Last updated September 23, 2026

Privacy Policy

Caveatly is a Chrome extension that reads a website’s Terms of Service and Privacy Policy with AI and flags what matters. It has no account, and apart from an anonymous daily usage ping you can turn off, it sends nothing to its developer. This page explains exactly what it handles.

What Caveatly sends, and to whom

When you scan a site, Caveatly sends two things to Google’s Gemini API (generativelanguage.googleapis.com), using the API key you entered:

• the text of the site’s Terms of Service and Privacy Policy pages, and
• the site’s domain name (for example, example.com), so the summary can name it.

Apart from the anonymous usage ping described below, that is the only data that leaves your browser. Caveatly never sends your browsing history, the contents of other pages, form entries, passwords, or anything that identifies you. Google handles this data under the Gemini API Terms of Service. If you use Gemini’s free tier, those terms allow Google to use submitted content to improve its products; a paid Gemini key changes that.

To find and read the legal pages, Caveatly also loads them directly from the website you are on, just as your browser would if you clicked the links.

Anonymous usage stats

Unless you turn it off, Caveatly sends one small ping a day to analytics.n3el.dev, a stats service run by Caveatly’s developer, so he can count active installs. The ping contains:

• a random install ID, created on your device and not linked to you or your Google account,
• the Caveatly version, your Chrome major version and CPU type (for example, arm64), and
• whether Caveatly came from the Chrome Web Store or was loaded unpacked.

It never includes the sites you visit or scan, page contents, your API key, or anything that identifies you. No cookies are used. The service does not store your IP address; it keeps only the country your request came from. When you uninstall Caveatly, Chrome opens a page on analytics.n3el.dev that counts the uninstall and then redirects to this website.

To opt out, open Caveatly → Settings and turn off Share anonymous usage stats. Caveatly then sends no ping and skips the uninstall page.

This website

This website counts visits with a small cookieless script from analytics.n3el.dev. It records the page address (without query strings), the referring site, clicks on download links, your country, and your browser, OS and device type. It sets no cookies, does not store your IP address, and does not track you across sites or days.

What Caveatly stores on your device

• Your Gemini API key, in chrome.storage.local. It stays on this device, is never synced, and is only ever sent to Google’s Gemini API.
• Scan reports for the sites you scanned, in chrome.storage.local, so you don’t have to re-scan. These include the site’s domain and the flagged clauses.
• A random install ID and the date of the last usage ping, in chrome.storage.local, for the anonymous usage stats.
• Prompt choices, such as dismissing the on-page scan prompt for a domain, in chrome.storage.local.
• Your settings (the on/off toggles and scan mode), in chrome.storage.sync. If you use Chrome sync, Google syncs these toggles between your devices. Your API key is never included.

Removing the extension deletes all of this.

Privacy features

Depending on your settings, Caveatly clicks “necessary only” or “reject all” on common cookie banners, sends the Sec-GPC: 1 Global Privacy Control signal to sites you visit, and removes tracking parameters such as utm_*, gclid and fbclid from links you open. All of this happens locally, in your browser.

What Caveatly does not do

• It does not sell or share your data with anyone.
• It does not use your data for advertising, credit decisions, or anything unrelated to explaining the legal pages you scan.
• It has no tracking, advertising, or crash reporting, and it runs no remote code. Its only analytics is the anonymous, opt-out usage ping described above.

Why it needs access to all websites

Terms and privacy links can appear on any website, and the cookie-banner, Global Privacy Control and tracking-parameter features apply wherever you browse. Caveatly reads a page only to find those links and banners; it never collects or sends page contents except the legal documents you choose to scan.

Children

Caveatly is not directed at children under 13 and does not knowingly collect any information from them.

Changes and contact

If this policy changes, the new version will be posted on this page with a new date. Caveatly is open source, so you can check every line of the code on GitHub. Questions? Open an issue on GitHub.