Privacy Policy

Last updated: 2026-07-07

This policy describes how the HoverRead browser extension and its backend service (api.hoverread.site) collect, use, and protect your data.

1. Data We Collect

HoverRead follows a "local-first" design: your learning data stays in your browser, and the backend collects only the minimum information needed to run the service.

Account Information

• Email address — collected at registration for account identification, login, and necessary service notifications.
• License Key — assigned when a free or paid quota is created, used to authenticate AI API calls. The key is stored in your browser's local settings and sent to the backend as a request header for verification.

Usage Logs

• Each AI API call logs: endpoint, timestamp, HTTP status code, response latency, caller email, and IP address.
• These logs are used for rate limiting, abuse prevention, and billing statistics, and are automatically deleted after 90 days.

Text Content Processed

• While you read English web pages, the extension sends sentences and words from the current page to the backend AI service for translation, sentence splitting, and grammar analysis.
• This text is used only during processing and is not stored permanently. The backend does not retain full page content, URLs, or browsing history.

2. What Stays on Your Device

The following data is stored in your browser's IndexedDB and chrome.storage, and is never sent to our servers:

• Vocabulary (mastered / learning / forced-unknown) — IndexedDB — words you have mastered or are reviewing
• Translation cache — IndexedDB — cached definitions to avoid repeated requests
• Offline dictionary (ECDICT) — IndexedDB — local word lookup, zero traffic
• Settings (vocabulary level, forget window, toggles) — chrome.storage — personalization
• License Key — chrome.storage — AI authentication (sent to the backend only as a request header)

3. Third-Party Services

HoverRead may involve the following third-party services when processing your requests:

AI Language Model Service

• Purpose: context-aware word translation, sentence splitting, and grammar/vocabulary explanations for chunks.
• Transmitted content: the sentences and words you read.
• Note: requests do not include your email, IP, or other personal identifiers — only the text and your License Key for billing.

Offline ECDICT Dictionary

• Bundled entirely within the extension and queried locally. No network transmission involved.
• ECDICT is an open-source project (MIT License, Copyright (c) 2025 Linwei — see NOTICE). Used as the offline definition source.

4. What We Do Not Collect

HoverRead explicitly does not collect or process:

• Browsing history or visited URLs
• Full page content (only the sentence/word fragments you read are sent)
• Personal identifiers (other than your registration email)
• Data for personalized advertising (this product has no ads)
• Cookie-based tracking or behavioral profiling
• Sale of data to any third party

5. Data Storage & Security

• Account and service logs are stored on our servers (deployment locations may change over time).
• Passwords are hashed with PBKDF2-SHA256 (210,000 iterations) with salt — never stored in plain text.
• Session cookies are protected with HttpOnly, Secure, and SameSite attributes.
• All state-changing endpoints are protected by CSRF (same-origin verification).
• AI requests are governed by fixed-window rate limiting and per-user daily quotas.

6. Data Retention

• Account info (email, subscription status): until you delete your account
• API usage logs: 90 days, then automatically deleted
• Local learning data (vocabulary, cache, settings): retained in your browser; removed when you uninstall the extension or clear browser data
• Text sent to AI: used only during processing, not permanently stored

7. Your Rights

• Access & export: you can export all local vocabulary data from the extension's settings page.
• Account deletion: you may initiate deletion from the account dashboard at any time; all associated data will be permanently removed within 30 days.
• Clear local data: uninstall the extension or click "Clear all data" in settings to delete local learning records.

8. Children's Privacy

HoverRead is intended for general English learners, is not specifically directed at children under 13, and does not knowingly collect information from children.

9. Policy Changes

This policy may be updated. The latest version will always be published at https://hoverread.site/privacy and in the repository's PRIVACY.md. Significant changes will be announced via in-app notice or email.

10. Contact

For any privacy concerns, reach out through the HoverRead extension's support channels or the contact information provided on the Terms of Service page.