Privacy Policy

Last updated: 2026-09-08

according to is a Chrome extension that checks claims you select on the web against real search results, weighted by a list of domains you personally curate. This policy describes exactly what data the extension and its backend collect, why, and where it's stored — nothing more.

What we collect

Email address. Collected when you create an account, via Supabase Auth. Used only for sign-in. An account is required to use the extension at all, since every check is scored against your own trust list.

Your trusted-domains list. Each domain you add on the Sources tab, plus the trust score you assign it. You fully control this list — add, edit, or remove entries at any time.

Search history, including the sources behind each result. Each time you check a claim, we store the claim text, the resulting verdict, the confidence score, and a timestamp — plus, for every source used to reach that result, its domain, your trust score for it, the LLM's judgment of how that source relates to the claim (supports it, settles part of it, doesn't say enough to tell, is off topic, or contradicts it), the snippet text, and the source URL. This is what powers the Searches tab, including its "see sources" evidence view. We do not store the raw text you originally selected on the page — only the claim(s) extracted from it (see "How your data is processed" below).

Feedback you give on a result, if you give any. A thumbs up/down on a result, and an optional short note if you choose to add one. Tied to the specific search it's about and to your account, so we can tell which results people found useful and, when you write something, actually read it. Entirely optional — nothing is collected here unless you tap a thumb.

Billing and subscription state, if you subscribe. Your Stripe customer ID, current plan, and subscription status. We never see or store your card details — those go directly to Stripe's own hosted checkout page.

Your own Anthropic API key, only if you choose the "bring your own key" (BYOK) plan. Stored encrypted at rest. Used to make Anthropic API calls on your behalf so that usage bills to your own Anthropic account instead of ours. If you're on the BYOK plan and also choose GPT-5 mini as your model, you'll need to provide your own OpenAI API key too, for the same reason — stored the same way (encrypted at rest).

Your AI model choice, if you change it. The Account tab lets you pick Claude (the default) or GPT-5 mini for claim extraction and stance classification. This preference is stored with your account (see "How your data is processed" below for what picking GPT-5 mini means for where your data goes).

Internal quality-tuning logs. We log the input and output of each search, stance-classification, and contradiction-verification call, and the output only (never the input) of each claim-extraction call, to a table only our own systems can query — never exposed through the extension, an export, or any user-facing feature — so we can inspect and improve the pipeline's accuracy over time. This can in principle be correlated back to a specific check, and therefore your account, since it's tied to the same internal id as your search history. Claim extraction's input is excluded specifically because it's the raw text you selected on a page, for the same reason we don't store that as part of your search history above.

On your device, via Chrome's storage API. Your sign-in session (access and refresh tokens, plus your user id/email), so you stay signed in between browser restarts; three small display preferences (confidence-mode, trust-score scale, and light/dark theme); and a short-lived cache of your most recent check result, so reopening the popup shows it instantly. None of this leaves your device except your session token, which is sent to authenticate your own calls to our backend.

On your device, via your browser's localStorage, if you use the web dashboard at accordingto.app/app.html. The web dashboard (Sources and Searches, viewable outside the extension) is the same account as the extension and stores the same kind of sign-in session — access and refresh tokens, plus your user id/email — in your browser's local storage instead of Chrome's storage API. It talks directly to Supabase (see below) using that session, the same way the extension does; no separate account or password is involved. Signing out on the dashboard clears this from your browser.

How your data is processed

Checking a claim involves a few third-party services along the way:

• Claim extraction. The raw text you selected is sent to an AI provider — Anthropic's Claude API by default, or OpenAI's API if you've chosen GPT-5 mini on the Account tab — to narrow it down to up to 3 specific, checkable claims, and to judge whether the text reads as a checkable factual claim at all (as opposed to an opinion or anecdote). This raw selection is not stored by us — only the extracted claim(s) that result from it, once you confirm and run a check. If the text didn't read as a checkable claim, the steps below (search and stance classification) are skipped entirely and the result is recorded as "not assessable" with no sources.
• Search. Finding sources for a claim means sending the claim text as a search query to Serper.dev, plus your browser's country/language so results are geo-targeted to you rather than to our server's location. If Serper is unavailable, we fall back to Brave Search with the same claim text and locale.
• Stance classification. The claim text and the retrieved result snippets are sent together, in a single request, to the same AI provider as claim extraction above (Anthropic or OpenAI, by your model choice), which judges how each snippet relates to the claim: whether it supports the claim, settles part of it, doesn't say enough to tell, is off topic, or contradicts it. Where a snippet is judged to contradict the claim, we send one further request to the same provider asking whether the claim and that snippet could both be true, before recording the result.
• Billing. If you subscribe, checkout and payment happen entirely on Stripe's own hosted pages. We only receive your Stripe customer ID and subscription status back via Stripe's webhooks.

If you're on the BYOK plan, claim extraction and stance classification are billed to your own account with whichever provider you've chosen (using your stored key) instead of ours; otherwise they run on our shared Anthropic or OpenAI account, matching your model choice. On the BYOK plan, choosing GPT-5 mini without first providing your own OpenAI key doesn't bill usage to our account on your behalf — it simply keeps using Claude via your Anthropic key until you add one. Anthropic's, OpenAI's, Serper's, Brave's, and Stripe's handling of the data sent to them is governed by their own respective privacy policies, not this one.

Where your data is stored

Your email, trusted-domains list, search history (including per-source snippets and links), any feedback you've given, subscription/billing state, and — if you're on the BYOK plan — your encrypted Anthropic and/or OpenAI API key are stored in Supabase, a third-party backend-as-a-service provider we use for our database and authentication. Row Level Security scopes every row to your own account, so only you (and, operationally, us as the service operator) can access your data — never other users.

Supabase, Anthropic, OpenAI, Serper, Brave, and Stripe all operate infrastructure in the United States. Using according to means your data may be processed and stored outside your own country, including the US, regardless of where you are.

How we secure your data

• All traffic between the extension, the web dashboard, our backend, and every third-party service above travels over HTTPS.
• Your BYOK Anthropic and/or OpenAI API key, if you provide one, is encrypted at rest (Fernet/AES) before it's stored, and only decrypted in memory at the moment it's used to make an API call on your behalf.
• We never see or store your card details — Stripe's own hosted checkout handles those directly.
• Supabase Row Level Security enforces account-scoping at the database level, not just in application code.

How long we keep your data, and how to delete it

We keep your account data — email, trusted-domains list, search history, feedback, and billing state — for as long as your account is active. Feedback is deleted automatically if the search it's attached to is (there's no separate "delete this feedback" control, since feedback without the search it's about wouldn't mean anything). You can remove individual trusted-domain entries yourself at any time from the Sources tab, and export your full search history at any time from the Searches tab. To delete your account and all associated data, email us at the address below; we don't yet have a self-serve "delete my account" button, so this is handled manually on request.

Your rights

Depending on where you live, you may have rights under laws like the EU/UK GDPR or the California CCPA/CPRA to access, correct, export, or delete your personal data, or to object to how it's processed. You can already do most of this yourself in the extension (see above); for anything else, email us at the address below and we'll honor applicable requests.

Children's privacy

according to is not directed to children under 13, and we do not knowingly collect data from them.

Changes to this policy

If we materially change what data we collect or how we use it, we'll update this page and its "Last updated" date, and adjust the extension's in-product disclosures to match. Continuing to use according to after a change means you accept the update.

What we don't do

We do not sell your data to third parties, and we do not use your search history, source data, or trusted-domains list for advertising.

Contact

Questions about this policy: jonathan.kammering@gmail.com