Security and Your Data
Last updated: November 4, 2026
How Polaris handles conversation content, permissions and external connections.
1. What Polaris Reads
Polaris reads supported AI conversation pages to build navigation, search and reading views. Complete ChatGPT and Gemini mode can request earlier messages in the current conversation through your existing website session. This makes a network request to the AI provider; local processing does not mean offline operation or provider approval of the access method.
These features do not send conversations to OpenAI's public Responses API for inference, or offer Sign in with ChatGPT or ChatGPT plan usage. OpenAI's official OAuth plan-usage permission does not grant access to ChatGPT conversations. Website-session credentials and OAuth plan-usage authorization are distinct; the existence of official API documentation does not authorize website-history access.
2. What Stays Local
Conversation text, search indexes and Markdown/HTML generation are processed in your browser. Polaris does not upload conversation text to the developer or a separate processing server. Copying writes to your system clipboard; downloaded files and any later sharing or cloud backup are controlled by you and the applications you use.
Complete-reading snapshots can persist in the extension's local IndexedDB, isolated by confirmed identity and conversation, up to 100 MiB compressed. They remain after you close a page or turn complete mode off, until cleared, evicted or removed with the extension. Unknown identities and private windows skip persistent caching. Short-lived ChatGPT bridge snapshots are filtered and expire within 60 seconds. Hidden reasoning, tool messages and alternate branches are excluded from cached snapshots.
Gzip is compression, not application-layer encryption. Protect your device and browser profile; local storage is not a guarantee against someone who already has access to them.
The store: false requirement for OpenAI's separate plan-usage inference flow is not a control for Polaris's local history cache or a blanket zero-retention guarantee. Any future official API feature would need its own data-handling disclosure under the applicable provider data controls. The local cache described here is part of the current website-reading feature.
3. Login Sessions and Browser Permissions
Polaris does not ask for your AI password. Complete readers use short-lived authentication data in the website's page context; those credentials are not sent in extension bridge messages, diagnostic logs, persistent caches or settings synchronization.
The extension requests access to supported AI sites, storage, scripting, tabs and the side panel where supported, plus the disclosed licensing host. The tabs permission is used to select the source tab and coordinate the side panel and can expose open-tab metadata; it should not be described as an inability to see other tabs. Polaris does not request the browser history permission or build a browsing-history database. Review the installed version's permissions and site access in your browser's extension manager.
4. Other Network Activity
Trial and license operations can contact the license service. Purchase checkout and transactional email use the providers described in the Privacy Policy. Settings can synchronize through the browser's sync service. Diagnostic logs are not automatically uploaded; sending a diagnostic email and attaching a downloaded log are your choices. The website's optional analytics are separate from the extension and require the website's analytics choice.
5. Safer Exports and User Controls
HTML exports sanitize content, block embedded scripts and remote images through a restrictive Content Security Policy, and use image labels. Markdown is generated from safe content, escapes raw message HTML and uses image labels. Ordinary links remain clickable: following them contacts the destination. No export format can make subsequent editing, sharing or third-party software risk-free.
You can choose page-only reading, turn off complete mode, clear conversation caches in Preferences, manage site permissions, or disable or uninstall Polaris. Cache clearing does not delete files you already downloaded or data managed by your clipboard tools. Check your employer's extension and information-handling rules before using sensitive work conversations.
6. Verify and Report
In Chromium browsers, open chrome://extensions, choose Polaris and inspect its permissions and site access. In Firefox use about:addons. Review the source and release information for the version you install. Store distribution, source availability or successful tests do not guarantee the absence of vulnerabilities or constitute endorsement by an AI provider; locally installed ZIP versions are a separate distribution path.
Report suspected security issues privately to [email protected] with the version and reproduction steps. Do not include passwords, session tokens, full payment-card details or private conversations. Please allow time to investigate before publishing sensitive exploit details.