Privacy Policy

Last updated: October 03, 2026

CapScript Web has no accounts and no analytics. Your transcripts, searches, library and settings stay in your browser. The only data that leaves your device is what license activation needs, feedback you choose to submit, and, if you turn on AI chat, the transcript text you send to the AI provider you choose.

This policy covers the CapScript Web browser extension for Chrome, Firefox and Chromium browsers, and this website. "We" means ~serptail, the developer.
What stays on your device

Transcripts and your library. Captions you fetch from YouTube, and any transcripts you save, are stored in your browser's extension storage.
Search. Indexing and searching happen locally. Search queries are never sent to us.
Settings and AI history. Your preferences, AI summaries and AI chat history (the most recent 200 messages per video) are stored locally.
API keys. If you add an AI provider key, it is saved in your browser's extension storage and used only to call that provider. We never receive it.
License data. If you activate a license, your license key, a signed token and its expiry date are stored locally (in extension local and session storage).


You can export your data as CSV, JSON or plain text at any time. Uninstalling the extension or clearing its data removes everything above.
What is sent to us: license activation

CapScript Web is a paid extension, so it checks your license with our licensing server when you activate, periodically afterwards, and when you deactivate. Each check sends:

your license key,
a device identifier: a one-way hash computed from coarse hardware traits (CPU thread count, touch support and GPU vendor category), not your name, IP-based location or browsing activity,
a random one-time value and a timestamp, used to sign the request and prevent replay.


Our server stores your license identifier and the device hash, and uses them only to confirm your license is valid and to enforce the two-device limit. It receives nothing that directly identifies you as a person, and the raw hardware values never leave your device. Licenses use time-limited signed tokens, and validation just confirms the token is still valid for the device that activated it. Signed receipts are stored on your device in encrypted form, which lets the extension work offline for a limited grace period.
Feedback

If you submit feedback from the extension, the message, your rating, a timestamp and basic browser metadata (user agent and platform) are sent through EmailJS to the developer's inbox. This happens only when you press submit. Nothing is sent in the background, and no telemetry is collected otherwise. Anything personal you type into the message will be in that email.
Payments, refunds and disputes

Purchases are handled by Payhip, which processes payment and emails your license key. We do not receive or store your card details. Payhip's own privacy policy governs the information you give it at checkout.

Payhip may send a webhook to our licensing server to create or revoke a license record. Refunds are also processed by Payhip, and our server has a refund endpoint that handles refund requests tied to your license key. For refund problems or payment disputes, email serptail2@gmail.com.
AI chat (optional)

AI chat is off until you add a provider and key. When you ask a question, the extension sends your question and the relevant transcript text directly from your browser to the provider you selected: Google (Gemini), OpenAI (ChatGPT), Anthropic (Claude), or a custom or local endpoint such as Ollama. Their terms and privacy policies apply to that data, and we do not see or store it. Your prompts and API keys never pass through our servers; the extension talks to the provider directly from your browser.

If you use Ollama or another model running on your own computer, the text goes only to that address. To keep everything on your device, use a local model or leave AI chat off.
YouTube

The extension reads transcript text, timestamps and the video ID from a YouTube page only when you actively trigger it. It does not run in the background or scan pages you haven't opened it on. To fetch captions it requests caption data from YouTube, as your browser normally would, and YouTube and Google handle that traffic under their own policies.
Service providers

Cloudflare (Workers and D1) hosts the licensing backend. It receives activation and validation requests and stores hashed device IDs and license records. Standard Cloudflare server logs (IP address, user agent) apply.
EmailJS delivers feedback submissions to the developer's inbox.
Payhip handles payments, license delivery and refunds, as described above.


This website

We run no analytics, advertising or tracking cookies on this site. It does load a few third-party resources that may receive your IP address and set their own cookies: Google Fonts, an embedded YouTube player in the demo, and the Payhip checkout window when you open it. The site is hosted on GitHub Pages, which may keep standard server logs.
What we do not do

We do not sell, rent or share your data for advertising.
We do not collect your browsing history, the videos you watch or your search terms.
We do not use data for anything unrelated to providing and securing the extension, and we do not use it to judge creditworthiness or for lending.


Retention and your choices

Deactivate from the extension to notify our server and remove license data from your device, which frees an activation slot.
Delete local data by clearing your library, removing a saved API key, or uninstalling the extension.
Ask us to delete your license record or submitted feedback by emailing us at the address below. Include proof of purchase so we can find your records. EU/EEA and California residents can exercise applicable data rights the same way.


License and device records on our server persist until revoked or removed. Operational server logs are kept for up to 90 days, then deleted or anonymized.
Security and remote code

All communication between the extension and our servers uses HTTPS. License data is signed and time-limited. Other local data, including transcripts and saved API keys, relies on your browser's own storage sandbox and is not given an extra encryption layer. The extension does not download or run any remote JavaScript or WebAssembly; everything it executes is bundled in the package you installed.
Children

CapScript Web is not directed at children under 13, and we do not knowingly collect their information.
Changes

If this policy changes, we will update the date above and, for material changes, note it in the extension's store listing or release notes.
Contact

Questions or requests: serptail2@gmail.com, or open an issue at github.com/serptail. Website: serptail.github.io/CapScript-Web.