vocaboo-privacy

Vocaboo Privacy Policy

Last updated: 2026-05-25

Vocaboo is a browser extension for learning English vocabulary from text you select while browsing. This policy describes what data the extension touches, where it is stored, and what we do (and do not) do with it.

Summary

• Everything stays on your device by default. Vocabulary, review history, and settings are saved in your browser’s local IndexedDB and chrome.storage.local. Nothing is sent to Vocaboo servers.
• No tracking, no analytics, no advertising. The extension does not embed third-party trackers or send telemetry.
• AI providers are opt-in and self-configured. When you enable a remote AI provider (OpenAI, Azure OpenAI, or a Custom HTTP endpoint), the selected text is sent to the endpoint and API key you configured — never to us.
• API keys are encrypted at rest using AES-GCM-256 with a non-extractable key stored in the browser’s IndexedDB.

Data the extension handles

Data	Where it is stored	When it leaves your device
Selected text on web pages	RAM only while the tooltip is open	Sent to your configured AI provider when you click “Explain & Extract” (only if a remote provider is enabled)
Page URL and title of the active tab	chrome.storage.local (most recent selection only)	Never
Saved vocabulary, definitions, examples	Browser IndexedDB	Never
Spaced-repetition review history	Browser IndexedDB	Never
User settings (theme, AI provider choice, etc.)	chrome.storage.local	Never
AI provider API keys	chrome.storage.local as AES-GCM ciphertext	Used in HTTPS requests to the endpoint you configured

Remote AI providers

When you switch the AI provider in Settings to a remote option, calls go directly from your browser to the endpoint you configured:

• OpenAI — https://api.openai.com/v1/chat/completions
• Azure OpenAI — the deployment URL you entered
• Custom HTTP — the URL you entered

Those providers receive the selected text and a small instruction prompt. Their own privacy policies apply. Vocaboo has no servers in the request path.

The default provider is the bundled Local heuristic provider, which runs entirely in your browser and never makes network requests.

Permissions the extension requests

Permission	Why it is needed
activeTab	Read the user’s text selection on the page they’re viewing when the tooltip is invoked.
storage	Persist saved vocabulary, settings, and the latest selection in the browser’s local storage.
contextMenus	Add a right-click “Explain selection with Vocaboo” entry.
sidePanel	Open the Vocaboo side panel that shows the AI explanation and lets you save vocabulary.
alarms	Schedule a daily review reminder alarm.
host_permissions: <all_urls>	The content script must run on any site where the user wants to highlight text. The script only activates on user-initiated selections and never reads page content automatically.

Data deletion

• Clear your vocabulary, review history, and settings by removing the extension from your browser, which deletes all of its IndexedDB and chrome.storage.local data, or by visiting Settings → Data & privacy inside the extension (when implemented).
• API keys you have configured are removed alongside settings when the extension is uninstalled.

Children

Vocaboo is a general-audience learning tool. It does not knowingly collect data from children, because it does not collect data from anyone server-side.

Changes to this policy

We will update this file in the repository when behavior changes and bump the Last updated date at the top.

Contact

Open an issue at https://github.com/lbsong01/langcoach/issues for questions about this policy or about the data handling of any feature.