Privacy policy

Who is responsible

The data controller is MB „Di Automatizacijos“ (a Lithuanian small partnership), company code 308095715, Vilniaus g. 8, LT-21118 Trakai, Lithuania. Email: lukas.bagdevicius@gmail.com. We have not appointed a data protection officer; write to the email above about anything in this policy.

The extension

When you open BotsRead on a page (the audit)

BotsRead uses Chrome’s activeTab permission, so it can read a tab only after you click its icon or press its keyboard shortcut (Alt+Shift+S; Option+Shift+S on a Mac), and only that tab. It then reads from the open page:

• the URL, title, meta tags (description, robots, canonical, Open Graph), language and headings;
• the visible text, counted and sampled for the checks;
• links and images (counts, whether images have alt text, whether a link points to another site);
• structured data (JSON-LD), author and date tags;
• loading performance of your visit (Largest Contentful Paint, layout shift).

To compare with what crawlers get, your browser downloads from the same site, directly: the page’s HTML (without your cookies, as a logged-out crawler would), /robots.txt, /llms.txt and the sitemap. These requests go only to the site you are checking.

All of this is processed inside the extension on your device. None of it is sent to us or anyone else, and it is discarded when you close the popup.

If you click “Show on the page” (Crawler view), BotsRead fetches the page’s HTML once more in the same way and marks, on the page itself, the text crawlers don’t get. This also happens only in your browser and sends nothing to us or anyone else; the view stays in that tab until you close it or leave the page.

Install and uninstall pages

After you install BotsRead from the Chrome Web Store, it opens botsread.app/welcome once, with a tag in the link that says the visit came from the extension. When you remove it, Chrome opens botsread.app/bye. These are ordinary visits to our website (see The website botsread.app); the extension itself sends no usage data.

When you click an AI fix

AI fixes are the only feature that sends page content off your device, and only when you click one. The extension then sends:

• the page address without its ?query or #fragment (or the page’s canonical URL), its language, title and meta description;
• up to 60 page headings;
• up to 12,000 characters of the page’s main text — taken from the logged-out version of the page whenever that has the content, so text you only see when signed in is not sent;
• your licence key, if you have Pro.

The extension asks for your OK the first time you use AI fixes on each website, and names that website. The data goes to our server (a Cloudflare Worker), which forwards the page data to Anthropic’s API (a Claude model) and returns the draft to your browser. Like any server, ours also receives your IP address. For the 3 free AI fixes only, the server keeps a count of free fixes per IP address (for IPv6, per /64 network) and per day, stored under a one-way hash of the address rather than the address itself; it is deleted automatically after 2 days and used only to stop abuse of the free trial. We don’t store the text you send or the drafts we return. Anthropic doesn’t use API data to train its models; it keeps API inputs and outputs for up to 30 days for abuse monitoring and then deletes them automatically, unless a request is flagged for breaking its usage policy, in which case it can keep it for up to 2 years (Anthropic’s retention policy).

Please don’t use AI fixes on pages that contain personal or confidential information, such as admin panels, CRMs or private documents.

Licence checks

When you activate Pro and when you request an AI fix, our server checks your licence key with Polar’s licence API; each AI fix request uses one credit, counted by Polar when the request starts. If the request fails because of a problem on our side (the AI service is down, overloaded or busy, or doesn’t answer in time), that credit is given back for your next fix; it isn’t given back when the AI declines a page, and at most one given-back credit waits at a time. To do this, our server keeps a one-way hash of your licence key (not the key itself) with a refund counter, only while a given-back credit is waiting and for no more than 30 days after it was given back. Without a licence you can try 3 AI fixes.

What is stored on your device

The extension keeps three things on your computer only (not synced to your Google account): which websites you allowed AI fixes for — stored as one-way hashes, not as site names; how many free AI fixes you have used; and your licence key if you have Pro, encrypted with AES-GCM using a key that never leaves the browser. Uninstalling the extension deletes all of it. The AI drafts you receive are also kept, in the browser’s memory only and under a one-way hash of the page address, so they are still there when you reopen the popup; closing the browser deletes them. It doesn’t store the pages you check.

What the extension does not do

• No analytics, tracking pixels or advertising code.
• No reading of pages you haven’t opened BotsRead on (with its icon or keyboard shortcut), and no browsing history.
• No selling or sharing of data for advertising, and no use for credit decisions.
• No remote code: everything the extension runs ships inside it.

Chrome Web Store Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

In practice: we use page data only to provide BotsRead’s single purpose, auditing the page you choose and drafting fixes for it. We transfer it only to the processors named below and only when you request an AI fix. We don’t sell it, use it for advertising or personalised ads, or let people read it unless you ask us to (for example in a support request) or the law requires it.

The website botsread.app

Cloudflare hosts this site. Like any web server, it processes your IP address, browser type and the pages you request in order to deliver them and protect the site from abuse.

We set no cookies of our own. The only optional tool is the Meta Pixel, which we use to measure which ads bring visitors and installs. It loads only after you click “Accept” in the cookie banner. If you accept, Meta receives the pages you visit on botsread.app, the events “Add to Chrome” click and “completed install” (when the welcome page opens after installing), your IP address and browser details, and sets the _fbp cookie and, if you arrived from a Facebook or Instagram ad, the _fbc cookie (each up to 90 days). If you are logged in to Facebook or Instagram, Meta may link this to your account. For collecting and sending this data, we and Meta Platforms Ireland Limited are joint controllers; Meta is responsible for what it does with the data afterwards (Meta’s privacy policy).

Your choice is saved in your browser’s local storage. You can change it any time with “Cookie settings” at the bottom of every page; if you withdraw consent, the Pixel stops and we delete its cookies on this site. The extension itself never sends data to Meta.

If you arrive through a link with campaign tags (utm_source and similar), the “Add to Chrome” link on that page passes the same tags on to the Chrome Web Store, so we can see which campaign led to an install. The tags describe the link, not you, and nothing is stored.

Payments

Polar (polar.sh) sells Pro plans as our merchant of record. Polar collects your name, email address, billing address and payment details and handles invoices and VAT; we never see your card number. Polar acts as an independent controller for that data under its own privacy policy. Polar shares with us what we need to support you: your name, email address, what you bought and your licence status.

Who else processes data

Some of these providers process data outside the European Economic Area, mainly in the United States. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.

Legal bases (GDPR Article 6)

• Contract: AI fixes, licences and support you ask for (Art. 6(1)(b)).
• Consent: the Meta Pixel on the website (Art. 6(1)(a)); you can withdraw it at any time.
• Legitimate interests: keeping the site and server secure and answering questions you send us (Art. 6(1)(f)).
• Legal obligation: bookkeeping records about our income from Polar (Art. 6(1)(c)).

How long data is kept

• Audit data: not kept; it never leaves your device.
• AI fix text and drafts: not stored by us; Anthropic deletes them within 30 days (up to 2 years if flagged for abuse).
• Free AI fix counter (under a one-way hash of your IP address, or of your /64 network for IPv6): deleted automatically after 2 days.
• Licence refund counter (under a one-way hash of your licence key): only while a given-back credit is waiting, at most 30 days after it was given back.
• Settings and licence key: on your device until you uninstall the extension.
• AI drafts in the extension: in your browser’s memory until you close the browser.
• Emails to us: as long as needed to deal with your request, and deleted within 3 years of our last exchange unless the law requires longer.
• Meta Pixel: the _fbp and _fbc cookies last up to 90 days; your consent choice stays in your browser until you change or clear it.
• Accounting records: as long as Lithuanian accounting law requires.

Your rights

You can ask us for a copy of your personal data, to correct or delete it, to restrict or object to its use, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time without affecting earlier processing. Email lukas.bagdevicius@gmail.com and we will answer within one month. Since the audit happens on your device, we usually hold very little about you: mostly emails and what Polar shares with us about purchases. We don’t make decisions about you based solely on automated processing; the scores rate web pages, not people.

You can also complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or the data protection authority where you live.

Children

BotsRead is a tool for people who run websites. It isn’t directed at children under 16, and we don’t knowingly collect their data.

Changes

We will update the date at the top when this policy changes. If we change what the extension collects or where it sends data, we will also tell you inside the extension before the change takes effect.