Skip to content
Betav0.75.4

SpanDock for AI Chats: Browser Extension Privacy Policy

Last updated: 29 October 2026

This policy explains what the SpanDock for AI Chats browser extension (for Google Chrome and Microsoft Edge) reads, where it sends it, and what happens to it. The extension is published by Nolatech Ltd, Cyprus (“we”, “us”), the company behind SpanDock.

In short

  • The extension sends what it captures only to the SpanDock app on your own computer. It sends nothing to us, and we never receive your chats, your prompts or anything else the extension reads.
  • Every AI chat site is off until it is turned on, by you in the extension's popup or by your organisation's browser policy. Nothing is captured until the extension is paired with SpanDock on your computer.
  • Secrets are redacted in the browser before anything leaves it.
  • Whether the text of your chats is kept is decided by your organisation's prompt-capture rules in SpanDock, which show you a notice. Otherwise SpanDock keeps only the activity (which site, when, sizes and counts).
  • The extension never reads cookies, passwords or sign-in tokens, never intercepts network requests, and never runs on other sites.
  • We don't sell data, show ads or use it for anything else.

1. What the extension is for

SpanDock is software that organisations and people run on their own computers and servers to see and govern how AI tools are used. The extension is its companion for AI chat sites in the browser: it records the conversations you have on the sites that are turned on and gives them to SpanDock, so they appear beside your other AI tools' activity. It does nothing without SpanDock installed on the same computer.

2. Where the data goes

Only to the SpanDock receiver on the same computer, by default http://127.0.0.1:4318. The extension makes no other network requests: no analytics, no crash reporting, no update checks of its own, no remote code. (The browser's own store updates the extension, as for any extension.)

  • The receiver's address. It is always on your computer (127.0.0.1 or localhost). You can change its port in the popup (Advanced), and your organisation can set and lock it through browser policy; an address anywhere else is never used.
  • From your computer on. The SpanDock app on your computer handles what it receives like any other AI tool's telemetry: if your computer is connected to your organisation's SpanDock server, it forwards the records there. That server is run by your organisation (or by you), on its own machines or cloud account. It is not run by us.
  • Self-hosted and air-gapped. SpanDock is self-hosted, and the extension needs no internet connection of its own: it works the same on networks that can't reach the internet, apart from the AI chat sites themselves.
  • We never receive it. Nothing the extension reads reaches Nolatech Ltd, https://spandock.com or any service we use.

3. What it captures, and when

The extension captures only when all of these are true: it is paired with SpanDock on your computer, SpanDock's settings allow capture, the site is turned on (each site is off until you or your organisation's browser policy turns it on), and its main switch is on. The toolbar badge shows the state of the tab you are looking at (ON when it is captured).

On those sites, for each completed message (yours, once sent; the assistant's, once it has finished), it sends:

  • the site and product (for example "ChatGPT"), the conversation's ID taken from the page address, whether the message is yours or the assistant's, its position in the conversation and its revision (an edited or regenerated message is sent again);
  • the model name the page shows, if any;
  • the message text, after redaction (section 4), with the number of redactions and a fingerprint (SHA-256) of the text; a text longer than 100,000 characters is cut;
  • the page title and the page address without its query string or fragment (for Grok on x.com, the conversation ID comes from the address's conversation value);
  • when it was captured and sent, and the extension's version.

Messages already on the page when you open a conversation are treated as history and are not sent, unless your organisation's SpanDock asks for history.

When a page's layout isn't recognised, it sends a short self-test report instead: which reader was tried and how many page elements matched, never any text.

When you pair the extension, it sends the pairing code, the extension's ID, whether the browser is Chrome or Edge, and the extension's version. SpanDock gives it a token, which it keeps.

Sites you add. If you click "Capture this site" on another site, the browser asks your permission for that site; once granted, the extension reads it the same way. You can remove it in the browser's extension settings.

4. Redaction

Before anything leaves the browser, the extension replaces with [REDACTED]: private keys, API keys (such as Anthropic, OpenAI, AWS, GitHub, GitLab, Slack and Google keys), JWTs, bearer tokens and password=, secret=, api_key=, access_token= and auth_token= style values. Redaction is on by default. You can turn it off in the popup unless your organisation has locked it on. Redaction looks for known patterns and can't catch everything, so don't paste secrets into AI chats.

5. Text or activity only: your organisation's rules

Whether SpanDock keeps the text of your chats follows the same rules as prompt capture for your other AI tools:

  • Text is kept only when prompt sharing is on for your computer (set by your organisation, or chosen by you when your organisation lets you choose) and SpanDock shows you its mandatory prompt-sharing notice.
  • Otherwise SpanDock keeps only the activity: which site, the model, whether it was you or the assistant, when, sizes, redaction counts and the fingerprint. The popup says "Only activity, not text". The extension still sends the text to SpanDock on your computer (so counts and fingerprints are exact), and SpanDock drops it as soon as it arrives.

Where text is kept, it is stored only on your organisation's SpanDock server, encrypted (AES-256-GCM) and deleted after 30 days by default (your organisation's administrator can set 1 to 365 days). Only administrators can read it. It is never included in backups, telemetry storage or SpanDock's SQL explorer, and it is deleted when its records, or a person's data, are deleted. The activity records follow your organisation's normal record retention.

Your organisation decides how SpanDock is used and is responsible for using it lawfully, including telling you about it. For questions about data in your organisation's SpanDock (access, deletion), contact your organisation's SpanDock administrator.

6. What it never reads or does

  • It never reads cookies, passwords, the sites' own storage, or sign-in tokens.
  • It never intercepts, blocks or changes network requests, and never reads network traffic.
  • It never runs on other sites: only on the AI chat sites it supports (Claude, ChatGPT, Gemini, Grok, Copilot, Perplexity, DeepSeek, Le Chat, Meta AI, Poe) and sites you add yourself. On X (x.com) it stays dormant everywhere except Grok (x.com/i/grok).
  • It never records keystrokes, clicks or scrolling. It notes only the moment you send a message, to tell new messages from history, and that moment never leaves the browser.
  • It never types, clicks or submits anything on a page.
  • It never sends query strings (apart from Grok's conversation ID, above).

7. What is stored in your browser

In the extension's own storage on your computer: your choices (switches, sites, the receiver's address), the token from pairing, SpanDock's last settings, the health of each site's reader, fingerprints of the last 5,000 messages sent (so a reloaded page doesn't send them twice), and a queue of at most 500 messages waiting while SpanDock isn't answering, which can include their (redacted) text until they are delivered. The badge's state per tab is kept only for the browser session. Unpair removes the token; uninstalling the extension removes all of it.

Developer mode's "Verify adapters" makes a report of page structure (element counts and a scrubbed outline, with every text replaced by its length). The report stays on your computer: it is downloaded or copied only when you choose, never sent anywhere.

8. Your organisation's controls

If your organisation manages your browser or your SpanDock, it can: install the extension for you; set the receiver's address; turn sites on (you can still turn them off) or off (locked); lock redaction on; or turn capture off entirely. Locked settings show a lock in the popup, with who set it, and the popup says "Managed by your organisation".

9. Sale, advertising and other uses

We don't receive the data, and the extension doesn't sell or transfer it to anyone, use it for advertising, or use it to decide creditworthiness or lending. It is used only for the extension's single purpose: giving your AI chat activity to your own SpanDock. The use of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements, and to Microsoft's policies for Edge Add-ons.

10. Children

The extension is a work tool for organisations and professionals. It is not directed at children, and we do not knowingly collect children's data (we receive none from the extension at all).

11. Changes

When the extension's handling of data changes, we update this page and its date before the new version is published, and describe the change in the extension's release notes. A change that makes it capture more will never apply without an update you or your organisation installs.

12. Contact

Nolatech Ltd, Cyprus
Privacy: privacy@spandock.com
Support: support@spandock.com · Contact

Our general Privacy Policy covers https://spandock.com, accounts and license checks.

Cookie settings

Cookie categories

Details: Cookie Policy.