What This Policy Covers

This policy covers two products, and it says which one each section applies to:

The Skopx web app at skopx.com, including the dashboard, chat, connected integrations, and billing.
The Skopx browser extension for Chrome, which adds an assistant side panel to pages you visit, can read and act on those pages when you ask, and offers Meeting Mode and Interview Mode.

The extension is the more sensitive of the two, because it runs inside your browser on sites that have nothing to do with Skopx. Read the extension sections carefully. We have written them to describe what the code actually does, including the places where our protections are partial.

The Short Version

The extension does not read pages in the background. It reads a page when you ask it something, and it acts on a page when you ask it to.
What it reads goes to skopx.com, and from there to the AI model provider that answers your question. If you have supplied your own model API key, it goes to that provider under your account with them.
Page content routinely contains real names and email addresses. We strip some sensitive patterns on some paths. We do not strip everything, and we say below exactly where the gap is.
Meeting Mode transcribes tab audio on your own machine. That audio does not leave your browser.
Interview Mode microphone input uses Chrome's built in speech recognition, which sends your microphone audio to Google. That is not our choice of processor and it is not obvious from the interface, so it is called out again below.
The assistant never types passwords, card numbers, CVVs, SSNs or one time codes, and it never presses a publish, send, pay, delete or authorize control without you approving that specific control first.
We do not sell personal information.

Chrome Web Store Data Disclosures

This section maps each Chrome Web Store data category to what the extension actually does. It exists so a reviewer can check each disclosure against a specific paragraph.

Personally identifiable information: collected

Your Skopx account holds your name and email address. Beyond that, the page content you ask the assistant about routinely contains other people's names, email addresses, job titles and similar details, because that is what business pages contain. That content is sent to our servers and on to an AI model provider so your question can be answered. See Page Content and Page Context and What Redaction Does and Does Not Do below.

Health information: not intentionally collected

We do not ask for health information and we have no feature that requests it. Our redaction pass removes labelled medical record numbers, patient identifiers and labelled patient name fields from extracted page text. If you point the assistant at a page containing health information, that information can still reach our servers and the model provider. Do not use Skopx on pages containing protected health information. We are not a HIPAA business associate and we do not offer a BAA.

Financial and payment information: collected

Payment details for your Skopx subscription are collected and processed by Stripe. We do not store your full card number.

Separately, and importantly: we do not intentionally collect financial data from the pages you visit, but a card number that is visible as text on a page you ask about can reach our servers. Our redaction pass removes Luhn valid card numbers from page text on the extraction path. It does not run on the browser agent's own page reading tools. If you ask the assistant to read or act on a page that is displaying a card number, bank account number or similar, assume it can be transmitted. See What Redaction Does and Does Not Do.

Authentication information: collected

There are two separate things here and they should not be confused.

Signing you in to Skopx. The extension reads your own Skopx session cookie on skopx.com so you do not have to log in twice. It stores that session token in the extension's session storage and refreshes it against Supabase, our authentication provider, when it is close to expiring. This applies only to cookies on skopx.com.
Reading cookies and storage on other sites. When you ask the assistant to work with a page, it can call tools that return the non httpOnly cookies for that site as name and value pairs, and localStorage or sessionStorage entries. Cookie values are cut off at 200 characters. When storage is listed in bulk, up to fifty entries come back and each value is cut off at 500 characters, but when a specific key is requested its value is returned in full. These cut offs are size limits, not security controls: plenty of session tokens are shorter than 200 characters and would come back whole. These tools only run against the site you are on, only while you are using the assistant on that page, and only as part of answering something you asked. They are not run on a schedule and not run on pages you have not engaged with.

Personal communications: collected

Meeting Mode captures the audio of a browser tab you explicitly select and transcribes it. Transcription runs locally in your browser using a small speech model, so the audio itself never leaves your machine. The resulting transcript text is shown in the side panel, and is sent to our servers only when you ask the assistant something that uses it.
Google Meet captions are read from the page when you are in a Meet call with captions turned on, and are shown in the same transcript.
Interview Mode microphone input is handled by Chrome's built in speech recognition, which means Google receives that audio. See the dedicated section below.
Messages and email on pages such as Slack and Gmail are read as page content when you ask the assistant about them.

Location: not collected

The extension never calls the browser's geolocation API and does not request location permission. As with any web service, our servers see the IP address your requests come from, which gives a rough geographic area.

Web history: collected

The URL and title of the tab you are working in are sent to our servers as context for your conversation, so the assistant knows what you are looking at. The extension does not read your browsing history database and does not have the Chrome history permission. It sees the tabs you use it on.

User activity: collected

When you ask the assistant to do something on a page, it performs clicks, typing, scrolling, form filling and navigation on your behalf, and it records what it did so it can report back and so you can see the run. It does not monitor your own clicking and typing when you are not asking it to act.

Website content: collected

Page text, structured page snapshots of the elements on the page, and JPEG screenshots of the visible tab. All of it is captured in response to something you asked, and sent to our servers so a model can answer.

The Extension: How It Signs You In

The extension needs to know you are you before it will talk to our API. It does this by reading the Skopx authentication cookie set by skopx.com in your own browser, which is the same cookie your logged in browser tab uses. It keeps the session token in extension session storage, which Chrome clears when the browser closes, and exchanges the refresh token with Supabase for a new token when the old one is close to expiring.

This is the only cookie reading the extension does on its own initiative, and it is limited to skopx.com. Cookie access on other sites happens only through the page tools described above, and only when you ask the assistant to work with that page.

The Extension: Page Content and Page Context

When you ask the assistant about a page, one or more of the following can be captured and sent to our servers:

The page's main text, up to a size cap, with navigation, ads and other boilerplate stripped out. If you have text selected, your selection is included and can replace the rest of the page.
A structured snapshot of the page's interactive and content elements, with their labels and visible text, so the assistant can find the right button or field.
Page metadata: title, URL, description, meta tags, and structured data the site publishes about itself.
Tables and lists, and specific fields when you ask for data in a particular shape.
A JPEG screenshot of the visible part of the tab, when the assistant needs to see the layout rather than read the text.
Files you attach in the side panel, including images and documents, which are uploaded so they can be converted to text.

Some well known work tools get purpose built extraction, so the assistant understands their structure rather than scraping raw text. Those tools currently include Jira, GitHub, Confluence, Notion, LinkedIn, ServiceNow, Salesforce, Slack, Zendesk and HubSpot. Every other site uses the general purpose extractor.

The extension is installed with access to skopx.com and a small set of work tool domains. Access to all other sites is an optional permission that Chrome asks you for, and you can revoke it at any time from the extension's settings in Chrome.

What Redaction Does and Does Not Do

We run a pattern based redaction pass over extracted page text. It looks for and replaces US Social Security numbers, phone numbers, email addresses, credit card numbers that pass a checksum test, AWS access keys, labelled API keys and tokens, labelled medical record and patient identifiers, and labelled name fields.

This protection is partial, in three specific ways. We would rather state them than let you assume more than is true.

It does not run on every path. The redaction pass runs when a page is captured through the extraction pipeline, which is the path used for all site types including ordinary web pages. It does not run on the browser agent's own page reading tools. When the assistant snapshots a page to find a button, reads the page text directly, pulls fields into a table, or reads cookies and browser storage, that data is returned as it appears on the page, without a redaction pass.
It is pattern matching, not understanding. Names, addresses, dates of birth, salary figures, health details written in prose, customer records and anything else that does not match one of the patterns above passes through unchanged. Page content routinely contains real names and email addresses of people who are not you, and email addresses are the only one of those we reliably remove.
Patterns miss things. The rules deliberately skip matches that look like version numbers, dates, IP addresses and hashes, so real data formatted unusually can be missed, and the reverse can happen too.

There is one protection that does hold across paths. Fields the browser recognises as secrets, meaning password fields and fields whose type, name, label or placeholder mark them as a password, PIN, card number, CVV, SSN, one time code, routing number or account number, have their values blanked before any page listing is handed to a model. That is a targeted rule about form fields. It does not clean up a card number printed as ordinary text in the middle of a page.

The practical guidance: treat anything visible on a page you ask the assistant about as something that can be transmitted. If a page is showing data you would not paste into a chat window, do not ask the assistant about that page.

Meeting Mode: Tab Audio

Meeting Mode captures the audio of one browser tab that you pick when you start it. Chrome shows a capture indicator on that tab while it is running.

The audio is transcribed on your own machine by a small speech recognition model running inside the extension. The audio is not uploaded to us and is not sent to any third party.
The model's weights are downloaded once from huggingface.co and cached by your browser. That is a download of data to you. No audio, transcript or other content is uploaded there.
The transcript appears in the side panel. It is sent to our servers, and from there to an AI model provider, only when you ask the assistant for help using it.
If you are in a Google Meet call with captions on, the finalized captions are read from the page and folded into the same transcript.
Closing Meeting Mode stops the capture and clears the transcript from the panel.

Interview Mode: Your Microphone Goes To Google

Interview Mode, and the voice input button in the side panel, use the speech recognition built into Chrome, called the Web Speech API. We want to be direct about what that means, because the interface does not make it obvious:

In Chrome, that API sends your microphone audio to Google's speech recognition servers for transcription. Google receives that audio, and Google's privacy policy governs what happens to it. This is Chrome's behaviour, not something we add, and we cannot change it while using that API.
Skopx receives the resulting text, not the audio. The text is used the same way as anything else you type into the assistant.
This is separate from Meeting Mode. Meeting Mode's tab audio is transcribed locally and does not go to Google. Only the microphone side goes through Chrome's speech recognition.
Chrome asks for microphone permission before this can run, and you can revoke it in Chrome's site settings. Stopping Interview Mode releases the microphone.

Actions the Assistant Takes For You

When you ask the assistant to do something on a page, it can click, type, scroll, fill forms, select options, upload a file you provided, and navigate. To do this reliably on sites that block synthetic events, it uses Chrome's debugging interface, which is why Chrome shows a banner saying the extension is debugging the tab. That banner is expected while the assistant is working, and the connection is dropped when the tab goes idle.

Two limits are enforced in code, not by asking the model nicely:

It never types credentials. Password fields, card numbers, CVVs, SSNs, PINs, one time codes, routing numbers and account numbers are never filled in by the assistant, at any autonomy setting. It stops and hands that step back to you.
It never does something irreversible without your approval. Any control that reads as publish, post, send, reply, pay, purchase, subscribe, apply, submit, delete, deactivate, authorize, connect or sign in pauses the run and asks you to approve that specific control. If you decline, do not answer, or the page changes after you approved, the action is refused. This decision is made from what the page itself says about the button, not from what the model claims it is doing, because a page can contain text written by someone trying to manipulate the assistant.

The extension does not have a mode where it acts on pages without you having started something.

The Web App: What We Collect

Account information

Name and email address
Company or organization name, and your team membership
Payment information, collected and processed by Stripe
Your own AI provider API keys, if you supply them, stored encrypted

What you send to the assistant

Your messages and the assistant's replies, kept as conversation history so the assistant has context
Files and documents you upload
Documents, reports and other work the assistant produces for you
Facts the assistant saves to memory so it does not ask you the same thing twice

Connected tools

When you connect a tool such as a CRM, a support desk, a data warehouse or a mailbox, you authorize Skopx to access it on your behalf, and we retrieve data from it to answer your questions and take actions you ask for. We access what the task needs. You can disconnect any tool at any time from the connections page, and revoke access at the provider as well.

Usage and diagnostics

Feature usage and page views, through Google Analytics and PostHog
Browser and operating system information
IP address, used for security and abuse prevention
Error and performance logs

Why We Collect It

To answer your questions and carry out the tasks you ask for
To keep conversation context so you do not have to repeat yourself
To sign you in and keep your session valid
To process payments and manage subscriptions and seats
To find and fix bugs, and to see which features are used
To detect and prevent abuse
To meet legal obligations

We do not sell personal information. We do not use your page content, conversations or transcripts to train our own models.

Where Your Data Goes

Everything the extension sends goes to skopx.com first. From there it can reach the following:

AI model providers. Your messages and the page content, transcripts and files attached to them are sent to the model provider that answers you. Many Skopx users supply their own API key, and in that case the content goes to that provider on your own account, under the agreement you have with them, and their policy governs it. The providers you can select are Anthropic, OpenAI, Google, Mistral, Groq, DeepSeek, xAI and OpenRouter.
Supabase. Authentication and our application database.
Stripe. Payments and subscription management.
Composio. The connector layer used to reach the third party tools you connect.
Chroma. Storage for the embeddings behind assistant memory and search.
Railway. Hosting for the application.
Resend. Sending transactional and notification email.
Google Analytics and PostHog. Website and product analytics. These run on skopx.com, not inside the extension side panel.
Google, through Chrome's speech recognition. Microphone audio in Interview Mode and voice input, as described above.
Hugging Face. A one time download of the local transcription model's weights. Nothing is uploaded.

Each of these has its own privacy policy and its own handling practices. We do not control what a provider does with data once it reaches them under your own API key.

Storage and Security

We take the following measures:

Data is encrypted in transit using TLS
Stored API keys and other secrets are encrypted at rest
Database access is restricted per user and per organization
Session tokens in the extension live in browser session storage, which Chrome clears when the browser closes
Meeting transcripts are held in the side panel while the session is open and are not written to our servers on their own

No system is perfectly secure, and we do not claim ours is. We hold no security certification and we do not currently offer a data processing agreement or a business associate agreement.

Data Retention

We keep account information, conversation history, saved page extractions, uploaded files and assistant memory for as long as your account is open, so that the product works as you expect across sessions. You can delete individual conversations, extractions and memories from the app at any time, and deleting them removes them from our database.

When you close your account, we delete your account and the data associated with it. Payment and billing records are kept for as long as tax and accounting law requires. Backups and logs are cycled out on their own schedule and can hold copies for a period after deletion.

Conversation history, saved page extractions and the page content attached to them are deleted automatically 90 days after they were last used. You do not have to ask for this and you cannot be charged for it. Billing records are kept longer because tax and accounting law requires it. If your organization needs a different window, write to us and we will tell you honestly what we can do.

Your Controls

Each thing described in this policy can be turned off. Here is how:

Stop the extension entirely. Remove it from Chrome at chrome://extensions. Removing it ends all page reading, all actions, all audio capture and all cookie access, and clears its stored session token. This is the complete off switch.
Stop it reading a particular site. In Chrome, open the extension's details and set site access. Access to sites beyond skopx.com and our built in work tool list is an optional permission you can revoke at any time. Note that the debugging permission used to act on pages is granted at install and cannot be revoked separately by design of Chrome's permission model. If you do not want the extension to have it, remove the extension.
Stop tab audio capture. Close Meeting Mode in the side panel. The capture stops immediately, the tab's capture indicator clears, and the transcript is dropped from the panel.
Stop microphone use. Stop Interview Mode, or revoke microphone permission for the extension in Chrome's settings. Both prevent any further audio reaching Chrome's speech recognition.
Stop the assistant acting on pages. Use draft mode, which lets it read and navigate but refuses anything consequential. You can also decline any approval request, or close the side panel to end the run.
Disconnect a tool. Use the connections page in the dashboard, and revoke the authorization at the provider as well.
Delete your data. Delete conversations, extractions and memories in the app, or close your account in settings.
Ask us. Write to team@skopx.com to request a copy of your data, correct it, or have it deleted. Tell us which account the request is for and we will verify it is yours before acting.

Requests About Your Data

Wherever you are, you can ask us to give you a copy of the personal data we hold about you, correct it if it is wrong, delete it, or export it in a portable format. You can also opt out of marketing email. We do not sell personal information, and we do not discriminate against anyone for making a request.

Send requests to team@skopx.com. We will verify that the request comes from the account holder before acting on it.

Cookies

On skopx.com we use cookies to keep you signed in, remember your preferences, and measure site usage. You can control cookies in your browser settings, though clearing the session cookie will sign you out of both the web app and the extension.

Children's Privacy

Skopx is a business product and is not intended for children under 13, and the extension is not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, write to team@skopx.com and we will delete it.

International Data Transfers

Our infrastructure and our providers operate in several countries, so your information may be transferred to and processed outside the country you are in, including the United States.

Changes to This Policy

We will update this policy when the product changes. When we do, we will change the date at the top of this page. If a change materially affects what we collect from the extension or where it goes, we will say so on this page and notify account holders by email rather than changing it quietly.

Contact

Questions about this policy, or about anything in it you think is wrong or unclear:

Email: team@skopx.com
Website: https://skopx.com
Entity: Skopx
Address: Arlington, Virginia, United States

Privacy Policy