Prepublish extension privacy policy

This policy covers the Prepublish browser extension for Chrome (the "extension"). It describes what the extension stores, what it does not collect, and the four moments when it contacts anything outside your browser.

What the extension stores

The extension keeps two kinds of data on your own machine, inside your Chrome profile.

1. Your settings and the script you are working on. These go to chrome.storage.local, which is stored on disk under your Chrome profile. The settings are your default speaking pace, the pace used for words-to-minutes, whether the Script button appears on YouTube video pages, whether exports include timestamps by default, and whether a prepublish.ai form is filled automatically. The script draft is whatever text you typed or pulled in the Script tab or the workspace.
2. Short-lived session data. The pending hand-off, the last extracted transcript, the last popup tab you had open, and the last Plan sub-tool go to chrome.storage.session, which is memory only and is cleared when Chrome closes. The prepublish.ai page never reads that store directly: it asks the extension's background worker for the hand-off that belongs to the page it is on, and the worker answers only that page. The worker holds the record until the page confirms the text reached a field, then deletes it.

Nothing in either store is synced to us, to your Google account, or to any third party. The extension has no server of its own.

Neither store holds the files you export. The .txt, .srt, .vtt, and .md exports and the two transcript bundles are assembled in your browser and handed to Chrome's own download flow, which saves them wherever you have set downloads to go. The extension keeps no copy of them, and nothing in them is uploaded anywhere.

What the extension never collects

• No analytics and no telemetry. There is no event tracking, no usage counting, and no crash reporting.
• No account and no sign-in. The extension has no user accounts and never asks for credentials.
• No page content beyond what you asked for. On a YouTube video page, the extension reads the video's title, channel name, channel links, duration, thumbnail URLs, description, tags, publish date, view count, and caption tracks. It does not read other tabs, your browsing history, your bookmarks, your form entries, or your messages.
• No sensitive categories. The extension does not collect health, financial, location, or personal communications data, and it does not fingerprint your device.

When data leaves the browser

There are exactly four cases.

1. When you open one of the seven checks. The Checks tab in the popup and the "Send to a free check" rows in the workspace open a tool page on prepublish.ai. That page load carries attribution parameters (utm_source=chrome_extension, utm_medium=extension, utm_campaign=free_tools, and a ref label naming where the click came from), and the Channel Scanner also receives the channel URL you handed off as a query parameter. For the other six checks, the text you chose to send is written into the page's own form field in your browser and is transmitted to the site only if you submit that form yourself. The extension never submits it for you. The checks run on the website under the policy published at prepublish.ai, free and without an account, with a limited number of runs per day.
2. When you open a video's public transcript page. The Open transcript page buttons in the popup and the workspace, and the Script button under a YouTube player, open prepublish.ai/youtube-transcript/<video id> in a new tab. The only thing the extension sends is the video id of the video you asked about, in the page's address, along with the same attribution parameters described above. No caption text, no script, and nothing else from your browser is uploaded. The transcript on that page is fetched by Prepublish on its own servers, not from your browser, and the page is public: anyone with the link can read it, and Prepublish indexes it for search.
3. Caption requests to YouTube. When you pull a script, the extension asks youtube.com for that video's caption track. See the next section.
4. Thumbnail images from YouTube. Whenever the extension shows a video card, the browser loads the video's thumbnail image from YouTube's image host, i.ytimg.com. Pressing Download thumbnail fetches the same file so it can be saved. Both are ordinary image requests made by your browser; they carry no data about you beyond what any image request does.

Nothing leaves the browser at any other time. Opening the popup, typing in the Script tab, running the word counter, using the words-to-minutes converter, timing your speaking pace, and building an export all happen locally on your device.

Caption fetching

Caption extraction does not contact a server we control. The extension injects its own content script into YouTube video pages you have open, reads the caption track URL that YouTube's own player has already requested, and refetches that URL from youtube.com with the video's caption data in JSON format. The track it reads is the one in the language the video is spoken in, never an automatic translation of it. That request is made from your own browser session, with your own YouTube cookies, exactly as if the player had made it. The extension restores your caption setting afterwards.

If you paste a video URL instead of using the video you are watching, the extension briefly opens that video in an inactive background tab to read its caption track, then closes the tab.

The public transcript page

The extension can open the public transcript page for a video at prepublish.ai/youtube-transcript/<video id>. The popup's Video tab and the workspace's video details card each have a button for it, and the Script button under a YouTube player opens the same page once its pull finishes.

Two things are worth stating plainly.

• The extension sends only the video id. Nothing you pulled, typed, or edited in your browser is uploaded, and that page does not read anything from your browser.
• The transcript on that page is fetched by Prepublish on its own servers. It is the same video and its own captions, pulled independently of the copy in your browser. It does not come from the extension.

That page is public. It is reachable by its URL and Prepublish indexes it for search, so treat the link as something anyone can open.

Permissions

The extension asks for nothing else, and it has no permission to read or change any other website. This is the complete list from the package: storage, contextMenus, clipboardWrite, and those four host patterns. No host permission is declared for YouTube's image host, i.ytimg.com: the thumbnail requests come from the extension's own pages as ordinary image loads, not from a content script. Opening a transcript page in a new tab also uses no host permission: a declared host only lets the extension's autofill script run on that site.

Retention and deletion

Both storage areas stay on your device for as long as you keep the data. The hand-off record is deleted as soon as the prepublish.ai page confirms the text reached a field (or that the field was already filled), and any hand-off older than five minutes is discarded rather than filled in.

You can remove everything at any time:

• Open the extension's options page and press Clear stored script and settings (it asks for a confirmation click first). This removes your settings, your script draft, and everything in session storage.
• Uninstalling the extension removes every trace of both storage areas. Chrome deletes an extension's local and session storage on uninstall.

Contact

Questions about this policy or about the extension's data handling: https://prepublish.ai/contact.