Privacy Policy
AI Chat Vault is a Chrome extension that saves a Gemini or Claude conversation you have open into a library on that device. An optional Pro license unlocks the rest of the library tools. This policy covers the extension and the license service it calls.
The public site for this policy is https://aichatvault.ecflowing.com/privacy. Questions go to xintiao1230@outlook.com.
What stays on this device
The extension reads the Gemini or Claude conversation that is already open and stores it in this browser. That library is not uploaded.
On https://gemini.google.com/* and https://claude.ai/*, a content
script reads the open chat only:
- whether it is Gemini or Claude
- the conversation id and the canonical link for that chat
- the title
- messages already shown on the page: role (you or the assistant), plain text, markdown, and a timestamp when the page shows one
It does not import the sidebar list of other chats. It does not call Gemini or Claude APIs, and it does not read those sites' cookies or account tokens. It does not run on other websites.
Images inside a message are not saved as image files. If an image has alt text, that text can be kept. Code that is part of the message is kept as text. The extension does not expand collapsed thinking or tool traces. Text that is already visible in the message can be saved with the message.
The script is injected on those two hosts. Until the address is a conversation, it does not store a chat.
The library is kept in IndexedDB in the extension's own storage (database name
ai-chat-vault):
- conversations, messages, and folders you create
- up to seven backup copies of that library, on this device, when Pro is on
- a temporary copy of one conversation when you use Print / Save as PDF
Search runs in this browser. The words you type into search are not sent anywhere. Export downloads a file to this computer (Markdown, plain text, and, with Pro, JSON, a print-to-PDF page, or a ZIP). The extension does not upload that file. Importing a Claude export reads a file you choose and writes it into the same local library.
chrome.storage.local on this device holds:
- a random device id created by the extension (a UUID, not a hardware serial number)
- the license record if you activate one: the license key, this device's instance id and name, status, product id, activation count and limit, expiry, and the time of the last check
- an optional override of the license-server address, if you set one
Uninstalling the extension removes this IndexedDB database and this
chrome.storage.local data with the extension. Files you already downloaded stay
where you saved them. Deleting one chat in the popup removes that chat and its messages from
the library.
What leaves this device
Conversation text, titles, folders, backups, and exports are not sent to us.
The only network calls the extension makes are license calls to our Cloudflare Worker:
https://ai-chat-vault-license.aichatvault.workers.dev
| Action | What is sent | When |
|---|---|---|
| Activate | License key and instance name (vault- plus the device id) |
You choose Activate |
| Validate | License key and instance id | You open the popup, and about every 12 hours if a license is stored |
| Deactivate | License key and instance id | You choose Deactivate this device |
| Checkout |
The plan name only (monthly, yearly, lifetime,
or earlybird)
|
You choose a Buy button |
The Worker forwards the license key and instance to Creem, and asks Creem for a checkout URL for that plan. The Creem API key stays on the Worker. It is not in the extension.
The extension then opens Creem's checkout page. It does not send your name, email, or card number with the checkout request.
The Worker does not keep a database of these requests. Its code holds a short-lived count of requests per IP address in memory (about 30 requests in 10 minutes) so the license endpoints are harder to abuse. That count is not a profile of you, and this code does not write it to a database.
If a license check cannot reach the server, Pro can stay on for up to seven days after the last successful check, unless the saved license is already expired. If Creem says the license is expired, disabled, or inactive, Pro turns off. That grace period does not upload your library.
A production build can only contact that Worker host. The Chrome Web Store package is the production build.
Payments
Creem is the merchant of record. Card payments are entered on Creem's website, under Creem's privacy policy. The extension and the Worker do not receive your card number, security code, or full card details.
Creem issues the license key. One key can be active on up to three devices. Creem's checkout can ask you for the details Creem requires, such as an email address and billing details. Those fields are collected by Creem, not typed into the extension. The seller can see the order records Creem shows in the seller's Creem dashboard. The extension does not download those records.
Permissions in the production extension
| Permission | Why |
|---|---|
alarms |
Schedule the daily on-device backup (it does not upload) and the license recheck. |
storage |
Keep the device id and the license cache in chrome.storage.local. |
| Host access to the license Worker |
Call https://ai-chat-vault-license.aichatvault.workers.dev/* only. The
extension does not have host permission to call Creem, Gemini, or Claude.
|
| Content script on Gemini |
Read the Gemini conversation you have open at
https://gemini.google.com/*.
|
| Content script on Claude | Read the Claude conversation you have open at https://claude.ai/*. |
The production manifest does not request tabs, scripting,
webRequest, downloads, cookies,
identity, or access to all websites.
There is no remote code. The extension runs the scripts packaged inside it. Opening Creem's website does not execute Creem's code inside the extension.
Analytics and advertising
The extension has no analytics, crash-reporting, or advertising SDK. It does not sell personal information. It does not use conversation content or license data for advertising, credit, or lending.
Chrome Web Store limited use
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
The extension does not request a Google user-data API. The sentence is here because the store asks the privacy policy to say it.
Children
AI Chat Vault is not directed at children under 13, and we do not knowingly collect personal information from them.
Changes
If this policy changes, the page at https://aichatvault.ecflowing.com/privacy will be updated and the effective date will change.