Last updated: September 29, 2026
This policy covers two products, and it says which one each section applies to:
The extension is the more sensitive of the two, because it runs inside your browser on sites that have nothing to do with Skopx. Read the extension sections carefully. We have written them to describe what the code actually does, including the places where our protections are partial.
This section maps each Chrome Web Store data category to what the extension actually does. It exists so a reviewer can check each disclosure against a specific paragraph.
Your Skopx account holds your name and email address. Beyond that, the page content you ask the assistant about routinely contains other people's names, email addresses, job titles and similar details, because that is what business pages contain. That content is sent to our servers and on to an AI model provider so your question can be answered. See Page Content and Page Context and What Redaction Does and Does Not Do below.
We do not ask for health information and we have no feature that requests it. Our redaction pass removes labelled medical record numbers, patient identifiers and labelled patient name fields from extracted page text. If you point the assistant at a page containing health information, that information can still reach our servers and the model provider. Do not use Skopx on pages containing protected health information. We are not a HIPAA business associate and we do not offer a BAA.
Payment details for your Skopx subscription are collected and processed by Stripe. We do not store your full card number.
Separately, and importantly: we do not intentionally collect financial data from the pages you visit, but a card number that is visible as text on a page you ask about can reach our servers. Our redaction pass removes Luhn valid card numbers from page text on the extraction path. It does not run on the browser agent's own page reading tools. If you ask the assistant to read or act on a page that is displaying a card number, bank account number or similar, assume it can be transmitted. See What Redaction Does and Does Not Do.
There are two separate things here and they should not be confused.
The extension never calls the browser's geolocation API and does not request location permission. As with any web service, our servers see the IP address your requests come from, which gives a rough geographic area.
The URL and title of the tab you are working in are sent to our servers as context for your conversation, so the assistant knows what you are looking at. The extension does not read your browsing history database and does not have the Chrome history permission. It sees the tabs you use it on.
When you ask the assistant to do something on a page, it performs clicks, typing, scrolling, form filling and navigation on your behalf, and it records what it did so it can report back and so you can see the run. It does not monitor your own clicking and typing when you are not asking it to act.
Page text, structured page snapshots of the elements on the page, and JPEG screenshots of the visible tab. All of it is captured in response to something you asked, and sent to our servers so a model can answer.
The extension needs to know you are you before it will talk to our API. It does this by reading the Skopx authentication cookie set by skopx.com in your own browser, which is the same cookie your logged in browser tab uses. It keeps the session token in extension session storage, which Chrome clears when the browser closes, and exchanges the refresh token with Supabase for a new token when the old one is close to expiring.
This is the only cookie reading the extension does on its own initiative, and it is limited to skopx.com. Cookie access on other sites happens only through the page tools described above, and only when you ask the assistant to work with that page.
When you ask the assistant about a page, one or more of the following can be captured and sent to our servers:
Some well known work tools get purpose built extraction, so the assistant understands their structure rather than scraping raw text. Those tools currently include Jira, GitHub, Confluence, Notion, LinkedIn, ServiceNow, Salesforce, Slack, Zendesk and HubSpot. Every other site uses the general purpose extractor.
The extension is installed with access to skopx.com and a small set of work tool domains. Access to all other sites is an optional permission that Chrome asks you for, and you can revoke it at any time from the extension's settings in Chrome.
We run a pattern based redaction pass over extracted page text. It looks for and replaces US Social Security numbers, phone numbers, email addresses, credit card numbers that pass a checksum test, AWS access keys, labelled API keys and tokens, labelled medical record and patient identifiers, and labelled name fields.
This protection is partial, in three specific ways. We would rather state them than let you assume more than is true.
There is one protection that does hold across paths. Fields the browser recognises as secrets, meaning password fields and fields whose type, name, label or placeholder mark them as a password, PIN, card number, CVV, SSN, one time code, routing number or account number, have their values blanked before any page listing is handed to a model. That is a targeted rule about form fields. It does not clean up a card number printed as ordinary text in the middle of a page.
The practical guidance: treat anything visible on a page you ask the assistant about as something that can be transmitted. If a page is showing data you would not paste into a chat window, do not ask the assistant about that page.
Meeting Mode captures the audio of one browser tab that you pick when you start it. Chrome shows a capture indicator on that tab while it is running.
Interview Mode, and the voice input button in the side panel, use the speech recognition built into Chrome, called the Web Speech API. We want to be direct about what that means, because the interface does not make it obvious:
When you ask the assistant to do something on a page, it can click, type, scroll, fill forms, select options, upload a file you provided, and navigate. To do this reliably on sites that block synthetic events, it uses Chrome's debugging interface, which is why Chrome shows a banner saying the extension is debugging the tab. That banner is expected while the assistant is working, and the connection is dropped when the tab goes idle.
Two limits are enforced in code, not by asking the model nicely:
The extension does not have a mode where it acts on pages without you having started something.
When you connect a tool such as a CRM, a support desk, a data warehouse or a mailbox, you authorize Skopx to access it on your behalf, and we retrieve data from it to answer your questions and take actions you ask for. We access what the task needs. You can disconnect any tool at any time from the connections page, and revoke access at the provider as well.
We do not sell personal information. We do not use your page content, conversations or transcripts to train our own models.
Helper, the Skopx model, learns inside your account by keeping notes, memory and preferences. No model's weights change, and nothing is shared with other customers.
Everything the extension sends goes to skopx.com first. From there it can reach the following:
Each of these has its own privacy policy and its own handling practices. We do not control what a provider does with data once it reaches them under your own API key.
We take the following measures:
No system is perfectly secure, and we do not claim ours is. We hold no security certification and we do not currently offer a data processing agreement or a business associate agreement.
We keep account information, conversation history, saved page extractions, uploaded files and assistant memory for as long as your account is open, so that the product works as you expect across sessions. You can delete individual conversations, extractions and memories from the app at any time, and deleting them removes them from our database.
When you close your account, we delete your account and the data associated with it. Payment and billing records are kept for as long as tax and accounting law requires. Backups and logs are cycled out on their own schedule and can hold copies for a period after deletion.
Conversation history, saved page extractions and the page content attached to them are deleted automatically 90 days after they were last used. You do not have to ask for this and you cannot be charged for it. Billing records are kept longer because tax and accounting law requires it. If your organization needs a different window, write to us and we will tell you honestly what we can do.
Each thing described in this policy can be turned off. Here is how:
Wherever you are, you can ask us to give you a copy of the personal data we hold about you, correct it if it is wrong, delete it, or export it in a portable format. You can also opt out of marketing email. We do not sell personal information, and we do not discriminate against anyone for making a request.
Send requests to team@skopx.com. We will verify that the request comes from the account holder before acting on it.
On skopx.com we use cookies to keep you signed in, remember your preferences, and measure site usage. You can control cookies in your browser settings, though clearing the session cookie will sign you out of both the web app and the extension.
Skopx is a business product and is not intended for children under 13, and the extension is not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, write to team@skopx.com and we will delete it.
Our infrastructure and our providers operate in several countries, so your information may be transferred to and processed outside the country you are in, including the United States.
We will update this policy when the product changes. When we do, we will change the date at the top of this page. If a change materially affects what we collect from the extension or where it goes, we will say so on this page and notify account holders by email rather than changing it quietly.
Questions about this policy, or about anything in it you think is wrong or unclear: