# Privacy Policy — Chameleon: Adaptive Accessibility

**Effective date:** May 3, 2026
**Extension version:** 2.0.0

This privacy policy explains what data the **Chameleon: Adaptive Accessibility**
Chrome extension does and does not collect, where it goes, and how it is used.

---

## Summary (the short version)

- We **do not** collect, transmit, or sell any personally identifiable
  information (PII) about you.
- We **do not** track your browsing history.
- We **do not** run analytics, telemetry, or third-party trackers.
- The extension reads page content **only on your device** to apply your
  accessibility preferences (font size, contrast, dyslexia-friendly typography,
  cursor styling, etc.).
- Your accessibility preferences are stored locally in `chrome.storage` and
  optionally synced to your account on the Chameleon website if you sign in.
- **Head-tracking** (optional, off by default) uses your camera. Camera frames
  are processed entirely on your device by Google MediaPipe and never leave
  your computer.
- **Voice tab commands** (optional, off by default) use Chrome's built-in
  speech recognition. **Where the audio goes depends on your Chrome
  installation:**
  - If your Chrome has the on-device English speech model installed
    (default on macOS; auto-downloaded by Chrome 138+ on Windows/ChromeOS),
    audio is processed entirely on your device and never reaches the
    network.
  - If the on-device model isn't available, Chrome routes audio to
    **Google's speech recognition servers** for transcription. In that case
    you'll see an explicit consent prompt before voice mode starts; nothing
    is sent until you accept.
  - Chameleon itself does not record, store, or transmit your audio in
    either mode.
- One optional feature — AI image descriptions — sends individual image data
  to Google's Gemini API on demand. This only happens when you explicitly hover
  over an image to request a description.

---

## Data the extension stores locally

The following data is stored on your device using the Chrome extension storage
APIs (`chrome.storage.local` and `chrome.storage.session`). It never leaves
your device unless you sign in to the Chameleon website (see "Account sync"
below).

| Data | Purpose | Where stored |
|---|---|---|
| Your accessibility preferences (font size, contrast, dyslexia mode, cursor color, etc.) | Apply your settings to every site you visit | `chrome.storage.local` |
| Whether the extension is enabled | Honor your global on/off toggle | `chrome.storage.local` |
| A randomly generated anonymous ID (e.g. `user-1745236341832`) | Distinguish your local install for preference syncing — not tied to any external identifier | `chrome.storage.local` |
| Hub URL + user token (only if you sign in) | Sync preferences with your Chameleon account | `chrome.storage.local` |
| Cached AI image descriptions | Avoid re-querying Gemini for the same image | In-memory only (cleared on tab close) |

You can clear all stored data at any time by removing the extension from
`chrome://extensions`.

---

## Data the extension reads from web pages

To apply accessibility transformations, the extension reads:

- **Page DOM and styles** — needed to identify text nodes, interactive
  controls, and elements to adapt (e.g. enlarge buttons, swap fonts, adjust
  contrast).
- **Image element data URLs / base64 data** — only when you actively hover
  over an image to request an AI description.
- **Computed styles** — to know whether a current site already meets your
  preferences before overriding.

This reading happens entirely **inside your browser**. The extension does
**not** transmit page content, URLs, browsing history, form data, or input
values anywhere — with the single exception below.

---

## Camera use — head-tracking (optional, opt-in)

The extension includes an optional **head-tracking cursor** feature for
hands-free use. When you turn it on:

- The extension requests camera access on the active tab using a one-time
  permission prompt.
- Camera frames are passed to Google's **MediaPipe FaceLandmarker**, which runs
  entirely **on your device** inside an offscreen document. The model is
  bundled with the extension — no inference happens in the cloud.
- Only **derived cursor coordinates** (and optionally a "blink" / "dwell"
  signal) are forwarded to the active page to move the cursor.
- Raw camera frames are **never** uploaded, stored, or transmitted anywhere.

You can revoke camera access at any time from `chrome://settings/content/camera`
or by simply turning head-tracking off.

---

## Microphone use — voice tab commands (optional)

The extension includes an optional **voice tab commands** feature that lets you
say things like "next tab," "previous tab," "close tab," or "new tab" to
navigate hands-free.

Voice commands use Chrome's standardized speech recognition API. Where your
audio actually gets transcribed depends on your Chrome installation, and
Chameleon's privacy behaviour adapts accordingly.

### On-device speech recognition (preferred path)

If Chrome has an on-device English speech model installed and ready —
which is the default on macOS, automatic on ChromeOS, and increasingly
common on Windows in Chrome 138+ — Chameleon enables voice commands
silently with **no third-party data transfer at all**:

- Microphone audio is processed entirely **on your device** by Chrome's
  built-in speech engine.
- Audio never reaches Google's servers, our servers, or any other network
  endpoint.
- No consent prompt is shown because no third party receives your audio.
- The status indicator in the side panel reads "processed on your device".

### Cloud-fallback speech recognition (only when on-device is unavailable)

If the on-device model is not installed or not ready (typically older
Chrome versions, some Linux distributions, or first-time use before the
model has finished downloading in the background), Chameleon switches to
the cloud path:

- Before voice mode starts, you see an **explicit consent dialog**
  describing exactly what's happening. Voice mode does not activate until
  you accept.
- If you accept, Chrome streams your microphone audio to **Google's speech
  recognition servers** for transcription. This is a property of Chrome's
  API, not Chameleon. Chrome's privacy policy governs Google's handling of
  that audio.
- Audio is sent **continuously** while the feature is enabled — including
  ambient sound and unrelated speech in the room.
- The status indicator reads "audio is streamed to Google" so you can see
  in real time which mode you're in.
- Once Chrome's on-device model finishes downloading (often automatically
  in the background), subsequent sessions silently switch to the on-device
  path and the cloud transfer stops.

### What's the same in both modes

- Chameleon receives only the **text transcript** and matches it against a
  small fixed set of commands ("next tab," "previous tab," "close tab,"
  "new tab," "tab N"). All other transcripts are discarded.
- Chameleon **does not** record, store, log, or transmit your audio or
  transcripts anywhere.
- You can disable voice tab commands at any time from the side panel.
  Disabling immediately stops audio capture in both modes.

---

## The one external request: Gemini AI image descriptions

**This feature is OFF by default.** It only runs after you enable the
"AI alt text" toggle under Low Vision in your dashboard settings.

When the toggle is on and you hover over an image, the extension sends
**only the bytes of that single image** to Google's Gemini API
(`generativelanguage.googleapis.com`) along with our shared API key. Google's
Gemini terms apply to that request; please review their
[generative AI privacy policy](https://policies.google.com/privacy).

We do **not** send:

- The URL of the page you are on
- The text content of the page
- Other images on the page
- Any identifier tied to you

This feature can be disabled by removing the extension or by not hovering over
images. No image data is sent automatically — only when you actively trigger
the feature.

---

## Account sync (optional — only if you sign in)

If you create an account on the Chameleon website (the Chameleon Hub) and
sign in, your **accessibility preferences only** are synced to your account so
they follow you across devices. This sync uses Supabase (a hosted Postgres
service) over HTTPS. The data synced is the same preferences listed in the
table above — no browsing data, no page content.

If you do **not** sign in, no data ever leaves your device (other than the
on-demand Gemini image-description requests described above).

You can stop syncing at any time by signing out via the extension's options
page.

---

## What we do NOT collect

Explicitly, the extension does **not** collect, log, transmit, or share:

- Your browsing history or list of visited sites
- The content of any page you visit (text, headings, links)
- Form data, passwords, search queries, or anything you type
- Cookies or session tokens from sites you visit
- Your name, email, IP address, or any contact information (other than the
  email used to sign in to the Chameleon Hub if you create an account)
- Analytics events, pageviews, click-tracking, or "telemetry"
- Camera frames or raw microphone audio (these are processed by your browser
  and on-device libraries as described above; Chameleon itself never receives
  or transmits them)

Earlier versions of this extension included a runtime accessibility-violation
telemetry feature; **all telemetry has been removed** in version 2.0.

---

## Permissions the extension requests, and why

| Permission | Why we need it |
|---|---|
| `storage` | Save your accessibility preferences locally |
| `sidePanel` | Provide the extension's preference dashboard via the Chrome side panel |
| `scripting` | Inject the styling adapter into pages so preferences apply everywhere; also injects a one-time camera/microphone permission helper into the active tab when you first enable head-tracking |
| `offscreen` | Hosts the on-device MediaPipe head-tracking pipeline. Camera frames are processed in this offscreen document and never leave your computer. |
| `tabs` | Required to fulfill voice tab commands ("next tab," "close tab," "new tab," etc.) when you have voice commands enabled |
| `activeTab` | Grants temporary access to your current tab when you click the extension (e.g. start head-tracking) so we can inject the camera-permission helper without requesting broad access to HTTP sites |
| `https://*/*` host permission | Required because the extension's purpose is to adapt the appearance of any HTTPS website you visit. We read page DOM only to apply your accessibility settings — we never transmit page contents off your device. |
| `https://generativelanguage.googleapis.com/*` host permission | Send images to Google's Gemini API when you request an AI description |

---

## Children's privacy

Chameleon is not directed at children under 13. The extension does not
knowingly collect personal information from children. (And in fact, it does
not knowingly collect personal information from anyone.)

---

## Disclaimer (no warranty / not a medical device)

Chameleon is provided **"as is" and "as available"**, without warranty of
any kind, express or implied, including but not limited to the implied
warranties of merchantability, fitness for a particular purpose, accuracy,
and non-infringement. Use of the extension is at your own risk.

Chameleon is **not a medical device** and is **not certified assistive
technology**. It is a general-purpose accessibility-adaptation tool. It is
not intended to diagnose, treat, cure, or prevent any condition; nor to
replace screen readers, switch-control systems, or any other device,
software, or service that has been certified for clinical, regulatory, or
disability-accommodation purposes. Users who depend on certified assistive
technology should continue to use it.

To the maximum extent permitted by law, the developers of Chameleon
disclaim all liability for any direct, indirect, incidental, special,
consequential, or exemplary damages arising out of or in connection with
your use of, or inability to use, the extension.

---

## Changes to this policy

If we ever change what data the extension collects or how it is used, we will
update this policy and, where the change materially affects existing users,
publish a notice in the next extension release notes. Continued use after a
change indicates acceptance of the updated policy.

---

## Contact

Questions or concerns about this policy? Email **extchameleon@gmail.com**.

You can also report security issues at the same address.
