PointChat 隐私政策 / Privacy Policy
生效日期 / Effective date: 2026-10-23 联系方式 / Contact: pointchat@playverseai.com
简体中文
1. 概述
PointChat（以下称「本扩展」）帮助你在网页上写评论，并把评论复制成 Markdown 交给你自己的 AI coding agent。本扩展没有服务器，不向开发者或任何第三方发送数据。
2. 本扩展处理哪些数据
只有在你主动使用评论功能时，本扩展才会在你的浏览器里保存以下内容：
- 你写的评论文字、评论状态（未完成 / 已完成）、创建与修改时间。
- 评论所在页面的网址。保存前会从网址的查询参数和 # 部分删除常见敏感或追踪参数：token、access_token、refresh_token、id_token、session、sessionid、sid、auth、authorization、code、password、passwd、secret、api_key、apikey、key，以及 utm_*、fbclid、gclid。这是固定名单，不保证覆盖所有网站；网址路径部分和其他参数原样保留。本地 file:// 页面会保存文件路径。
- 评论目标的定位信息：CSS 选择器、XPath、元素标签与类名、元素位置与大小、窗口大小，以及页面上的 data-source、data-testid 等属性（若有）。
- 帮助定位的周边文字：目标所在的标题路径、表格的行与列标题、表单字段的标签文字；评论时页面所处的状态（选中的 tab 名称、下拉框选中的选项文字），用于之后一键切回。
- 页面内容片段：你选中的文字（最多 500 字）及其前后各 32 字，元素文字片段（最多 120 字），图片或视频的地址（已按上述规则脱敏）和尺寸。这些内容来自你正在浏览的页面，可能包含你不希望外传的信息，请留意你在哪些页面上评论。
本扩展不收集：浏览历史（只保存你评论过的页面）、Cookie、表单输入、密码、账号信息、位置、设备标识或使用统计。
3. 数据存在哪里
全部保存在你电脑上浏览器的扩展本地存储（chrome.storage.local）。不使用云同步（chrome.storage.sync），不上传。本扩展不发起任何网络请求，不加载远程代码，不含广告、统计或第三方 SDK。
4. 数据如何使用与分享
数据只用于：在页面和侧边栏显示你的评论、刷新后恢复评论、按你的操作生成 Markdown 或导出文件。
- 点击「复制给 Agent」时，扩展把未完成评论（含脱敏后的网址、评论、选择器、所选文字及上下文、元素文字片段、图片地址、窗口大小）写入你的系统剪贴板。你把它粘贴到哪里，由你决定；其他应用可能读取剪贴板。把网页内容交给 AI agent 时请留意其中的提示注入风险。
- 点击「导出」时，扩展把评论的完整数据下载为 JSON 文件，保存位置和后续使用由你决定。
- 除上述由你触发的操作外，我们不分享、出售或转让任何数据，不用于广告、画像或信用评估，开发者也无法读取你的数据。
5. 权限说明
- activeTab、scripting：只在你点击图标、按快捷键或右键菜单时，把评论界面注入当前页面。
- storage：本地保存评论。
- sidePanel：显示侧边栏。
- contextMenus：右键菜单入口。
- 可选站点权限：默认不授予。只有你在侧边栏点击授权按钮，才会按单个站点申请，用于该站点刷新后自动恢复评论，或评论页面内嵌的 iframe。你可以随时在浏览器的扩展设置中撤销。
6. 保存期限与删除
评论一直保存到你删除为止。你可以：
- 在页面或侧边栏删除单条评论；
- 在侧边栏「⋯」菜单中「清空本页」；
- 卸载本扩展，浏览器会同时删除它的本地存储。 已导出的 JSON 文件和已复制到剪贴板的内容不在扩展控制范围内，需要你自行删除。
7. 安全
数据不离开你的设备。chrome.storage.local 中的数据由浏览器管理，没有额外加密；请不要在共用电脑或你不信任的浏览器配置文件中保存敏感内容。导入 JSON 时会逐字段校验并限制大小（5 MB、5000 条）。
8. Chrome 网上应用店用户数据政策声明
本扩展对用户数据的使用遵守 Chrome Web Store 用户数据政策，包括 Limited Use（有限使用）要求。（The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.）我们仅在提供本扩展单一用途所必需的范围内使用数据；不向第三方转让数据（用户自己触发的复制与导出除外）；不用于个性化广告；不允许任何人阅读用户数据。
9. 儿童
本扩展不针对 13 岁以下儿童，也不主动收集任何人的个人信息。
10. 政策变更
如果数据处理方式发生变化（例如将来加入同步或分享功能），会先更新本政策并在应用商店说明中提示，并在需要时重新征得你的同意。
11. 联系
English
1. Overview
PointChat ("the extension") lets you write comments on web pages and copy them as Markdown for your own AI coding agent. The extension has no server and sends no data to the developer or to any third party.
2. What data the extension handles
Only when you use the commenting features, the extension stores the following in your browser:
- The comment text you write, its status (open / done), and creation and edit times.
- The URL of the page you commented on. Before saving, common sensitive or tracking parameters are removed from the URL's query string and hash: token, access_token, refresh_token, id_token, session, sessionid, sid, auth, authorization, code, password, passwd, secret, api_key, apikey, key, as well as utm_*, fbclid and gclid. This is a fixed list and does not cover every site; the URL path and other parameters are kept as is. For local file:// pages the file path is stored.
- Location data for the commented target: CSS selector, XPath, element tag and class names, element position and size, window size, and data-source / data-testid attributes if present.
- Nearby text that helps locate the target: the heading path above it, table row and column headers, form field labels; and the page state when you commented (the selected tab name and the selected dropdown option text), used to switch the page back later.
- Page content snippets: text you selected (up to 500 characters) plus 32 characters before and after, an element text snippet (up to 120 characters), and the address (redacted as above) and dimensions of an image or video. This content comes from the pages you browse and may contain information you do not want to share, so be mindful of where you comment.
The extension does not collect: browsing history (only pages you commented on are stored), cookies, form input, passwords, account information, location, device identifiers or usage analytics.
3. Where data is stored
Everything is stored in the extension's local storage (chrome.storage.local) in your browser on your computer. Cloud sync (chrome.storage.sync) is not used and nothing is uploaded. The extension makes no network requests, loads no remote code, and contains no ads, analytics or third-party SDKs.
4. How data is used and shared
Data is used only to show your comments on the page and in the side panel, restore them after a reload, and produce Markdown or export files when you ask.
- When you click "Copy for Agent", the extension writes your open comments (including the redacted URL, comment text, selector, selected text with context, element text snippet, image address and window size) to your system clipboard. Where you paste it is your choice; other applications may be able to read the clipboard. Be aware of prompt-injection risk when giving page content to an AI agent.
- When you click Export, the extension downloads the full comment data as a JSON file; where it is kept and how it is used afterwards is up to you.
- Apart from these actions triggered by you, we do not share, sell or transfer data, we do not use it for advertising, profiling or credit decisions, and the developer cannot read your data.
5. Permissions
- activeTab, scripting: inject the comment UI into the current page only when you click the icon, press the shortcut or use the context menu.
- storage: save comments locally.
- sidePanel: show the side panel.
- contextMenus: context-menu entry.
- Optional site access: not granted by default. Only when you press an authorise button in the side panel is a single site requested, to restore comments automatically after a reload on that site or to comment inside embedded iframes. You can revoke it at any time in the browser's extension settings.
6. Retention and deletion
Comments are kept until you delete them. You can:
- delete a single comment on the page or in the side panel;
- use "Clear this page" in the side panel's "..." menu;
- uninstall the extension; the browser then removes its local storage. Exported JSON files and clipboard contents are outside the extension's control and must be deleted by you.
7. Security
Data does not leave your device. Data in chrome.storage.local is managed by the browser and is not additionally encrypted; do not store sensitive content on shared computers or untrusted browser profiles. Imported JSON is validated field by field and limited in size (5 MB, 5000 items).
8. Chrome Web Store User Data Policy statement
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use data only as necessary for the extension's single purpose, do not transfer it to third parties (other than the copy and export actions you trigger yourself), do not use it for personalised advertising, and do not allow humans to read user data.
9. Children
The extension is not directed at children under 13 and does not knowingly collect personal information from anyone.
10. Changes
If data handling changes (for example if sync or sharing is added), this policy will be updated first, the store listing will say so, and consent will be sought again where required.