Privacy policy
Draft. Have it reviewed before it is relied on or linked from a store listing.
Covers the WebCodeReview Chrome extension and this website.
The extension: WebCodeReview
The WebCodeReview extension lets a program on your own computer (the WebCodeReview server) send questions to AI chat sites you are already logged in to, and run automated browsing steps, through your browser.
What the extension does with data
- Prompts and answers. The extension types the prompt (from your WebCodeReview program, or one you enter in the extension's review page or popup) into the chat site (ChatGPT, Gemini, Claude, DeepSeek, Grok) in your own logged-in tab, reads the answer back, and returns it to your WebCodeReview program, or shows it in the extension's page you typed it into. The prompt and answer pass through the extension only to do this. The finished answer (not the prompt; only a short fingerprint of it) is kept in the browser's memory-only session storage so that a repeated request cannot submit the prompt twice. It is deleted within 10 minutes after the answer finished, or when the browser closes. Short diagnostic log lines (no prompt or answer text) are held in memory until the extension's background worker stops, and the server you configured can request them.
- Copy capture. To read an answer exactly as the site shows it, the extension clicks the answer's own Copy button once and intercepts the text inside the page. Your clipboard is never written.
- Image attachments. If a request includes images, the extension uploads them to the chat site in your tab. They are passed through and are not stored or logged (only their count and size appear in diagnostic logs).
- Modes on the chat sites. The extension types the prompt and presses send in a new conversation. It turns a site's thinking or reasoning mode on or off only when a request asks for that. It turns the site's web search off for each request unless the request asks for it on. Afterwards it puts every setting it changed back the way it was. If that fails, it tells you so you can change the setting back yourself.
- Account check. To tell you when a site needs a login, the extension reads only whether you are logged in and whether the plan is free or paid. Names and email addresses are looked at inside the page only to tell the plans apart and are not sent anywhere.
- Automated browsing (optional). It is off until you turn it on in the popup, and Chrome then asks you to allow access to all websites. Turning the switch off stops automation inside the extension, but it does not withdraw Chrome's all-websites permission; to revoke that access completely, open
chrome://extensions, choose WebCodeReview and change Site access. When a plan runs, the extension reads the structure and text of the pages the plan visits, only on the domains that plan lists, and returns what the plan asks for to the server. Without that permission, only the chat-site features work. Each plan must list the domains it may use, and a plan listing a whole suffix such as "com" is refused. The extension ignores every command until the server has accepted its pairing token. - Settings. The server address, pairing token (saved by the pairing page from the link that
wcr setupopens, not typed by you), an on/off switch, whether to close the work tab when a request finishes, the list of sites that skip the debugger keep-alive, and a few content-script preferences are stored in the browser's local extension storage on your device. The ids of the work tabs and the last login and plan check per site are kept in memory-only session storage until the browser closes. - Your WebCodeReview account. Signing in is optional and needed only for automated browsing. If you sign in, the extension stores the email address of your WebCodeReview account (received from webcodereview.com after you sign in) and a device secret for that account in the browser's local extension storage. The email address is shown in the popup and is never sent anywhere else or logged. The device secret is sent only to webcodereview.com. Signing out in the browser deletes the stored account data (email address and device secret) locally. Removing the device on the website revokes it; the extension notices at its next daily check, or when Chrome starts, and signs out. About once a day the extension checks with webcodereview.com that your sign-in is still valid (and, later, your plan). No prompts, answers or page content are sent there.
- Welcome page. The extension opens a welcome page when you first install it.
Where data goes
Prompts, answers and page content go only to the server address you configure. The default is ws://127.0.0.1:8787, a process on your own computer. The extension sends no analytics, telemetry or advertising data. The only developer-operated service it contacts is webcodereview.com, for account sign-in and your plan; no prompts, answers or page content are sent there. Data is not sold or shared with third parties by the extension. Whatever you send to the chat sites is handled by those sites under their own terms and privacy policies.
If you point the extension at a remote server, that server receives the prompts, answers and page content described above. Use only servers you control, over TLS. The extension's popup warns when the server address is not on your computer.
Credentials
The extension does not read, store or transmit your passwords, cookies or session tokens for the chat sites. It works in tabs where you are already logged in; the browser holds those sessions.
Permissions and why
| Permission | Why |
|---|---|
| Host access to the chat sites: chatgpt.com, gemini.google.com, claude.ai, chat.deepseek.com and grok.com (required) | Type the prompt and read the answer in those tabs. |
| Host access to webcodereview.com (required) | Sign in to your WebCodeReview account (a device code you approve on webcodereview.com/device) and check once a day that your sign-in is still valid (and, later, your plan). No prompts, answers or page content are sent there. |
| Access to all websites (optional, off until you turn on “Automated browsing” in the popup) | Automated browsing visits the sites a plan names. Without it, only chat-site features work. The popup switch stops automation but does not withdraw this permission; to revoke it completely, open chrome://extensions, choose WebCodeReview and change Site access. |
tabs | Open, reuse and close the work tabs; read tab URLs to enforce the plan's allowed-domain list. |
scripting | Run the page-reading and clicking code in those tabs. |
storage | Keep settings, the ids of the work tabs and the short-lived answer cache described above. |
debugger | While a prompt runs, mark the chat tab as active so the site keeps streaming in the background. Chrome shows its "debugging this browser" bar meanwhile. |
webNavigation | Detect when a page has finished navigating before the next automation step. |
tabGroups | Keep the extension's work tabs together in one tab group named "WCR". |
notifications | Tell you when a chat tab needs you to log in or pass a human check (clicking the notification opens that tab), when a site setting it changed could not be put back, or when the connection to your WebCodeReview program was refused or taken over by another browser. |
identity | Only for one-click sign-in with Google, which opens in Chrome's own sign-in window. It adds no install warning. |
alarms | Reconnect to the server after the browser suspends the extension. |
TODO: The permission list follows extension/PRIVACY.md and the manifest. The
debugger permission stays (decided). Update this table when either changes.This website
- Waitlist. If you submit your email address, we store it, the time, and a one-way SHA-256 hash of your IP address (used only to limit abuse), in a Cloudflare D1 database. We use the email only to tell you when early access opens; we do not email anyone yet and do not sell or share the list.
- Rate-limit records. A hash of your IP address and a timestamp are kept for one hour to limit repeated submissions, then deleted.
- Hosting. The site runs on Cloudflare, which processes requests (including IP addresses) and may keep standard request logs under its own privacy policy.
- Accounts (once sign-in is available). Signing in is needed only for automated browsing; code review works without an account, and if you never sign in we collect none of the following. If you sign in with Google, we store your email address and your Google account id (from Google we receive only your verified email address and an account id), a session that keeps you signed in for up to 30 days (only a hash of its secret is stored), the devices you approve (name, when added and last seen), and a security log of sign-in and device events that is deleted after 90 days. We store no password.
- No analytics or advertising cookies are set by this site. If you sign in, a session cookie keeps you signed in. Your theme and language choice, and the page to return to after signing in, are kept in your browser's local storage.
To be removed from the waitlist, contact us at the address below.