THOLI FIREFOX EXTENSION PRIVACY NOTICE
Updated October 20, 2026

Operator
Tholi is operated by ILUNỌNSEN LLC, Ohio, United States. Contact info@ilunonsen.com with privacy questions or requests.

Local processing
Normal extension guidance runs on your device without a Tholi account or backend. When you start guidance or page exploration, Tholi processes your destination, task context and bounded website information, including control labels, headings, accessibility information, navigation paths and interaction state.

DOM observation does not read input or textarea values, passwords, one-time codes, editable contents or full page HTML.

Visual assistance
Visual assistance may temporarily process viewport images and recognized text. Tholi masks discovered editable fields and iframe areas before processing captures. Masking and redaction cannot guarantee removal of all sensitive information. Images and private recognized text are not saved as persistent extension knowledge.

Storage and retention
Reusable website knowledge, sanitized paths, saved routes and preferences are stored locally. Destinations, supplied task details, private context, drafts and conversations use extension-session storage. Backend connection credentials are stored separately in extension-owned storage.

Reusable knowledge has bounded storage limits and expires after 90 days when accessed. Persistent knowledge excludes raw HTML, screenshots and private OCR text.

Optional private backend
No backend connection is required. If you explicitly configure and enable one, Tholi requests host access and Firefox’s optional data-transmission permissions.

That chosen server may receive its API authentication token, website origins and paths, task instructions, navigation context and bounded page observations. Masked images are transmitted only when backend OCR is separately enabled.

The supplied Tholi backend keeps private session context in memory and does not persist OCR payloads. Other operators may have different logging, retention and security practices.

Declining or revoking optional permissions blocks further backend requests and leaves local processing available. Revocation does not delete information already held by a server. Remote deletion may require reconnecting and retrying the deletion request.

Your controls
Pause or Stop ends active guidance and observation. Reset current session clears unfinished tasks, drafts and conversation. Forget removes selected website knowledge; Clear removes saved knowledge and routes. Uninstalling removes extension-owned browser data but does not erase remote server copies.

Other uses
The extension does not include advertising or analytics trackers. We do not sell extension user data or use it for personalized advertising. Information you send by email is handled to respond to your request and meet applicable obligations.

Website and contact
Visiting tholi.io is separate from using the extension. Website hosting, Cloudflare measurements and cookie practices are described at https://tholi.io/privacy and https://tholi.io/cookies.

For privacy requests, contact info@ilunonsen.com. Device-only data must be managed through your browser and extension controls because we cannot retrieve or erase it remotely.