This page is the complete privacy policy for the Osmolog Chrome extension.

Privacy Policy for Osmolog

Effective date: October 14, 2026

Osmolog records active and passive language-immersion time on supported media websites, records active reading time on article websites the user individually enables, and records activities the user adds manually. This policy explains the information the extension handles and how it is used.

Information handled

To provide tracking, the extension processes:

Fully manual counting treats eligible supported-site playback as the selected target language without performing language checks. Automatic mode normally identifies spoken language from player-provided audio and caption metadata. Weak page-title evidence may suggest an option when asking the user, but does not automatically confirm the spoken language.

The extension does not read passwords, payment information, or cookie contents. A page containing a password or payment field is never eligible for reading tracking. Outside declared media services, ongoing tracking requires the user to add an individual custom video or reading website and approve Chrome's site-access prompt. When the user opens the Osmolog toolbar popup on another website, Chrome's temporary active-tab access lets the popup check for HTML video elements and their playback state, including accessible same-origin frames and open shadow roots. This bounded check returns only presence/playback flags, does not read page text or capture audio, and does not store or transmit its results. The popup can also use Chrome's tab-audible flag to suggest adding a website. No custom-video time is recorded until the user chooses a language and approves site access.

On an enabled reading website, Osmolog runs only on ordinary HTTP or HTTPS article pages. Browser-internal pages, extension pages, local files, PDFs, Google Docs, ebook readers, and app-like editors are not supported. The worker reads a bounded visible-text sample locally to identify Japanese, Korean, or Chinese when the page's language declaration is insufficient. The sample and computed character ratio are immediately discarded. Page text, page titles, full URLs, paths, query strings, selections, and scroll positions are never stored or transmitted. A reading session stores only the enabled hostname, duration, language, activity type, and timestamps in the same local history used for other sessions. Reading starts only after the user presses its control, and time accrues only in the focused, visible tab while recent reading activity is present. The reading-site permission list stays on that browser and is excluded from Chrome Sync, account sync, product analytics, feedback, and Groups. Removing a reading website unregisters its worker and revokes its optional site access.

Custom video tracking reads ordinary HTML-video playback state on an individually approved website and uses the language selected by the user. The custom-video site-access configuration stays in local extension storage and is not included in Chrome Sync, product analytics, feedback, or Groups. Recorded custom-video sessions follow the same history rules as other sessions: their hostname source label and page title remain local unless the user has explicitly enabled Pro full backup, whose disclosure includes complete session titles and source labels. Removing the website revokes its optional access. When a supported provider exposes artwork only through its own signed-in page session, Osmolog may make a same-provider request from that page to obtain the artwork URL; it does not copy or transmit the provider's cookies elsewhere. YouTube, Netflix, Twitch, and Crunchyroll are labelled Supported and available by default. YouTube Music is labelled Beta and is also available by default. Spotify, supported podcast web players, and additional streaming services are labelled Experimental and shown only when the user enables the Experimental list. Generic webpage audio is not enabled because arbitrary pages cannot reliably separate content from ads or interface sounds.

The optional Windows MPV companion runs locally and connects to the extension through loopback after the user grants Chrome's local-host permission. On first run it opens a five-minute local connection window that accepts Chrome-extension Origins only and stores the verified Osmolog extension ID locally. If Osmolog is later reinstalled with a different ID, the user must explicitly select Reconnect Osmolog in the companion before the new extension can replace the trusted ID. Folder-to-language rules and full media paths remain in %APPDATA%\Osmolog and are evaluated only by the companion. Completed segments are journaled there until the extension acknowledges them; unassigned-language segments are retained in extension storage until the user assigns them. The configured Chrome-extension Origin check blocks ordinary websites but is not intended to defend against a determined process already running on the same computer. The installed companion checks its public GitHub Releases feed over HTTPS and downloads newer installers automatically; GitHub receives ordinary request information such as the network address and user agent, but no media titles, paths, activity, languages, settings, or Osmolog history. The portable companion performs no automatic update checks. The companion sends no data directly to Osmolog or Supabase.

Steam games

Steam tracking is optional and off by default in Osmolog Companion. When enabled, Companion reads local Steam library manifests and observes game-window focus and keyboard/mouse/XInput idle state. The paired extension receives only the current game's app ID, optional title, language, timing, and bounded tracking/settings status. Full paths, process IDs, raw input, and the installed library stay inside Companion. No Steam account, public profile, credentials, or third-party Steam website is required. Per-game language/exclusion preferences remain in local Companion configuration. Recorded Gaming sessions follow the same local history, export, and optional sync rules as other sessions; app IDs can identify games even when Companion title recording is disabled.

Channel, artist, show, and artwork information

Osmolog's Sources view can group locally retained sessions by a bounded channel, artist, or show identity and display the readable name, recorded time, share, session count, and available provider artwork. For episodic services, the local session title may also contain the season, episode number, and episode name exposed by the player. Provider logos, such as the YouTube, Netflix, and Twitch marks, are packaged inside the extension and do not require a network request.

When a supported player exposes a channel avatar, artist image, or show artwork, Osmolog may retain the provider-hosted image URL with the session. It does not retain a separate individual-video thumbnail. The dashboard displays available artwork by requesting that retained URL directly from the provider or its image-delivery service. That provider receives the ordinary image request, which can include the user's network address and standard request information under the provider's own privacy practices. Osmolog does not proxy the request or copy the image into an Osmolog-operated image library. The retained URL stays in local extension storage, is included in a deliberate local JSON export, and can be included in live Pro Sync. Automatic cloud recovery snapshots omit provider artwork URLs, so restored artwork may be unavailable; it is never included in Free Basic Sync, product analytics, feedback, or Groups. It can be removed by permanently deleting the session, resetting data, or removing the extension.

How information is used

Information is used only to:

Local storage and Chrome Sync

Tracker history and settings are stored in Chrome extension storage on the user's device. Free Basic Sync stores a separate random contributor ID for each installation; lifetime total, aggregate active seconds and aggregate passive seconds by language; combined daily total, aggregate active seconds and aggregate passive seconds for the latest 12 months; goals, language settings and selected safe settings; compact format/version data; and reset markers through chrome.storage.sync, which is operated by Google and subject to the user's Chrome and Google account settings. Sources, activities, exact times, session rows, titles, URLs and descriptions remain local. Separate device contributions are added together for the displayed total and permanent session IDs are not placed in Chrome Sync. Chrome Sync extension storage is not treated as encrypted storage.

Basic Sync does not contain session records, session IDs, source or activity values, titles, readable channel/show labels, manual descriptions, URLs, searches, subtitle or page text, exact times, or session timelines. Optional older calendar data is compacted before lifetime totals if Chrome Sync approaches its quota; the Account page warns at approximately 75% and 90% use and offers a full local JSON export. Older detailed Chrome Sync entries created by a previous extension version are converted to the current compact contract and removed when the new Basic Sync contract runs.

The popup's collapsed Detection details panel is transient and local. Its sanitized copy action includes only the provider and adapter names, detected language codes/names, decision/conflict state, scan timing, and—when local detection was used—the bounded model confidence and sample duration. It excludes audio, page URLs, video titles, channel/source names, content identifiers, and account/profile data. The extension does not keep a diagnostic event log or transmit these details.

To avoid repeating the same first-time provider guide or unresolved-playback tip, the extension keeps separate local-only education metadata containing only the education version, a closed provider identifier (YouTube, Netflix, or Crunchyroll), bounded shown, dismissed, or resolved timestamps, and a short-lived pending-claim expiry used to ensure a guide or tip was actually displayed. It contains no URL, title, content or source identifier, language, account data, or detection evidence, and is excluded from Chrome Sync, backup/export, cloud sync, analytics, and diagnostics.

Osmolog has no advertising SDK and no in-extension payment integration. It does not sell or rent tracker data. The dashboard and popup read the same extension data. See "Product analytics" below for the separate, off-by-default, consent-based analytics contract.

Free Basic Sync reset advances a shared generation so older entries cannot restore previous progress. Older-generation physical items may remain in Chrome Sync until overwritten; Osmolog does not delete reused keys during retry because another device may already have stored new progress there. This is logical reset protection, not a claim to erase Google's historical copies.

Optional account, Pro Sync, and recovery backup

Signing in is never required. Local tracking, goals, history, and exports work without an account and remain available without Pro access or after the user signs out.

Supabase is used as the third-party authentication and database provider. Supabase stores the account email and authentication credentials. The extension never stores the account password beyond forwarding it in the authentication request.

Creating an account or signing in enables the account connection. The sign-in and create-account forms prominently disclose the Pro Sync and Backup fields immediately above their submit button. An account already signed in under an older aggregate-only disclosure must make a one-time explicit choice before full-detail synchronization begins. Signing in stores the account identifier, a randomly generated per-device identifier that is not a hardware identifier, and a generic device label derived from it.

While the account has active Pro access, the extension synchronizes complete supported session records by permanent session ID and keeps three separately validated, compressed, full-history recovery points: the latest, one from about a week earlier, and one from about a month earlier. The synchronized and backed-up tracker state includes:

Live Pro Sync can include retained provider-artwork URLs that are part of supported sessions. Automatic cloud recovery snapshots omit those cosmetic artwork URLs; they retain source identities, labels and the custom-video origins described above. Local JSON exports include retained artwork URLs. Restoring a cloud snapshot preserves supported history and settings but may not restore artwork. For a completed reading session, the retained source and generated session label contain the enabled hostname, but never the page title, full URL, path, or query. It includes text labels that the user explicitly teaches to audio tracking, but never the audio itself. It excludes audio, passwords, cookies, searches, subtitles, page text, reading selections and scroll positions, local language-detection ratios, authentication tokens, account entitlements, analytics queues, and local cloud-transport bookkeeping. Reading-site permissions and the reading-site allowlist are device-local, as are Chrome host-permission grants, keyboard shortcuts, Anki connection secrets, in-progress timers, and overlay screen position. Provider logos and packaged icons are extension assets rather than user backup data.

Supabase also stores the account email and authentication data, display name, the short ID of a selected packaged profile avatar, cloud-activation time, server-owned plan/entitlement status (including a founding-member flag), registered device metadata, reset generation, mutation receipts, change cursors, minimal deletion fences, conflict records, and account setting revisions. The avatar artwork itself remains packaged inside the extension. Legacy aggregate/backup rows may remain during the guarded rollout under the same account, reset, entitlement and recovery controls; current clients use per-session Pro Sync plus the three recovery points.

Founding member offer. Accounts created on or before November 15, 2026 receive Pro free until May 15, 2027, recorded as a server-owned plan, expiry date and founding-member flag on the account profile. The user cannot change these fields. Osmolog has no payment system: no card or billing details are collected, and nothing is charged when the offer ends. Pro data handling during and after the offer follows the rest of this section.

Pro synchronization is automatic on browser startup, sign-in, connectivity recovery, dashboard/popup activity, background alarms, and whenever a local session is saved. Local tracking never waits for the network. The client downloads cloud changes before uploading its durable pending queue, merges sessions by ID and revision, and treats absence as no deletion. If two devices edit the same session before seeing each other's change, Osmolog keeps the synced version active and retains the other edit locally for an explicit comparison choice. Signing out stops further uploads without deleting the server copy. Sync now is a manual retry, and full JSON export/import remains available on every plan.

Backup transport uses HTTPS. Supabase encrypts the project at rest, and Row Level Security restricts ordinary authenticated clients to the backup row belonging to their account. Authorized infrastructure operators retain the access necessary to operate and recover the service. This design is not zero-knowledge or end-to-end encryption: it deliberately allows password/account recovery to remain seamless without a second recovery secret or private key. The extension never embeds a Supabase service-role key.

Losing Pro access stops cloud writes and new recovery points immediately and starts the disclosed 90-day recovery window shown in Account. Existing cloud session history and recovery points remain read-only and exportable during that window and are then permanently removed by bounded trusted server cleanup. Returning to eligible Pro access before the deadline cancels scheduled deletion and resumes with a download before any pending local uploads. Local tracking is unaffected. Account reset advances the reset generation and permanently removes live cloud data and all product recovery points before local data is cleared; account deletion removes the profile and owned cloud data without affecting local history unless the user separately resets it.

Optional Groups and Pair

Groups and Pair require a signed-in account and a display name explicitly chosen during creation or joining. That name is shared across the account's spaces and can be changed in Account. Supabase stores group names and optional descriptions, selected languages, Friendly/Competitive mode, counting rules, period/timezone/target settings, status, memberships and their timestamps, and hashed invitations with expiry and use limits. Members see identities and daily/period totals split into automatic/manual active/passive time, including categories excluded from scoring. No sources, titles, URLs, private notes or individual-session feed are shared.

Private server evidence uses opaque stable identifiers, bounded start/end intervals, language, automatic/manual origin, active/passive seconds and revisions to reject duplicate or overlapping automatic recordings and increases. This evidence is not exposed to other members. Reduced values are audited while results remain editable. On a later contribution sync, evidence for locked periods is pruned while daily totals remain. Reactions store the daily progress item, reacting account and chosen reaction. Safety reports retain only account/space identifiers, a closed reason and status timestamps, without free text.

Writes are rate-limited; database permissions and server functions enforce membership, management roles and counting rules. Results lock 24 hours after a period ends. Existing Group sponsorship grace/read-only behavior remains. Spaces persist until archived or the final member leaves. Leaving or removal stops access and new sharing; earlier aggregate contributions remain as Former member. Account deletion removes private evidence and reactions and anonymizes retained daily totals. Local Group caches, pending transport and acknowledgements are account-scoped and excluded from tracker exports, Basic Sync and Pro backups. Previously downloaded or copied results cannot be remotely recalled.

Product analytics

Product analytics are off by default and remain separate from Pro access and full backup — enabling sync does not enable analytics, and enabling analytics does not enable sync. This control lives in the Account page's Privacy & data card. When a user is signed in, the on/off preference is included in the account-settings sync so their signed-in browsers use the same choice; the analytics events themselves remain anonymous and are not linked to that account.

If a user turns analytics on in Settings, the extension shares small, anonymous usage events containing only:

Since version 2.4.0, the extension sends at most one event per date, language, platform and content type every 15 minutes, containing only the time added since its previous successful report. It keeps the already-reported totals locally so it does not resend history.

Product analytics never collect or transmit video or content titles, URLs, search terms, subtitles or captions, page text, or anything typed into a manual entry. A stored analytics event contains no account ID, device ID, session identifier, or stable per-install identifier, and the separate rate-limit hash described below is never stored with or joined to an event.

MPV companion sessions are not submitted through product analytics in v1.

Analytics events dated more than 12 months in the past are eligible for permanent deletion. The analytics endpoint runs this bounded cleanup at most once per day when it next processes analytics traffic, so deletion can occur later if the endpoint receives no subsequent traffic.

To prevent abuse of this anonymous endpoint, the server temporarily checks how many events are arriving from the same network address, using a one-way hashed version of that address that is stored separately from analytics events and is never linked to them. The hash affects only its fixed one-minute rate-limit bucket. Buckets older than an hour are removed when later analytics traffic runs cleanup; if there is no later traffic, a stale hash can remain stored until that cleanup next runs, but it no longer affects request limits. This check exists only to slow down automated flooding of the endpoint. It does not identify a user, is not used to build any profile, and is not connected to target language, platform, or activity data in any way.

Product analytics can be turned on or off at any time from Account → Privacy & data. For a signed-in user, the updated choice follows the account to their other synced browsers. Turning it off stops any further events from being shared; because events are never linked to an account or device, previously shared events cannot be individually identified or removed. On-device charts and insights operate from local tracker data regardless of this setting.

Anonymous error reports

Anonymous error reporting is a second, independent choice. It is off by default in the welcome tutorial and can be changed later from Account → Privacy. Enabling product analytics, an Osmolog account, Basic Sync, or Pro Sync does not enable error reporting. This preference is local to the browser where it was chosen.

When enabled, Osmolog may report a detected storage or dashboard failure using only six fixed fields: a closed error code, a closed component name, the extension version, the local-data schema version, whether automatic recovery succeeded, and a coarse affected-count bucket (none, 1, 2–5, 6–20, or 21+). The server adds the receipt time. The endpoint does not accept error messages, stack traces, session IDs, account or device IDs, titles, URLs, source labels, viewing history, subtitles, page text, manual descriptions, or other typed text.

The extension applies the same closed allowlist before an error report can leave the browser. It keeps at most 20 pending reports locally, suppresses the same report for 24 hours after a successful submission, and deletes pending reports when the user turns the option off. Submitted diagnostic rows are eligible for permanent deletion after 90 days.

To prevent abuse, the diagnostic endpoint limits total traffic and allows at most 60 reports per hour from one network address. It stores a one-way hash of that address in a separate rate-limit table; the hash is never included in or joined to a diagnostic row. Expired rate-limit buckets are removed by later diagnostic traffic and are not used for profiling.

Local tracking diagnostics

If a playing video that Osmolog intends to count does not start counting within a few seconds, the extension saves a technical report on the user's device so the problem can be investigated. A report contains timings, tracker and browser-attention states, playback state (for example paused, buffering, muted or playback speed), the extension version and the supported site's name. It never contains video titles, URLs, channel or show names, content identifiers, account details or typed text. Normal starts are not saved unless the user turns on the verbose option on the Tracking diagnostics page.

Osmolog keeps at most the 20 most recent reports in local extension storage. They are never uploaded or synced. The user can view, download, copy or delete them from Tracking diagnostics in the popup settings.

Support messages

Help → Bugs & ideas lets signed-in users write to the developer and read replies inside the extension. Sending a message stores in Supabase: the selected category, the message text, the extension version, the account it was sent from, and a one-way hash (SHA-256) of a random reply key created once for that browser installation. The reply key itself stays in that browser's extension storage and is only used to fetch replies; it is not linked to tracker data, analytics, or diagnostics. No separate email address is collected: when the developer replies, a notification is sent to the account's email address.

Reply notifications are sent through the email provider Resend. User messages themselves are not emailed; they are read inside Osmolog. Users are asked not to send personal ID numbers, passwords, card details or other sensitive information; if something like that is sent anyway, the developer deletes the conversation, and users can delete it themselves at any time with Mark as solved. Messages never include tracker history, titles, URLs, or browsing data unless the user types them, and the form asks users not to include passwords or private viewing details.

For a Bug message the user can tick "Attach tracking diagnostics". This adds the extension version, the browser's user-agent string, the tracking language code and the locally saved tracking stall reports described under "Local tracking diagnostics" (no titles, URLs, channel names or page text), limited to about 200 KB, to that conversation. They are stored and deleted together with the conversation.

Each message is deleted permanently 30 days after it was sent, and a conversation is deleted when it has no messages left. Users can delete any of their own messages at any time, and a whole conversation is deleted immediately when the user or the developer marks it as solved or when the linked Osmolog account is deleted. Messages are limited to 1,000 characters and to 20 per hour per account. No IP address or device data is stored with messages; optional bug diagnostics contain only the browser and operating system family, not the full browser identifier. Feedback sent from versions before 2.4.0 has no reply key or account link and cannot be answered.

To prevent automated flooding, a network address can start at most five conversations per hour and post at most 30 messages per conversation per day. The hourly check stores a one-way hash of the network address in a separate rate-limit table, never with a message, and those buckets are removed after a day.

Importing from other apps

Account → Import from another app reads a CSV file the user exported from another tracker (currently Game Sentence Miner or Kechimochi) on their own computer. The file is read inside the extension; only the resulting daily sessions (date, title, activity, duration and language) are saved to local history, where they follow the same rules as manually added sessions. The file itself is not uploaded or kept.

Uninstall survey

When the extension is removed, Chrome opens osmolog.com/uninstall/ with only the extension version in the address. Answering is optional. If the user sends the form, Supabase stores the chosen reason, any text they type (up to 1,000 characters), the extension version and the time. Nothing links an answer to an account, device, installation or tracker history. The same hashed network-address rate limit as support messages applies (five answers per hour). Answers are deleted after 12 months.

Data control and retention

Phone remote beta

The optional Phone remote requires a confirmed Osmolog account and works with free accounts during the beta. The phone saves its active timer, completed sessions, and custom source names in Supabase. A timer includes its source, optional title, language, active/passive mode, start and pause times, time zone, and immersion-day boundary. Completed sessions include duration and dated time segments. Recording works while the computer is off; internet access is required to save changes.

When a signed-in extension opens, it collects waiting sessions for the same account and saves them through its normal local history and synchronization settings. Each session is assigned to one Chrome installation to prevent duplicate contributions across computers. Supabase stores that installation's random identifier, name, and collection status; a local receipt stored alongside history prevents duplicate imports after interruptions. Your existing extension sync handles other computers. Custom watching-source names merge between the phone and extension.

Signing out revokes that endpoint's access but keeps timers, completed sessions, and custom sources in the account. Phone records remain until the account is deleted, including records already collected by Chrome; deleting a local History entry does not delete that retained phone record or collect it again. If the receiving installation is removed before confirming collection, the saved session remains assigned to it. Command request identifiers and responses support safe retries and are pruned after seven days when that account next submits a command.

The phone stores its account session and any unconfirmed save request in browser storage. The unconfirmed request can include the source, title, language, duration, and date being saved; it is removed when confirmed. The account session is removed on sign-out. Only public app files are cached for installation; passwords, account sessions, and timer data are not stored in the service-worker cache. A private beta preview may also require its owner's ChatGPT sign-in.

Earlier beta versions used a computer relay. That compatibility endpoint sends the selected computer's name, manual-timer state, language list, and extension version to Supabase. Relay commands expire after one minute and are cleaned up when the account next submits a command after a day. Disabling the legacy relay deletes its endpoint and queued commands.

Daily totals, dates, and source breakdowns remain on the device until edited, reset, or the extension is removed. Daily records contain date, language, general source, active time, passive time, and session count—not titles or URLs.

Completed local session records may include readable video and manual-action titles, their general source and origin, a bounded channel/show source identity and readable label, a provider-hosted channel avatar or show-artwork URL when the supported player exposes one, and exact active/passive timeline segments. Reading records contain a generated label and source based only on the enabled hostname; they never contain the article title or page address beyond that hostname. All individual details are retained by default. Account settings offer an optional limit from 100 to 5,000, with confirmation before reducing retention. Only when a finite limit is explicitly chosen are older sessions replaced by statistical summaries preserving original counts, dates, language, activity, source/channel identity, active/passive time, numerical duration distributions, and hourly totals. Individual titles and exact playback timelines are removed; increasing the limit cannot restore them. Sessions still recording are protected until they finish. Unassigned sessions are also protected from compaction until a language is assigned. Users can also permanently delete a session, replace or reset local data, or remove the extension; with active Pro access, supported session fields are synchronized and backed up subject to the artwork exclusion disclosed above. Osmolog does not download or maintain its own image library; the dashboard requests the retained provider image URL when it needs to display available artwork. The dashboard reveals retained individual History progressively in 50-row batches; popup History remains a latest-ten summary. Local JSON backups include retained session details, bounded source identity, and timelines; when available, they also include the provider artwork URL. Imports create a local recovery copy of the prior history before replacement. These copies remain on this device until an explicit all-data reset, browser storage removal, or uninstall; users can download them from Account. JSON import and export support files up to 256 MiB. Spreadsheet exports prefix formula-like text cells with a tab to reduce formula execution when opened in spreadsheet software. CSV exports remain daily aggregates and do not include sub-day timelines. History retains an opaque derived content identifier for matching delayed saves and scoped language corrections; readable individual-video identifiers are not stored in History.

Remembered exact-video, channel, and related-content choices use pseudonymous hashed identifiers for functional matching. With Pro full backup, saved rule state and its bounded readable manager label are included in the account snapshot; Basic Sync does not contain rules. These identifiers minimize readable matching data; they are not claimed to provide cryptographic anonymity. Eligible playback is saved as Unassigned while language detection or a language question is pending. A later language choice reassigns the saved time without creating another copy. These sessions follow the local history, export, and optional synchronization rules above and remain individually retained until assigned or removed by the user.

Users can export tracker data as JSON or CSV.

Deleting one session is permanent after a simple confirmation; a minimal anonymous deletion fence may remain so an offline device or older backup cannot restore the private content. Reset this device clears only the current installation and its Free Basic Sync contribution. Reset all account data permanently clears the account generation, cloud sessions, recovery points, and synchronized account data across devices. Both bulk reset actions require the user to type reset, and no trash or 30-day undo copy is retained. A signed-out user must sign in again before an account-wide reset can remove the remote copy. Account deletion remains available separately from the Account page.

Security

The extension uses Chrome Manifest V3, executes only packaged code, restricts default website access to declared supported services, and gains access to a custom video or reading website only after the user adds that host and approves Chrome's site-access prompt. It transmits full-detail tracker records only to the optional user-account provider after the user reviews the disclosure, signs in, and has active Pro access. Authentication tokens are stored separately from exportable and backup tracker state. Transport encryption, database-at-rest encryption, per-account RLS, protocol/version gates, payload limits, compression and backup integrity hashes are enforced; the service is not represented as zero-knowledge encrypted.

Limited Use disclosure

Osmolog's use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including Limited Use requirements. Information is used only to provide or improve user-facing immersion-tracking features. It is not used for advertising, creditworthiness, lending, or sale to third parties, and is not made available for humans to read except when the user explicitly supplies specific information for support or when required by law or security needs.

Changes and contact

Material changes will be published with an updated effective date. Questions can be submitted through the support channel on the extension's Chrome Web Store listing.