Claude DuetPrivacy Policy
Claude Duet AI Companion · Effective and last updated:
Summary
- No account is needed. We don’t sell data, show ads or use analytics or tracking tools.
- Your chats, memory, calendar, automations and settings are stored in your browser, not on our server.
- To answer you, the extension sends your request to our server, and our server sends it to our AI providers through OpenRouter. Depending on what you do, a request contains your message with the earlier messages of the chat, the page you are on, page data for the agent, a voice clip or your memory items. We use it only to produce the answer and don’t store it.
- The page you are on is sent only together with a request: a message while the page switch is on (it is on by default and shown above the message box), a page action, the right-click menu or an agent task you start. Nothing about your pages is sent in the background; the only AI request that runs without you is an automation you scheduled yourself.
- The agent won’t type into password or card fields, doesn’t receive their values, and asks for your approval before important steps.
- Our server keeps only a random install ID, the extension version and language, daily request counters, checkout records and, if you subscribe, your subscription details (plan, status, renewal date, customer ID and checkout email).
- Payments are handled by Dodo Payments, our merchant of record. We never see your card details.
- Section 7 lists the data categories we declare in the Chrome Web Store and what each one means here.
1. Who we are
Claude Duet AI Companion (the “extension”) is a Chrome extension published by TMV.DEV (Tamara Lapatovene). Tamara Lapatovene is responsible for the processing of your personal data described here (the “controller”).
Contact for any privacy question or request: [email protected].
This policy covers the extension, our API server (duet-api-production.up.railway.app), our checkout and subscription handling, and this website (getclaudeduet.com).
2. Data we process
We process only what is needed to give you the feature you asked for. The table shows each kind of data, when it is processed, why, and whether we keep it.
| Data | When | Why | Stored by us? |
|---|---|---|---|
| What you type: chat messages (sent with the earlier messages of the same chat, up to the last 20), research questions, agent tasks and automation instructions, together with your answer settings (interface language, tone, length and model) | When you send a request, or when an automation you scheduled runs | To generate the answer or result | No |
| Page content: title, address, selected text (up to 4,000 characters) and visible text (up to about 24,000 characters) of the current tab | When you send a message while the page switch is on (it is on by default; turn it off above the message box or in Settings → Current page), run a page action such as Summarize, or use the right-click menu | To answer about the page | No |
| Agent page data: the page address and title, its visible text (up to 7,000 characters), a numbered list of buttons, links and fields with their labels and current values (for example a search box, or a name or email already entered in a form), the scroll position and the steps already taken. Fields recognized as password or payment fields are marked as secret and their values are left out | At each step of an agent task you started, and only while it runs | To decide and perform the next step you asked for | No |
| Memory items and calendar data | When memory is on (it is on by default), up to 40 of your memory items go with each chat message. When an automation you created runs, its request includes today’s calendar events (time, title, length), your open tasks and preferences, and your current local date, time and time zone | To personalize answers and to run your automations | No (they stay in your browser) |
| Voice recording: an audio clip of up to 60 seconds | Only after you press the microphone, until you stop or pause | To turn your speech into text | No |
| Install record: random install ID, extension version, interface language, daily request counter and its date, first and last request time, Pro plan and its end date | When the extension first connects and with your requests | To provide the service, apply the daily limit and protect against abuse | Yes, until you delete it |
| Checkout records: checkout session ID, chosen plan, status and time | When you open the checkout | To activate Pro after the payment | Yes, deleted together with the install record |
| Subscription details: subscription ID, plan, status, renewal date, Dodo Payments customer ID and the email used at checkout. Dodo’s replies to our server also contain the customer name and billing address; we don’t save them | When you subscribe and when the subscription changes | To unlock Pro, let you manage or cancel it and restore it in another browser | Yes, while the subscription exists and as long as accounting and legal rules require |
| Restore request: email and order ID you enter | Only when you use “Restore purchase” | To check the purchase with Dodo Payments | No (compared, not saved separately) |
| Technical data: IP address, time, requested address on our server and browser type (user agent) | With every request to our server | Security, rate limiting and troubleshooting | Not in our database. The IP address is used in server memory for rate limiting, and our hosting provider keeps standard request logs for a short period |
We don’t ask you for your name or contacts, and we don’t collect your precise (GPS) location, the list of sites you visit, passwords, keystrokes or mouse movements. We don’t build a profile of you. We learn the address of a page only when you send a request about it or the agent works on it.
3. Data stored only in your browser
Your chats and saved answers, memory, calendar events and reminders, research reports, agent run history, automations and their run history, settings, the launcher position, the sites where you hid the launcher and the access token are stored with chrome.storage.local on your device. They are not uploaded to us for storage.
You can delete them at any time: Settings → Privacy → “Delete all my data”, or “Clear chat history”. Uninstalling the extension removes them too.
4. How the extension reads pages
Small page scripts are loaded on http and https pages so the launcher button can appear and so the assistant can read the page or let the agent act when you ask. They don’t send anything on their own.
While the side panel is open, it looks at the active tab inside your browser — its title and address, the text you selected, the word count and whether the page has a table or a form — to show which page it will work with and to suggest actions. When you select text, a small “Explain” button may appear next to it. This check stays on your device. Selected text is sent only if you click that button, use the right-click menu, or send a message while the page switch is on.
Page content leaves your browser only together with something you start: you send a message while the page switch is on, run a page action (for example Summarize or Translate), use the right-click menu, or start an agent task. The page switch is on by default, so while it stays on, every message you send includes the current page. You can turn it off above the message box or in Settings → Current page, and hide the launcher on any site.
5. The AI agent and your approval
The agent works only on a task you give it, in the tab you are using, and shows what it is doing on the page. You can stop it at any time.
At each step it sends our server the page address and title, its visible text and a list of buttons, links and fields with their labels and current values, so the AI can choose the next step. It won’t type into password fields or fields recognized as card, CVC, IBAN or similar payment fields, and their values are left out. Values of other fields are included, for example a username or email already entered in a sign-in form.
Before steps that send, submit, publish, pay, book, buy, delete, sign in or change account settings, it stops and asks for your approval.
You are responsible for the steps you approve and for following the terms of the websites where you use the agent.
6. Voice input
When you press the microphone, Chrome asks once for microphone access. The extension then records a clip (up to 60 seconds) until you stop or pause, sends it to our server and to our speech-to-text provider to turn it into text, and puts the text into the message box for you to review. The audio is not stored by us.
You can withdraw microphone access at any time in Chrome (Settings → Privacy and security → Site settings → Microphone).
7. What we declare in the Chrome Web Store
The Chrome Web Store asks every developer which categories of user data the extension collects. In the store’s meaning, data is collected when it leaves your device, even if, like most data here, it is only used to produce an answer and is not stored. To be complete, we declare every category that can leave your device while you use the extension:
| Category in the store | What it means for this extension |
|---|---|
| Personally identifiable information | The email used at checkout (stored with the subscription) and the email you enter to restore a purchase. Also any personal details you write in a message or that are visible on a page you send, including a name or email already entered in a form the agent works on. |
| Financial and payment information | Subscription and payment records: plan, status, renewal date, and subscription, payment, checkout and customer IDs. Card details are entered on the Dodo Payments checkout and never reach us. |
| Authentication information | The random access token the extension uses to talk to our server. During an agent task, the values of ordinary form fields are included, so a username or email in a sign-in form can be sent. Passwords and fields recognized as payment fields are not. |
| Personal communications | Your messages to the assistant and your voice clips, and the text of an email, chat or other message shown on a page you send with a request. |
| Location | Your IP address (rate limiting and hosting logs) and, when an automation runs, your time zone. We don’t use GPS or precise location. |
| Web history | The address and title of the page you send with a request or the agent works on. We don’t collect the list of sites you visit. |
| User activity | During an agent task: the scroll position of the page and the steps the agent has already taken. We don’t record your own clicks, mouse movements or keystrokes. |
| Website content | The text, links and form fields of the page you send with a request or the agent works on, and the selected text you send. |
We don’t declare health information: the extension doesn’t ask for health data and has no health features. If you write about your health or send a page that contains such information, it is handled like any other message or page content described above and is not stored by us.
We also certify in the store, as in this policy, that we don’t sell user data, don’t use or transfer it for purposes unrelated to the extension’s single purpose, and don’t use or transfer it to determine creditworthiness or for lending.
8. How we use information and legal bases
To provide the service you request: answers, summaries, research, agent steps, automations, voice input and Pro features (performance of a contract).
To process subscriptions, let you manage or cancel them and restore Pro in another browser (performance of a contract; legal obligations for accounting and tax).
To keep the service safe and fair: rate limits, fair-use limits, abuse and fraud prevention, troubleshooting (our legitimate interests).
To reply to you when you contact us (our legitimate interests or your request).
We don’t use your data for advertising, to sell it, to build profiles, to decide creditworthiness or to train AI models.
9. Service providers
We use a small number of trusted providers that process data on our behalf, only for the purposes above:
OpenRouter receives each AI request from our server, forwards it to a provider that hosts the selected model and returns the answer. For Claude models, that provider is Anthropic or a cloud platform licensed to run Claude models, such as Amazon Bedrock or Google Cloud Vertex AI; they generate answers, research reports, agent steps and automation results. For voice input, a Google Gemini model (through Google AI Studio or Google Cloud Vertex AI) turns the clip into text. For research, the search query goes to the model provider’s built-in web search or, if it isn’t available, to Exa, to find sources. Requests come from our server, so these providers don’t receive your IP address. They process the content to return a response under their own terms and privacy policies and may keep it for a limited time, for example for abuse monitoring.
Dodo Payments is our merchant of record for Pro subscriptions: it runs the checkout, collects your name, email, billing address and payment details under its own privacy policy, processes payments, taxes, invoices and refunds, and provides the customer portal for managing your subscription. We save only the subscription details listed above and never receive your card number.
Railway hosts our API server and its database (install records, counters, checkout records and subscription details). Cloudflare hosts this website and its domain.
Google (Gmail) hosts our support mailbox, so it processes the messages you send us.
We use no analytics, advertising or tracking tools, and the extension runs no remote code.
10. About the AI models and the name “Claude”
Answers are generated by Claude models from Anthropic (and, for voice, by a Google Gemini model), which we access through their APIs via OpenRouter. Claude Duet AI Companion is an independent product: it is not made, endorsed or sponsored by Anthropic, and using it doesn’t create an Anthropic or Claude account or add anything to your Claude history. Anthropic processes requests only as a provider of the AI model, as described above. “Claude” is a trademark of Anthropic, used here only to describe the AI technology the service runs on.
11. Browser permissions
| Permission | Why it is needed |
|---|---|
sidePanel | Shows the assistant in Chrome’s side panel next to the page. |
storage | Keeps your chats, memory, calendar, automations, settings and the access token on your device (chrome.storage.local). |
tabs | Knows the title and address of the active tab to offer actions for it (in full-screen mode, of the most recently used web tab in the window), opens pages you ask for, and lets the agent work in the tab you are using. |
scripting | Reads the current page or runs an agent step in it after you ask, if the page script isn’t loaded yet. No code is downloaded from the internet. |
contextMenus | Adds “Explain” and “Summarize this page” to the right-click menu. |
alarms | Runs reminders and the automations you scheduled at the right time. When an automation runs, its request goes to our server as described above. |
notifications | Shows reminders and the results of scheduled automations. |
Access to websites (http and https) | Lets the assistant and the agent work on any site you choose and shows the small launcher button on pages. Page content is sent only together with your request; you can hide the launcher on any site. |
Microphone (asked by Chrome on first use) | Records a voice clip only after you press the microphone button. You can withdraw access at any time in Chrome’s site settings. |
12. Limited Use
The use of information received from your browser adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use it only to provide or improve the single purpose of the extension — an AI assistant in the side panel — and the features you request. We do not sell it, use it for advertising or personalized ads, use it to determine creditworthiness or for lending, and humans do not read it, except with your explicit consent (for example, when you send it to us for support), for security purposes, to comply with applicable law, or when it is aggregated and anonymized for internal operations.
14. International transfers
Our providers may process data in the United States, the European Union and other countries. Where data protection law requires it, transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses offered by these providers.
15. Retention and deletion
Requests, page content and voice clips are processed in memory and discarded after the response is produced.
The install record, counters and checkout records are kept until you choose Settings → Privacy → “Delete all my data”, which deletes them on our server and resets the extension. We may also delete records that have been inactive for a long time.
Subscription records are kept while the subscription exists and afterwards only as long as required for accounting, tax and legal obligations. “Delete all my data” unlinks the subscription from your browser but doesn’t cancel it — cancel it first via Settings → Manage subscription.
Hosting logs (IP address, time, requested address, browser type) are kept by our hosting providers for a short period for security and reliability.
To delete subscription-related data or anything else we hold, email [email protected].
16. Security
All traffic uses HTTPS. The AI provider keys live only on our server, never in the extension. Each install gets a signed access token; our server doesn’t store your content. Access to our systems is limited to what is needed to run the service.
No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the authorities as required by law.
17. Your rights and choices
Depending on where you live (for example under the GDPR, the UK GDPR or California law such as the CCPA/CPRA) you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict processing, and to withdraw consent at any time.
Most choices are in the extension: switch off page context or memory, clear chats, or delete everything with “Delete all my data”. For any other request, email [email protected]; we may need to confirm that the request comes from you (for subscriptions, the checkout email and order ID). We will reply within the time required by law, usually within 30 days.
We don’t discriminate against you for exercising your rights. If you are in the EEA or the UK, you can also complain to your local data protection authority.
18. Children
The extension is not directed to children under 13 (or under 16 in the EEA and the UK), and we don’t knowingly collect their personal data. If you believe a child has sent us personal data, contact us and we will delete it.
20. Changes to this policy
We will update this page when our practices change and change the “Last updated” date. If a change is significant, we will tell you in the extension before it takes effect.
21. Contact
TMV.DEV (Tamara Lapatovene) · [email protected]