ContractFocus Privacy Policy

This Privacy Policy applies to the ContractFocus browser extension ("ContractFocus", "the extension") published by Loophead Labs LLC ("we", "us", or "our"). It is consistent with the general Loophead Labs privacy policy; this page covers the extension-specific details that the Chrome Web Store requires publishers to disclose.

We are committed to protecting your privacy. This policy explains what data the extension accesses, how it is used, and your rights regarding that data.

1. What ContractFocus Does

ContractFocus is an on-device contract decoder for Terms of Service pages, privacy policies, residential leases, NDAs, freelance agreements, and similar legal documents. When you click the toolbar icon or upload a PDF, the extension:

1. Classifies the document as legal or non-legal using Chrome's on-device Gemini Nano model.
2. Produces a plain-English bullet summary via Chrome's Summarizer API.
3. Runs a local pattern-matching pass that surfaces 34 common clauses across five packs (auto-renewal and billing, arbitration and class-action waivers, liability and indemnity, privacy and data, lease and tenant-specific terms).
4. Stores the result in your local scan history so you can compare future versions of the same document.

Paid tiers unlock unlimited analyses, additional clause packs, team-shared history, and version-change alerts. No analysis of page content ever leaves your device except the optional team sync described in Section 5.

2. Data We Collect

ContractFocus stores the following in your browser using Chrome's built-in storage.local and IndexedDB APIs:

• Your extension preferences (active tier, dismissed banners, UI filters, dev-only overrides).
• A local scan history keyed by normalized URL. Each entry records the page URL, title, detected document type, word count, the plain-English summary, matched clause flags, and a timestamp. The raw contract text is retained only long enough to detect version-to-version changes and is not transmitted anywhere.
• For uploaded PDF or text files: the extracted text is held in memory for the duration of the analysis. A summary of the result (title, type, summary bullets, clause flags) is written to local history; the raw file bytes are not persisted.

For Team plan members only, an additional sync layer is used (see Section 5) that sends a redacted summary record to Firebase Firestore. The full raw contract text is never included in the synced record.

We do not collect or transmit:

• Your name, address, phone number, or any personal identifier other than the email address you choose to use with ExtensionPay and, if applicable, Firebase Anonymous Authentication.
• The full text of the contracts you analyze.
• Your browsing history, cookies, or session tokens.
• Microphone, camera, location, or any OS-level data.
• Analytics, telemetry, crash reports, or ad identifiers.

3. Permissions

ContractFocus requests the following Chrome permissions, and uses each only for the stated purpose:

• activeTab: to read the main content of the page you are currently viewing when you click the toolbar icon or the Decode button. activeTab grants one-off access at the moment of the user gesture.
• tabs: to capture the URL and title of the tab being analyzed so they can be displayed in the side panel, used as the history key for version comparison, and shown on shared team entries. Tab content is not read through this permission.
• scripting: to inject the on-page detector that identifies likely legal documents and extracts the readable article text for analysis. The injected script reads visible DOM text and publishes only a summary signal back to the extension; it does not transmit anything.
• sidePanel: to render the ContractFocus user interface in Chrome's side panel, where the summary, flagged clauses, history, and team controls live.
• storage: to save your local scan history, tier status, team membership details, UI preferences, and cached Firebase authentication token on the user's device. None of this is transmitted except where disclosed under Section 5.
• downloads: to save PDF or Markdown exports of a decoded summary to your Downloads folder when you click Export. Exports are triggered only by your explicit action and only write files the extension generated locally.

Optional host permissions:

• <all_urls> (optional): requested only if you enable automatic detection on every site. Until you grant it, the extension analyzes pages only when you invoke it manually.

Required host permissions:

• https://extensionpay.com/*, https://api.extensionpay.com/*: used by the ExtensionPay library to validate purchases and deliver the purchase-completed callback. A small content script is injected only on extensionpay.com to deliver this callback.
• https://firestore.googleapis.com/*, https://identitytoolkit.googleapis.com/*, https://securetoken.googleapis.com/*: used only by Team-plan members to authenticate with Firebase Anonymous Authentication and read or write Team-shared history in Firestore. These endpoints are not contacted for users on the Free, Pro monthly, or Pro annual tiers.

4. AI Features

ContractFocus uses Chrome's built-in Prompt API and Summarizer API, both powered by the Gemini Nano on-device model:

• The Prompt API classifies whether a page is a legal document, detects document type (ToS, privacy policy, lease, NDA, etc.), and performs lightweight clause-quality checks on suspected matches.
• The Summarizer API produces the plain-English bullet summary shown in the side panel.
• A deterministic pattern matcher (no AI, shipped inside the extension) surfaces the 34 clause flags.

All AI inference runs locally on your device through Chrome's built-in AI runtime. No page content, uploaded file content, or generated output is transmitted to any AI provider by ContractFocus. Availability and device support are determined by Chrome (version 138 or later on a supported machine). If the on-device AI is unavailable, the pattern matcher still runs so clause flags and a template summary are still produced.

5. Team Plan Sync (Optional, Paid Feature)

The Team plan (owner pays $99 per year, up to 5 teammates included at no extra cost) enables a shared contract history across your teammates. This is the only feature that causes any analysis data to leave your device, and it is only active after a team owner explicitly creates a team and members explicitly join one.

When enabled, for each contract you decode the extension writes a redacted record to Firebase Firestore containing:

• The page URL and title.
• The detected document type.
• The plain-English summary bullets.
• The list of matched clause flags (name, severity, and short explanation).
• A timestamp, the document word count, and the display name you chose when joining the team.

The raw contract text, the uploaded file bytes, and any content outside the structured summary are not synced. The shared record is visible only to members of your team, enforced by Firestore security rules. Team owners can rotate the invite code or remove members at any time from the Team tab.

Authentication uses Firebase Anonymous Authentication. A user identifier is generated by Firebase on first use and stored locally; it is not linked to your real identity. If you leave the team or delete the extension, your local Firebase token is discarded. The team owner can additionally remove any synced records authored by a member.

Free, Pro monthly, and Pro annual users do not contact Firebase at all.

6. Third-Party Services

ContractFocus uses the following third-party services:

• ExtensionPay (operated by Glench, LLC), which uses Stripe to process subscription payments for Pro monthly ($6.99/month), Pro annual ($49/year), and Team annual ($99/year). When you click Upgrade, you are redirected to Stripe Checkout. We never see or store your payment card details. ExtensionPay and Stripe handle that data under their own privacy policies, available at extensionpay.com and stripe.com/privacy.
• Google Firebase (Firestore and Authentication), used only on the Team plan for the shared-history feature described in Section 5. Google's privacy policy is available at policies.google.com/privacy.

We do not use analytics providers (no Google Analytics, no Mixpanel, no PostHog), advertising networks, or tracking pixels. We do not sell, rent, or share any data with third parties for any purpose other than the direct operation of the features above.

7. Children's Privacy

ContractFocus is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has used the extension in a way that raises concern, please contact us.

8. Data Security

Because ContractFocus stores all of its data locally on your device using Chrome's built-in storage and IndexedDB, the security of that data is a function of your device and your Chrome profile. For Team-plan users, the synced summary records are stored in Firebase Firestore and protected by security rules that restrict access to members of your specific team. Payment data is handled entirely by Stripe, which is PCI-DSS certified and uses industry-standard encryption.

We encourage you to keep your browser and operating system up to date.

9. Your Rights and Choices

You can remove all data ContractFocus has stored by:

1. Clearing scan history from the History tab in the side panel.
2. Leaving your team from the Team tab, which detaches your local Firebase identity and removes your membership record.
3. Uninstalling the extension from chrome://extensions. Uninstalling clears all chrome.storage.local and IndexedDB data written by the extension. Synced Team records written before uninstalling remain readable to other team members until the team owner removes them or deletes the team.

If you are a team owner and want your entire team's synced history deleted server-side, email us at the address below with the team invite code and we will purge it.

Because we do not operate any servers beyond the Firebase project used for optional Team sync, and that data is already scoped per-team, there is nothing further to delete on the Free or Pro tiers.

10. Policy Changes

We may update this Privacy Policy as the extension evolves. Changes will be posted at this URL and reflected by the Effective Date above. Material changes will also be noted in the extension's release notes on the Chrome Web Store.

11. Contact

For questions about this Privacy Policy or ContractFocus, please contact: dev@loopheadlabs.com