Privacy policy

In short

• We read public pages of websites their owners add, to build each guide's knowledge.
• The browser extension reads the page you are on only after you press its icon, and never what you type into a field.
• What a guide needs to answer is sent to an AI provider. We do not store the page text it was shown.
• We do not sell personal data, run advertising, or track you across websites.
• You can ask us to delete your data at hello@localhost.

Who we are

“Pharos”, “we” and “us” mean the service at localhost:3030 and the people who run it. For anything in this policy, write to hello@localhost.

What we collect

If you own a website and have an account

• Your email address and display name, and a one-way hash of your password (we never store the password itself). If you sign in with Google or GitHub, the identity they confirm to us (an id, your name and email).
• The websites you add, your settings (appearance, allowed addresses, chosen AI model), and the text and links of the public pages we read on those websites, so the guide can answer from them.
• Usage counts (how many sessions your guide ran, which questions it could not answer) shown to you in your dashboard.
• Billing records: your plan, its dates and status, and the payment provider's reference for you. Your card details are handled by the payment provider and never reach us.

If you use a guide on a website that installed Pharos

• The question you type, with email addresses, phone numbers and card-like numbers removed before it is stored or sent anywhere.
• A random id kept in that website's storage in your browser, so a conversation hangs together. It is different on every website and is not shared between them.
• To answer, the guide reads the page you are on: its address (without anything after a ? or #), its title, its headings, an excerpt of the text showing, and the names of the buttons and links. It never reads what you type into a form, anything marked private, or its own panel.
• The website's owner can see the questions and how often things were asked, in their dashboard.

If you use the browser extension

• A random install id, made when you install it, so we can count your daily walkthroughs. It is not derived from you or your browser.
• When you ask for something: the website's host (for example shop.example) and what you asked for, with emails, phone numbers and card-like numbers removed.
• To plan each step: the page's address without its query, its title and headings, an excerpt of the text showing (up to about 3,000 characters), and the names of the things on screen. This can include whatever is on that page, including pages you are signed in to. Press the icon only where you are comfortable with that, and use Pause in the extension's menu to switch it off.
• If you sign in from the extension: your account email, so your plan applies.
• It never reads what you type into fields, never touches a page until you press its icon on that page, and never presses anything for you.

Who else handles it

We use these services to run Pharos. Each receives only what it needs.

• Anthropic and OpenAI (AI models): the question and the page excerpts above, to write an answer or plan a walkthrough, and the text of the public pages a site owner adds, to make them searchable. Under their API terms, content sent through the API is not used to train their models.
• Aiven (database) and our server host: where the data lives.
• Vercel: hosts the website and dashboard.
• Resend: sends our emails (verification, password reset, usage notices).
• Paddle and Bachs.io: take payment. They act as the seller (“merchant of record”), so they handle your card, tax and invoices, under their own privacy policies.

We may disclose information if the law requires it. We do not sell personal data and we do not share it with advertisers or data brokers.

Cookies and storage

One session cookie keeps you signed in to the dashboard (and a short-lived one while you sign in with Google or GitHub). The guide stores a random id (and the progress of a walkthrough in progress) in the browser storage of the website it runs on, and the extension keeps its install id and settings in its own storage. We use no advertising or third-party analytics cookies.

How long we keep it

• Visitors' questions and walkthrough events: for as long as the site owner chose, at most what their plan allows (one day on Free, up to a year on the largest plan), then deleted every day.
• Visitor sessions: about two days.
• What people asked the extension for (the host and the request, personal details removed): 90 days. It is not linked to you or your install id.
• The text of the page excerpts sent to plan or answer: not stored by us.
• Pages we read for a site: while the site is on your account, replaced each time it is read again, and deleted with it.
• Your account: until you ask us to delete it. Payment records: as long as accounting and tax rules require.
• Server logs: short-lived, and they do not include what visitors typed or the content of pages.

Your choices

You can ask us to show you, correct or delete the data we hold about you, or to delete your account and everything on it, by writing to hello@localhost. We will answer within 30 days. Uninstalling the extension stops it completely. If you are in a place where the law gives you more rights (for example the EU, the UK or Nigeria), you have them, and you can also complain to your data protection authority.

Security

Everything travels over HTTPS. Passwords are stored only as hashes. Access keys and provider keys live on our servers and never in a page or the extension. The extension asks for the narrowest browser permission that works (only the page you press it on), and a web page can never read its install id. No system is perfectly secure; if something goes wrong that affects you, we will tell you.

Children

Pharos is not for people under 16, and we do not knowingly collect their data.

Where your data goes

Our providers run in several countries, including the United States and the European Union, so your data may be processed outside your own.

Chrome Web Store user data policy

The use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. The extension's page content is used only to point at things on the page you asked about, and is not sold, used for advertising, or used to judge creditworthiness or lending.

Changes

If this policy changes in a way that matters, we will update the date above and, where it affects what we do with your data, tell you by email or in the dashboard.