIN. If you forget your PIN, it cannot be recovered.

## Permissions and why each is required

The extension requests the minimum permissions needed to function:

- **`storage`** — to save your PIN hash, salt, feature toggles, and lock state locally on your device.
- **`history`** — to remove `chatgpt.com` entries from your **local browser history** when you have that feature enabled. This affects only your current browser's local history.
- **`alarms`** — to run the local history cleanup on a periodic schedule.
- **Host permission for `https://chatgpt.com/*`** — to apply the blur and collapse styling on ChatGPT pages. The extension reads the page structure to apply styling; it does **not** read, collect, or transmit the content of your conversations.

## What the history deletion does NOT affect

History deletion removes `chatgpt.com` entries from **this browser's local history only**. It does **not** affect:

- Chrome Sync history on your other devices.
- Your Google Account's Web & App Activity.
- Records held by your internet service provider, network operator, or ChatGPT/OpenAI.
- Any server-side data.

## Third parties

The extension does **not** use any third-party services. It does not load third-party scripts, does not include advertising, and does not connect to any external server. The only external links are the "Support development" link to Ko-fi (`ko-fi.com`), which you must click voluntarily and which opens in a new tab — no data is sent to Ko-fi by the extension.

## Data of children

The extension is intended for general audiences. It does not knowingly collect any data from anyone, including children.

## Your choices

- You can disable any feature at any time from the extension's popup.
- You can remove all extension data at any time by uninstalling the extension (this deletes the stored PIN hash, salt, and settings).

## Changes to this policy

If the extension's data practices change, this policy will be updated and the date above revised. Any material change will be reflected before or at the time the updated extension is released.

## Open source

The extension's full source code is publicly available, so you can independently verify every claim in this policy.

## Contact

If you have questions about this privacy policy, you can reach the developer via [Ko-fi](https://ko-fi.com/ita07).