Privacy Policy

1. Data Controller

Entity: "mew Beta" (French micro-enterprise)
Legal representative: Adam FAYOLLE
Contact email: team@magence.studio
Website: https://mewbeta.fr
This policy complies with the General Data Protection Regulation (GDPR – Regulation EU 2016/679) and strictly adheres to the Chrome Web Store Developer Program Policies.

1. Explicit Consent

Before any data is tracked or sent to our servers, an explicit consent interface (Onboarding) is presented to the user. The extension's tracking is entirely inactive until this consent is granted. You can withdraw your consent at any time by uninstalling the extension or requesting account deletion.

1. Justification of Chrome Permissions

To fulfill its single purpose of calculating AI environmental impact, the extension requires specific Chrome permissions. Here is exactly how they are used:

webRequest & host_permissions (AI Platforms): Used to intercept network requests made to ChatGPT, Claude, Gemini, and Mistral. This allows the extension's background worker to intercept the API calls, count the number of characters in the prompt, and detect the AI model used. The text is processed dynamically in memory and dropped immediately.
tabs: Used exclusively to detect when you are actively using a supported AI platform to inject the required script, and to automatically open or focus the Mew onboarding tab upon installation.
storage: Used to store your session token locally, save your interface preferences, keep track of unread activity, and maintain a temporary local queue of calculated metrics if your network disconnects.
host_permissions (Supabase): Used strictly to authenticate the user and transmit the calculated environmental metrics to our secure backend (https://wwzfjiogscvmozzptbbg.supabase.co/*).
4. Data Collected & Processed

Data processed LOCALLY (Never transmitted):

Prompt Content: The semantic text of your questions to the AI.
Response Content: The semantic text of the AI's answers.
Mechanism: Our scripts (content.js and background.js) read this text locally solely to calculate its length (number of characters/tokens). The text itself is immediately discarded and never leaves your browser.
Data TRANSMITTED to our servers:

Email Address & User ID: For authentication and associating your metrics with your dashboard (via Supabase).
AI Platform & Model: (e.g., "ChatGPT", "GPT-4o-mini").
Message Size: The numerical integer representing the total length of the prompt and response.
Environmental Metrics: Calculated energy (Wh), CO₂ (grams), and water (mL) estimates.
Timestamp: Date and time of the calculation.
Data explicitly NOT collected:

Browsing history outside the supported AI platforms.
IP addresses (beyond standard transient server logs managed by our hosting provider).
5. Subprocessors and Data Transfers

We use the following third-party infrastructure to operate our service. We only share the minimum data required.

Supabase: (Server location: Paris, France). Used for secure user authentication, password hashing, and database hosting for your environmental metrics.
Stripe: (Ireland, EU). Used exclusively for processing donations. We do not store or process full credit card details on our servers.
6. Retention Periods

Account data (email, ID): Lifetime of the account + 30 days after deletion request.
Aggregated metrics (CO₂, energy, water, size, platform): Lifetime of the account.
Raw text prompts/responses: 0 seconds (Deleted locally in memory, never stored).
7. Security

Encryption in transit: All communications between the extension and our Supabase backend use HTTPS/TLS.
Encryption at rest: Data is encrypted at rest on our Supabase instances.
Data Isolation: The extension utilizes Isolated Worlds for its content scripts where applicable to prevent interference with page operations.
8. Your GDPR Rights

Under the GDPR, you have the right to Access, Rectification, Erasure (Right to be Forgotten), Restriction, Portability, and Objection regarding your personal data.

To exercise these rights, please email us at adam@mewbeta.fr . We will process your request within 30 days. You also have the right to lodge a complaint with the CNIL (cnil.fr).