Privacy Policy for the Loqalit Chrome Extension

Last Updated: July 20, 2026

Overview

Loqalit is a Chrome extension for localization QA professionals that scans web pages and analyzes translation quality using AI. This privacy policy describes how the Extension collects, uses, and protects your information.

Information We Collect

1. Page Content (During Scans)

When you click "Scan Page," we extract text content from the active webpage:

Text content (headings, paragraphs, buttons, form labels, etc.)
Optional language and text-direction attributes for each text block
A minimal source-type hint when text comes from a non-default source (for example an ARIA attribute or a CSS pseudo-element)

We intentionally do not collect DOM locators such as CSS selectors or element positions — scan payloads contain text content and the metadata above only.

Storage: Scan data is stored locally in your browser (IndexedDB for history, chrome.storage.session for active scans). Data is sent to our servers in exactly two cases: when you run the AI analysis feature, and — for signed-in users who have opted in — through the scan-history sync described below.

Purpose: To display scan results, perform quality checks, enable highlighting, and persist scan history locally.

2. Scan-History Sync (Opt-In, Signed-In Users)

If you are signed in and explicitly enable scan-history sync (one-time dashboard prompt, changeable later in Settings → Account), the dashboard uploads your local scan history to your Loqalit workspace:

Page URLs of scanned pages
Scan timestamps
Block and word counts
Quality scores

Sync is off until you enable it; no scan history is uploaded before that. Disabling sync stops future uploads but does not delete entries already uploaded — clearing local data (Reset) or uninstalling the extension also does not delete server-side copies. You can request deletion of synced data at any time (see Contact below).

When a signed-in scan is associated with a workspace or project, its captured workspace/project context may also be stored with the analysis so the dashboard can distinguish where the scan originated from its later project assignment.

3. Authentication Data (AI Features)

If you use AI analysis with a signed-in account:

You sign in via Clerk authentication through a browser popup window
Your email and user ID are stored on our backend to manage access and usage quotas
Session state is managed via cookies on the auth host domain — no tokens are stored locally

4. Workspace, Invitation, and Billing Data

For signed-in workspace features, our backend stores the data needed to provide the selected workspace and its access controls:

Workspace, team, and project names and identifiers; membership roles; and

each user's selected workspace/project context

Invitation recipient email, role, status, expiry, inviter, and an opaque

invitation reference used by the invitation landing page

Billing plan and subscription status, seat/usage records, invoices, and

checkout/portal/cancellation intent metadata such as action, plan, provider reference, status, and timestamps

Hosted payment details are entered directly with Dodo Payments. Loqalit does not receive or store full card details. Opening checkout, a portal, an email draft, or a return URL is not treated as proof that payment or delivery completed; verified provider/backend state remains authoritative.

5. Usage Data

Our backend logs AI analysis requests including:

Timestamp and response time
Page URL and page domain
Block count, character count, and token usage
Model used, cost, and error information (if any)
Finding count from AI analysis

For signed-in analyses, the backend also stores the finding contents returned by the AI (message, rationale, and suggestion text — which may quote text from the analyzed page) in our backend database so your analysis results are available in the dashboard. It may also store the immutable originating workspace/project context separately from the analysis's current project assignment. When R2 storage is configured, the backend may additionally store the full request payload including system/user prompts and raw text blocks.

This helps us monitor service health, enforce usage limits, and improve analysis quality.

6. Guest Analysis Data

Guest users (not signed in) can use AI analysis with limited quota:

Identified by a locally-generated UUID device ID
Same request data is logged as authenticated users, with device ID instead of user ID
Default quota: 1 analysis per device

7. Crowdin Integration (Optional, User-Configured)

If you configure the optional Crowdin integration with your own Crowdin Personal Access Token:

The token is stored as authentication information in chrome.storage.local on your device and is sent only to Crowdin's API (api.crowdin.com) to act on your behalf
Access to api.crowdin.com is an optional browser permission, requested only when you set up the integration
When you explicitly push a finding to Crowdin, the Extension sends the AI finding text, the page URL and title, and a short excerpt of the rendered page text (up to ~280 characters) to your own Crowdin project as an issue
When screenshot evidence is included with a push, the Extension captures the visible tab and uploads the screenshot to your Crowdin project

Crowdin data goes directly from your browser to Crowdin — Loqalit servers do not receive or store your Crowdin token or pushed content.

7b. Phrase Strings Integration (Optional, User-Configured)

If you configure the optional Phrase Strings integration with your own Phrase API token:

The token is stored as authentication information in chrome.storage.local on your device and is sent only to Phrase's API (api.phrase.com) to act on your behalf
Access to api.phrase.com is an optional browser permission, requested only when you set up the integration
To find the key a finding belongs to, the Extension searches your Phrase project's translations for the rendered text of the affected string
When you explicitly push a finding to Phrase, the Extension adds a comment to the matching key in your own Phrase project containing the finding's severity and category, the page title and URL, the finding summary, rationale and suggestion, and a short excerpt of the rendered page text (up to ~280 characters). If you enable comment routing, a follow-up mention comment is added as well
When screenshot evidence is included with a push, the Extension captures the visible tab, uploads the screenshot to your Phrase project, and attaches a marker linking it to the key

Phrase data goes directly from your browser to Phrase — Loqalit servers do not receive or store your Phrase token or pushed content.

8. Product Diagnostics

The Extension can save operational diagnostic entries locally when expected product operations partially fail, such as skipped screenshot evidence capture. Backend upload is disabled by default and controlled by release configuration. When enabled, uploaded product diagnostics are limited to:

Diagnostic ID, event kind, source context, operation, severity, and stable

error code

Extension/app version, release channel, browser version, and environment
Page origin plus redacted path or hashes; raw query strings are excluded
Bounded counts such as captured/skipped targets and block count
Bounded per-target metadata such as block ID, finding index, category,

severity, and error code

Uploaded product diagnostics do not include screenshots, DOM snapshots, full page text, raw AI payloads, cookies, authorization headers, Clerk tokens, raw request headers, or raw query strings.

Vendor crash monitoring is currently disabled. If enabled later, it will be a separate exception-reporting lane for sanitized crashes only; session replay is not part of the current product.

9. User Preferences

Configuration preferences stored in Chrome storage:

Quality thresholds (MQM settings)
Scan configuration options
Onboarding completion state and distinct scan-history sync consent states

(unset, deferred, enabled, or explicitly declined)

Storage: Most preferences use chrome.storage.sync. Onboarding state, sync consent, and a few local-only UX flags use chrome.storage.local.

Data Processing

Local Processing

Page scanning happens entirely in your browser
Scan history is stored locally in IndexedDB
Quality checks and MQM scoring run client-side

Server Processing

When you click "Analyze with AI":

Extracted text blocks and the page URL are sent to our Convex backend
Our backend builds prompts server-side and calls Google Gemini
Analysis results are returned to your browser, and for signed-in analyses the finding contents are stored in our backend database

Note: When R2 storage is configured, full request payloads (prompts and raw text blocks) may additionally be stored for quality review. Request metadata (page URL, domain, block count, token usage) is always logged.

Third-Party Services

Service — Purpose — Data received — Privacy Policy

Clerk — Authentication — Email, sign-in session data — clerk.com/legal/privacy
Convex — Backend infrastructure — AI analysis payloads, request logs, synced scan history, workspace/project context, invitations, and billing records — convex.dev/legal/privacy
Cloudflare Pages — Auth UI hosting — Standard web request data — cloudflare.com/privacypolicy
Google Gemini — AI analysis — Extracted page text (via our backend) — ai.google.dev/terms
Crowdin — Optional issue handoff (user-run) — Finding text, page URL/title, page-text excerpt, screenshots — sent to your own project — crowdin.com/page/privacy-policy
Phrase Strings — Optional key-comment handoff (user-run) — Finding text, page URL/title, page-text excerpt, screenshots — sent to your own project — phrase.com/legal/privacy
Dodo Payments — Payment processing (merchant of record) — Name, email, billing address, and payment details you enter on Dodo's hosted checkout; Loqalit never receives card data — dodopayments.com/privacy
OneSignal — Transactional email delivery — Recipient email address and the content of workspace/billing notification emails — onesignal.com/privacy_policy

We do not sell user data. We do not include analytics or ad tracking libraries, and the Extension's production manifest allowlists no telemetry endpoints (Clerk SDK telemetry is disabled).

Permissions

The Extension requests the following permissions:

Permission — Purpose

scripting, activeTab — Inject the content script to scan the current page
storage — Save preferences and scan state locally
sidePanel — Display results in Chrome's side panel
cookies — Required by the Clerk authentication SDK for session synchronization (not used to read site cookies)
Loqalit backend/auth hosts — Host permissions for our Convex backend and Clerk auth domains (AI analysis, sign-in)
api.crowdin.com (optional) — Requested only when you set up the Crowdin integration
<all_urls> (optional) — Requested only when you grant site access for scanning, or when you click "Allow screenshot access" in the export dialog to make screenshot evidence capture reliable. Revocable anytime in Chrome's extension settings

Data Security

All server communication uses HTTPS
Authentication tokens are not stored — a fresh short-lived JWT is fetched per request
We never store passwords (handled by Clerk)
No LLM API keys are stored client-side

Your Rights

You can:

Clear local data: Use the Reset button in the panel header or uninstall the extension (this does not delete server-side copies of synced or analyzed data)
Disable scan-history sync: Settings → Account → Scan history sync
Sign out: Dashboard Settings → Account section → Sign out
Request deletion: Contact us to delete your account and associated server-side data

Data Retention

Local data: Retained until you clear it or uninstall the extension
AI request logs: Retained for 180 days, then deleted by a scheduled backend cleanup job
Product diagnostics: Detailed backend diagnostic events are retained for 30 days; aggregate rollups are retained for 180 days
Analysis findings, synced scan history, workspace/invitation records, and billing metadata: Retained while needed to provide the account and its history, or until deletion is requested where applicable
R2 payloads: Retained when configured, for quality improvement
Account data: Managed to support access and quota enforcement

No Tracking or Ads

We do not:

Use analytics or ad tracking scripts
Display advertisements
Sell or share data with third parties beyond service providers listed above

Children's Privacy

This extension is not intended for users under 13 years of age.

Changes to This Policy

We may update this privacy policy. Changes will be reflected in the "Last Updated" date above.

Contact

For privacy questions or data deletion requests:

Email: info@loqalit.com
Website: https://loqalit.com