Last updated: 2026-08-13


This extension uses no analytics, advertising, or behavioral tracking. You can choose either "My API key" or the "Monthly plan." The network path depends on that choice.

• My API key: the extension calls the OpenAI API directly. Kagayoi's servers do not receive your research content.
• Monthly plan: Hikyaku, operated by Kagayoi, verifies subscription status and usage limits and relays requests to the OpenAI API. Sekisho sends verification codes to the purchase email and manages subscriptions, while Stripe processes payments.

When a research run starts, the following is sent to the OpenAI Responses API. On the monthly plan, Hikyaku temporarily relays the same data.

• The search query, taken from the q parameter of the Google search page URL.
• An output language hint, inferred from the page's hl / lang attributes (for example, ja).
• A country code and time zone, only while "Use my region for search" is on.

The following is not sent to OpenAI or Hikyaku:

• Titles, URLs, snippets, or any other content from the search results page
• Page bodies, content from pages other than the search results page, or browsing history
• City-level location, street addresses, or coordinates

Requests use store: false, instructing OpenAI not to retain the conversation. OpenAI's handling is governed by its policies: https://openai.com/policies/

A search query is text you typed and may itself contain personal information. Only the query from a search page where you started research or enabled automatic runs is sent.

• Your OpenAI API key is stored only in this browser (chrome.storage.local).
• It is used only to authenticate to the OpenAI API and is never sent to Kagayoi, Hikyaku, Sekisho, or another third party.
• Network calls are made from the service worker, a privileged context. The content script injected into search pages never receives the key. It receives only the selected access mode and a boolean indicating whether that mode's required credential is set.

• During authentication, the purchase email address and the six-digit verification code you enter are sent to Sekisho. Neither is sent to OpenAI or exposed to the search page.
• After authentication, Sekisho returns a signed credential containing the purchase email address, Stripe subscription ID, and issue date. The extension never displays it; it stores it in this browser (chrome.storage.local) and sends it only to Hikyaku when requesting a short-lived session. Hikyaku receives it temporarily to verify the signature but does not store the credential or email address. The session token is held only in service-worker memory and is not persisted.
• Hikyaku sends the subscription ID to Sekisho's license-check endpoint to confirm subscription status.
• To enforce usage limits, Hikyaku stores an irreversible hash derived from the app ID and subscription ID, monthly request and input/output-token totals, and short-lived rate-limit records. It does not store search queries, prompts, generated results, or source URLs.
• Sekisho processes the purchase email address, verification code, Stripe payment/customer/subscription identifiers, and subscription status as needed to authenticate the purchaser and verify subscription status.
• Stripe processes sign-up, payment methods, billing, and cancellation. Stripe's handling is governed by its privacy policy: https://stripe.com/privacy

While "Use my region for search" is on, the extension passes only a country code (for example, JP) and time zone (for example, Asia/Tokyo) to OpenAI's web_search tool. Hikyaku relays these fields on the monthly plan.

The extension never constructs city-level location, street addresses, or coordinates. Turning the setting off stops sending the country code and time zone.

• Settings: access mode, API key, monthly-plan internal credential, automatic runs on/off, reasoning effort, result-cache duration, output language, appearance, panel width, text size, region sharing on/off, and the panel's collapsed state.
• Temporary authentication data: after sending a verification code, the extension keeps the purchase email address only in in-memory browser-session storage (storage.session) so the popup can resume at the code-entry step. It is removed after successful authentication, when the browser exits, or when the extension is disabled, reloaded, or updated. It is not persisted to disk or exposed to search pages. The six-digit verification code is never stored.
• Usage counters: runs, extra searches, and input/output tokens per month.
• Result cache: generated results are kept for a limited time (24 hours by default, adjustable from off to 7 days) to avoid charging twice for the same query. "Clear cache" removes it at any time.

Uninstalling the extension removes this local data from your browser. Credentials are transmitted only for the purposes described above; usage counters and cached results are not sent externally.

• storage: stores the data listed under "Data stored in your browser."
• host_permissions (https://api.openai.com/*): sends research requests directly to the OpenAI Responses API in API-key mode.
• host_permissions (https://hikyaku.kagayoi.com/*): verifies licenses and sends research requests to Hikyaku on the monthly plan.
• host_permissions (https://sekisho.kagayoi.com/*): requests and verifies the purchase-email code on the monthly plan.
• Content scripts (/search* on supported Google country domains): inserts the panel and reads the query from the search page URL. The extension does not run on other sites.
• web_accessible_resources (fonts/*.woff2): loads the bundled IBM Plex Sans JP font. Exposure is limited to the Google domains where the content script runs.

The extension loads no external code. All scripts and fonts are included in the extension package. Traffic to the OpenAI API and Hikyaku carries data only; it never retrieves or executes code.


We do not sell user data, use or transfer it for unrelated purposes, or use or transfer it to determine creditworthiness or for lending. Processing by OpenAI, Hikyaku, Sekisho, and Stripe is limited to what is needed to provide research and the monthly subscription.


GitHub Issues: https://github.com/1llum1n4t1s/Sonoyo-Support/issues