Privacy Policy

ModeNote Chrome Extension — Last updated: April 17, 2026

1. Introduction

ModeNote (the "Extension") is a Chrome extension that summarizes web pages and PDFs using AI. This policy describes what data the Extension collects and how it is used.

2. Data We Collect

The Extension only retrieves page content when the user explicitly clicks the "Summarize" button. It does not collect data in the background or record browsing history.

3. How We Use Data

• Page and PDF text is sent only to the AI summarization service and is not stored on our server.
• Email addresses are used for account and subscription management.
• Usage data is used to manage plan-based usage limits.
• We do not use collected data for marketing, advertising, or profiling purposes.

4. AI Data Processing and Training

The Extension uses the following commercial (paid) AI APIs for summarization. Under our contracts with each provider, submitted data is not used to train or improve AI models.

Our server does not store the submitted text, PDF data, or summarization results (passthrough in memory only). AI providers temporarily retain the data for abuse and policy-violation monitoring as described above, after which it is automatically deleted. In no case is the data used for AI model training or improvement.

5. Consignment of Personal Data & International Transfers

We consign the handling of personal data to the service providers listed below to provide the Extension. Under Article 27, Paragraph 5, Item 1 of Japan's Act on the Protection of Personal Information (APPI), this constitutes "consignment" and does not amount to a third-party transfer. We supervise each consignee as required by Article 25 of the APPI.

Payment processor

Payment processing for paid plans is handled by the following payment processor. Stripe, Inc. is not a consignee of ours; it independently handles card information under its own privacy policy and terms of service. We do not receive or retain credit card numbers or equivalent payment credentials.

Handling of personal data in foreign countries

Provision of personal data to the above consignees and payment processor located in the United States and Singapore is treated as "provision to a third party in a foreign country" under Article 28 of the APPI. Neither country has been designated as providing a level of protection equivalent to Japan by the Personal Information Protection Commission (PPC). However, we have entered into Data Processing Addenda (DPA) or Cloud Data Processing Addenda (CDPA) with each provider to secure contractual safeguards.

Information on the personal data protection regimes of these countries is available on the PPC website: https://www.ppc.go.jp/en/.

We do not sell or share user data with any third party other than those listed above.

6. Chrome Permissions

7. Local Storage

The Extension uses Chrome's storage API to store the following data in the browser. This data is not sent to our server.

• chrome.storage.local: Authentication token, selected summarization mode ID, selected AI model
• chrome.storage.session: Current tab processing state (e.g., whether summarization is in progress)

Uninstalling the extension automatically deletes all local data.

8. Data Security & Retention

• All server communication is encrypted via HTTPS (TLS 1.2+).
• API keys are verified using salted SHA-256 hashes. An encrypted copy is retained for admin display, accessible only by the account holder.
• Authentication tokens expire after 30 days.
• Page and PDF text is not stored on the server and is discarded immediately after AI API processing.
• The database runs on a managed service (Neon Postgres, Singapore region) on Google Cloud with encryption at rest.

Retention periods:

• Account information (email, display name): Until account deletion
• Summarization mode settings: Until account deletion
• API usage logs: 1 year from the date of recording (automatically deleted thereafter)
• After account deletion, all personal data is removed from our servers within 30 days.

9. Security Measures

In accordance with Article 23 of the APPI, we implement the following measures to prevent unauthorized leakage, loss, or damage to personal data.

(1) Organizational measures

• We designate a person responsible for personal data handling and maintain internal policies governing such handling.
• We periodically audit our handling practices and update policies and operations as needed.
• We maintain incident reporting and escalation procedures.

(2) Personnel measures

• All staff are bound by confidentiality obligations regarding personal data.
• We provide regular training on the proper handling of personal data.

(3) Physical measures

• The service operates on cloud infrastructure. We do not operate physical servers in-house and rely on the cloud provider's physical security (access control, surveillance, etc.).
• Access to work devices requires login authentication.

(4) Technical measures

• Access to personal data is limited to staff with a business need.
• All server communication is encrypted via HTTPS (TLS 1.2 or higher).
• Databases are protected with encryption at rest.
• Credentials such as API keys are stored as salted hashes, and authentication tokens have expiration.
• We apply rate limiting, login-attempt limits, and access-log monitoring to prevent unauthorized access and abuse.

(5) Understanding of the foreign environment

• Personal data may be handled in the United States (Google LLC, Anthropic PBC, Stripe, Inc., Neon, Inc.) and Singapore (Neon's data storage region).
• We have reviewed the data protection regimes of these jurisdictions and entered into DPA / CDPA contracts with each provider to secure appropriate safeguards.

10. Your Rights (Under Japan's Act on the Protection of Personal Information)

Users may exercise the following rights regarding personal data we hold:

• Disclosure: Request disclosure of your personal data held by us.
• Correction / Addition / Deletion: Request correction, addition, or deletion if your data is inaccurate.
• Suspension / Erasure: Request suspension of use or erasure of your data.
• Cessation of Third-Party Provision: Request that we stop providing your data to third parties.

How to make a request:

• Please use our Contact Form.
• For identity verification, please send your request from your registered Google account email, or we may ask you to submit identification documents.
• We respond without undue delay, typically within two weeks of receipt. If additional investigation is required, we will notify you separately.

Additionally, uninstalling the Extension removes all locally stored data.

Filing a complaint

Complaints regarding our handling of personal data can be submitted through the Contact Form.

We are not affiliated with any authorized personal information protection organization.

If our response is unsatisfactory, you may also file a complaint with the Personal Information Protection Commission (PPC) of Japan.

• PPC website: https://www.ppc.go.jp/en/
• PPC consultation hotline: +81-3-6457-9849

11. Disclosure Under External Transmission Regulations

In accordance with Article 27-12 of Japan's revised Telecommunications Business Act, the following information is transmitted to external parties through the use of this Extension:

All transmissions listed above are necessary for service delivery and occur only in response to explicit user actions (login, summarization, payment). To opt out, uninstall the Extension to cease all external transmissions.

12. Changes to This Policy

This policy may be updated as needed. Significant changes will be communicated through extension updates or by posting on this page in advance.