Privacy Policy

01 Overview

PWNY ("the Extension") is a Chrome browser extension developed by Ciklo that provides AI-powered cybersecurity lab assistance, including translation, text-to-speech, and contextual AI chat. This policy explains what data PWNY collects, how it is used, and how it is protected.

02 Data We Collect

Data stored locally on your device (via chrome.storage.local):

• Your AI provider preference (DeepSeek or OpenAI)
• API keys you provide (DeepSeek, OpenAI, ElevenLabs)
• PWNY license key and subscription plan
• Selected voice ID and cached voice list
• Study timer state and session data
• Learning notes you save during sessions
• Lab context text you paste into the extension

Data processed but NOT stored by us:

• Page text content when you use the Translate or Summarize features
• Selected text when you use the Explain or Deep Dive features
• Chat messages you send to the AI assistant
• Screenshots captured during Lab mode (processed by OpenAI Vision, not stored on our servers)

03 API Keys & Credentials

Pro plan users: If you are on the Pro plan, AI and voice requests are routed through our secure proxy server (pwny.ciklo.me). In this case, your license key is sent to our server for authentication, and we use our own API keys to process your requests. Your content is forwarded to OpenAI/ElevenLabs and is subject to their respective privacy policies.

04 Payments & Stripe

Subscription payments are processed by Stripe. When you subscribe:

• Stripe collects your payment information (card number, email, billing address)
• PWNY receives your email address and subscription status via Stripe webhooks
• We generate a unique license key (PWNY-XXXX-XXXX-XXXX-XXXX) linked to your email
• We store: license key, email, plan type, subscription status, and creation date
• We do NOT store credit card numbers or payment details

05 Chrome Extension Permissions

PWNY requests the following browser permissions:

• activeTab — To read page content for translation and to capture screenshots
• storage — To save your settings, API keys, and session data locally
• scripting — To inject the PWNY panel into web pages
• contextMenus — To add the "Explain this" right-click option
• commands — To register keyboard shortcuts (Ctrl+Shift+Y)

The extension does not run in the background. It activates only when you explicitly trigger it via keyboard shortcut, context menu, or by clicking the extension icon.

06 Third-Party Services

PWNY integrates with the following third-party services. Your use of these services is governed by their respective privacy policies:

• OpenAI — GPT-4o / GPT-4o Mini for AI chat and vision analysis (Privacy Policy)
• DeepSeek — DeepSeek Chat for AI text processing (Privacy Policy)
• ElevenLabs — Text-to-speech voice synthesis (Privacy Policy)
• Stripe — Payment processing (Privacy Policy)

07 Data Retention

• Local data (settings, notes, timer) is stored until you uninstall the extension or clear it manually
• License records are retained for the duration of your subscription plus 30 days after cancellation
• We do not retain any AI conversation content, page text, or screenshots on our servers

08 Security

• All communications with our server use HTTPS/TLS encryption
• API keys are stored locally and never leave your browser (Starter plan)
• Stripe webhook signatures are verified to prevent tampering
• Database queries use parameterized statements (prepared statements) to prevent SQL injection
• The extension uses Shadow DOM isolation to prevent XSS attacks

09 Your Rights

You have the right to:

• Access your data — View all stored data via chrome.storage.local in DevTools
• Delete your data — Uninstall the extension to remove all local data
• Cancel your subscription — Manage via Stripe's customer portal
• Request deletion of your license record — Contact us at the email below

10 Contact

For questions, data deletion requests, or privacy concerns, contact us at:

11 Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Extension after changes constitutes acceptance of the revised policy.