📋 Privacy Policy

📌 Chrome Web Store Compliance & Data Disclosure Matrix

The table below provides a quick reference to our data collection, handling, storage, retention, and sharing practices in full accordance with the Chrome Web Store User Data Policy.

Account and Authentication Information (including Passwords):

• Email address: Provided by you when signing up or logging into an optional account (via email/password or Google Sign-In).
• Account passwords: When you register or log in using an email address and password, your chosen password is collected solely to authenticate your identity and protect your account. Passwords are sent securely over encrypted HTTPS (TLS) connections directly to Google Firebase Authentication. Phantom Typer never views, logs, or stores your plain-text password. Google Firebase securely hashes and salts passwords using industry-standard cryptographic algorithms.
• Firebase user ID & account identifier: A unique identifier generated by Firebase to track your account and associate your Pro subscription status.
• Authentication tokens and session credentials: Secure JSON Web Tokens (JWTs) issued by Google Firebase Authentication to maintain your authenticated session.

Important: Account registration is completely optional. You can use Phantom Typer offline on the free tier without ever entering an email or password.

Subscription and Payment Data:

• Subscription status (free or Pro)
• Subscription plan type (monthly or yearly)
• Subscription expiration date
• Payment confirmation and transaction status (received from the payment provider)

Important: Phantom Typer does not collect, see, or store payment card numbers, CVVs, bank account details, or other financial credentials. All payment card processing is handled entirely by Paystack, our third-party payment processor.

Usage Data:

• Typing session count (used to enforce free-tier usage limits)

Local Extension Settings (stored on your device):

• Typing speed preference
• Typing mode selection (Always Type, Replace, If Empty, If Content)
• Keyboard shortcut preference
• Human Feel toggle states (randomized delays, natural pauses, typo simulation, invisible paste, keyboard sounds, keep line breaks)
• Other UI preferences and feature toggles

User-Provided Text (stored locally on your device):

• Text entered by the user into the Extension's popup or side panel text area

Important clarification: When you enter or paste text into the Phantom Typer popup or side panel, that text is saved locally in Chrome extension storage (chrome.storage.local) on your device so it persists between sessions. This text is not transmitted to our servers. It remains on your device and is used only to perform the typing action you request. The Side Panel is an additional UI surface only — it does not collect any new data or introduce any new server traffic; it reads and writes the same locally stored text the popup uses.

Website Field Interaction Data:

• Detection and focusing of the active input field, textarea, or contenteditable element on the current page
• Simulated keyboard events dispatched to the focused field to type user-provided text

Important: This interaction is limited to performing the typing action requested by the user. The Extension does not read, collect, scrape, or transmit the existing content of web pages or form fields to any server.

Stored locally on your device (chrome.storage.local):

• Extension settings (typing speed, mode, shortcut, toggles)
• User-provided text from the popup or side panel text area
• Cached authentication state
• Free-tier usage counter (cached locally, synced with your account)

This data never leaves your device and is not transmitted to any server.

Stored on Firebase / Google Cloud servers:

• Email address and Firebase user ID
• Account password authentication hashes (passwords are securely salted and hashed by Google Firebase Authentication; plain-text passwords are NEVER stored)
• Authentication tokens and session data
• Subscription status, plan type, and expiration date

This data is stored securely on Google Cloud infrastructure used by Firebase.

Processed by Paystack (not stored by Phantom Typer):

• Payment card details and billing information
• Transaction records

Phantom Typer does not see or store your payment card information. Paystack handles all payment card processing.

Processed by Vercel backend:

• Payment webhook verification (confirms payment success and updates subscription status in Firebase)

The Vercel backend acts as a secure intermediary to verify payment webhooks from Paystack and update your subscription status in Firebase. It does not store user data persistently.

Data shared with Firebase (Google Cloud):

• Email address and account password — transmitted over encrypted HTTPS directly to Google Firebase Authentication to verify credentials and authenticate your account
• Firebase user ID — to identify your account
• Subscription status, plan type, and expiration — to manage Pro access
• Typing session count — to enforce free-tier usage limits

Data shared with Paystack (payment processor):

• Email address — pre-filled on the Paystack checkout page
• Payment card details — entered by you directly on Paystack's page (Phantom Typer never sees or handles this data)

Phantom Typer receives only a payment confirmation status (success/failure) and a reference ID from Paystack. No card details are transmitted to or stored by Phantom Typer.

Data shared with Vercel backend:

• Firebase authentication token — to verify your identity when confirming payment
• Payment reference — to verify payment status with Paystack

The Vercel backend acts as a secure intermediary. It does not store user data persistently.

Data that is NEVER shared or transmitted:

• Your plain-text account password (never stored, logged, or shared; managed solely via Google Firebase cryptographic hashes)
• Passwords or credentials entered into third-party websites (Phantom Typer never captures, logs, or intercepts third-party passwords)
• The text you enter in the popup or side panel (stays on your device)
• Your extension settings (speed, mode, shortcuts, toggles — stays on your device)
• The content of web pages you visit
• Your browsing history or the URLs you visit
• Any data typed into website fields

Why broad access is required:

Phantom Typer's core function is to simulate typing into text fields on websites chosen by the user. Because users may want to type on any website (email clients, document editors, forms, messaging apps, CMS platforms, etc.), the Extension needs permission to run its content script on all websites. Without this permission, the Extension would not be able to detect or interact with text fields on most websites.

What the Extension does with website access:

• Detects and focuses the active input field, textarea, contenteditable element, or supported rich text editor on the current page
• Dispatches simulated keyboard events (keydown, keypress, input, keyup) to type user-provided text into the focused field
• Interacts with supported iframe-based editors when necessary (using all_frames: true)
• Uses experimental main-world script injection for Google Docs compatibility
• Provides a dockable Chrome Side Panel (chrome.sidePanel) that mirrors the popup's Save Text and Start Typing controls and adds a Stop button. The Side Panel reads and writes the same locally stored text the popup uses; it does not access any additional page content and does not transmit data to any server.

What the Extension does NOT do with website access:

• Does not read, collect, scrape, or store the existing content of web pages
• Does not intercept, capture, read, or collect passwords or credentials from web pages or login forms
• Does not collect or transmit form field values to any server
• Does not collect or transmit browsing history
• Does not inject advertisements or tracking scripts
• Does not modify web page content for any purpose other than typing the user's requested text
• Does not send any page content, URLs, or field data to our servers or any third party

Local data (on your device):

• Extension settings, saved text, and cached state are retained until you uninstall the Extension, clear extension data via chrome://extensions, or manually clear the data.

Account and Authentication data (on Firebase servers):

• Email address, user ID, password authentication hashes, subscription status, and usage count are retained for as long as your account exists.
• You may request deletion of your account and all associated server-side credentials and data at any time by emailing gmuraguri75@gmail.com. We will permanently delete your account, authentication records, and data within 30 days.

Payment data (on Paystack):

• Payment records are retained by Paystack according to Paystack's data retention policy. Phantom Typer does not store payment card information.

How consent is collected:

• Before you can sign in or create an account, you must check a consent checkbox that summarises the data collected and links to this full Privacy Policy.
• No account data is collected or transmitted until you actively agree.
• The consent checkbox lists the specific types of data collected and how they are used.

How to withdraw consent / opt out:

• Sign out: Click the sign-out button in the Extension popup to stop all server-side data collection immediately.
• Use without an account: The Extension's basic local features (saving text, typing at Slow/Normal speed) work without signing in. No data leaves your device in this mode.
• Uninstall: Removing the Extension from Chrome deletes all locally stored data.
• Request account deletion: Email gmuraguri75@gmail.com to have all server-side account data permanently deleted.

Offline / local-only mode:

You can use Phantom Typer without creating an account. In this mode, all data stays on your device, nothing is transmitted to any server, and the Extension functions as a fully offline typing tool (limited to free-tier speeds and session count).

Limited Use Disclosure:

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically:

• We limit our use of user data to the practices explicitly disclosed in this privacy policy.
• We do not transfer user data to third parties except as necessary to provide or improve the Extension's user-facing features, as described in Sections 6 and 7, or as required by law.
• We do not use or transfer user authentication information (such as passwords or authentication tokens) for any purpose other than authenticating the user and providing access to their Phantom Typer account.
• We do not use or transfer user data for serving advertisements.
• We do not use or transfer user data for creditworthiness or lending purposes.
• We do not allow humans to read user data, except with the user's affirmative consent for specific messages (e.g., support requests), if necessary for security purposes (e.g., investigating abuse), or to comply with applicable law.