Privacy Policy — Lookup & Translate
Who is responsible
This extension is published as Lookup & Translate, an independent project run by one developer. For anything in this policy, including a data-protection request, the contact is:
tornike.shvangiradze23@gmail.com
What the extension does
Lookup & Translate lets you select text on a webpage, right-click it, and see a translation, an explanation of what you selected, synonyms, and related images in a small popover on the page, next to the text you selected.
Automated content
Translations, explanations, synonyms and simplified rewordings are produced by an AI language model (OpenAI's GPT-5 mini). They are generated, not retrieved from an edited dictionary, and they can be wrong. Do not rely on them for anything consequential without checking.
What is sent, and where
When — and only when — you explicitly choose Lookup & Translate on a selection, the selected text is sent to our backend service, which forwards it to the configured providers to fulfil that request:
| Provider | Receives | Purpose |
|---|---|---|
| OpenAI (API) | The selected text, plus the language and level you chose | Translate it, detect its language, and explain or simplify it |
| Pixabay | The selected text | Up to three related images |
| Pexels | The selected text, and only if Pixabay fails | The same, as a fallback |
No text is sent unless you invoke a lookup. Simply browsing, selecting text, or opening the right-click menu sends nothing.
Providers process the text under their own privacy policies. Review OpenAI's privacy policy, Pixabay, and Pexels for their practices.
We ask OpenAI not to keep the text. Its API retains request and response
content for 30 days by default so it can be retrieved later; every request we send sets
store: false, which turns that retention off. OpenAI states that API data is
not used to train its models, and it keeps separate abuse-monitoring logs for up to 30 days
independently of this setting.
The image fallback is contacted only when Pixabay fails, so in normal operation the text reaches one image source.
What is stored
On your device only:
- Your preferred source and target languages, your simplification level, color-mode preference, whether to show image results, and an optional custom backend URL. These are stored in the browser's extension settings storage and synchronise across your signed-in browser profiles if you have browser sync enabled.
- The most recent selected text, held in memory-only session storage so the popover can render it. It is never written to disk and is discarded when the browser closes.
- An installation token — a random value with no meaning outside this service, created the first time the extension runs and sent with each lookup so that usage limits can be applied fairly. It is not synchronised between your browser profiles, it is not derived from anything about you or your device, and it is not linked to what you look up. Uninstalling removes it.
On our backend, we do not store the text you look up. There is no cache of translations, explanations or any other text you select — a repeat lookup is sent to the provider again rather than answered from storage.
Four things are kept, none of which identifies you:
- An image cache, for 24 hours. Pixabay's licence terms require image results to be cached, so results are held for 24 hours and no longer. Its key is a salted, one-way hash of the single word searched, so the stored entry holds no readable word. Images are only ever fetched for single words, never for sentences or passages. To be plain about the limit of this: a hash of a common word could be guessed by someone holding both the secret salt and the database. What makes this low-risk is that it is word-only, expires in a day, and carries no user identifier — not the hash on its own.
- A rate-limit record, only if you exceed the limits. If a very large number of lookups arrives from one installation or internet connection in a short time, we store a short-lived marker that pauses further lookups from it. It is keyed on a salted, irreversible hash of the installation token or of the IP address — neither the address nor the token is stored in the record — and it holds nothing about what was looked up. It expires automatically within 12 hours. No such record exists for normal use.
- The list of issued installation tokens. Each is stored on its own, with no IP address, no history and nothing about what was looked up attached to it, purely so we can tell a real installation from an automated one. A token expires a year after it is issued. We also keep a count of how many tokens have been issued to one internet connection in a day, keyed on the same irreversible hash and expiring within 24 hours, so that one source cannot create unlimited installations.
- A marker that a fault has already been reported. When the service itself breaks, a short-lived entry records that an alert for that error code was sent, so a single outage does not send a thousand messages. It holds an error code and nothing more — no text, no token, no address. It is not about you.
What is not collected
- We do not sell, rent, or share selected text or browsing history.
- We do not collect browsing history, page URLs, page content beyond the text you explicitly select, or personal identifiers.
- We do not use advertising or analytics trackers.
- We do not create user accounts or profiles.
Logging
The backend records minimal operational logs to keep the service running. Raw selected text is never logged, and neither is your IP address or your installation token. A log line contains only the endpoint, the response status, the number of characters you selected, the language codes and simplification level you chose, whether the selection was treated as a word or a phrase, how many images were returned, and — when something failed — an error code. Nothing in a log line can be traced back to you.
When the service itself fails, an alert is sent to the developer containing the error code, the HTTP status and the type of the error. It never contains selected text, your installation token, or your IP address.
Permissions and why they are needed
| Permission | Why |
|---|---|
contextMenus |
To add the "Lookup & Translate" right-click item |
storage |
To remember your preferences and hold the current selection in memory |
activeTab |
To show the results popover on the page you are reading — granted only for the tab you are on, and only at the moment you click the right-click item |
scripting |
To place that popover on the page. activeTab is what limits it to the
one tab you invoked it on
|
The extension requests no standing access to website content. It has no host permissions and no content script that runs on the pages you visit: the code that draws the popover is placed into a single tab at the moment you choose "Lookup & Translate" there, and nowhere else. It only ever receives the text you deliberately select and look up.
The popover itself is rendered inside a frame belonging to the extension rather than written into the page, which means the page cannot read what is in it and the extension does not need to read the page.
Data retention
Preferences and the installation token persist until you change them or uninstall the extension. Uninstalling removes all locally stored data, including the token. The selected text in session storage is cleared when the browser closes.
On the backend: cached image results expire within 24 hours, a rate-limit record — which only exists if the limits were exceeded — expires within 12 hours, an issued installation token expires within a year, and the count of tokens issued to one connection expires within 24 hours. Selected text is not retained at all.
Your data-protection rights
If you are in the UK, the EU, or another region with similar law, you have the right to ask for access to your personal data, its correction or deletion, a restriction on how it is used, and to object to its use; you may also ask for it in a portable form. To exercise any of these, email the address at the top.
In practice there is very little to act on, and it is honest to say why. We hold no account, no name, no email address, and no record of what you look up. The only values on our backend that relate to a person at all are a salted one-way hash of an IP address or installation token, held briefly for abuse prevention. Because those are hashed and hold no identifier, we generally cannot connect them to a particular person even if asked to — which also means there is nothing meaningful to hand over or correct. Everything the extension holds about you is on your own device, and uninstalling it deletes that.
The legal basis for the limited processing described here is our legitimate interest in providing the lookup you asked for and in preventing abuse of a service that costs money to run. Sending your selected text to the providers listed above is necessary to perform the lookup you requested.
International transfers. The providers above process data outside your country, including in the United States. Their own policies, linked in this document, describe the safeguards they apply.
Complaints. If you are unhappy with how your data has been handled, you may complain to your local data-protection authority.
No warranty
This extension and its backend are provided as is, without warranties of any kind, express or implied, including fitness for a particular purpose. The AI output can be wrong, and the service may be unavailable, interrupted, or withdrawn at any time. To the fullest extent permitted by law, the developer is not liable for any loss or damage arising from your use of it, or from reliance on anything it produces. Nothing here limits any liability that cannot be limited by law.
Children
This extension is not directed at children under 13 and does not knowingly collect information from them.
Changes
Material changes to this policy will be reflected in an updated "Last updated" date and, where significant, in the extension's store listing.