Prism privacy policy.

This page is the complete, extension-specific privacy disclosure for Prism. It does not describe another Selfhood Studios extension. The studio-wide policy remains available at /privacy.

Prism requires no Selfhood Studios account. Extension data is processed locally unless a feature you deliberately use needs to contact a destination identified in the sharing section below.

Prism reads and analyses data from websites you inspect. Most auditing stays in your browser. Cloud AI is optional, but once valid cloud-provider credentials are configured, a user-started audit automatically sends audit and page context to that provider for an executive summary; other AI transfers occur when you send a chat or invoke an AI-labelled action.

When a transfer starts: Remote transfer begins after you configure a provider and take a related action: running an audit triggers the automatic AI summary; sending chat, choosing deep analysis, requesting vision or responsive critique, generating a component, or requesting an AI visual comparison triggers that specific request. Local audits still work without any AI provider.

Prism handles the address and title of the page being inspected; page text excerpts, headings, links, forms, metadata, structured-data types, selectors, attributes, DOM and HTML snippets, accessibility roles and names, computed styles, design tokens, layout fingerprints, resource and timing information, Core Web Vitals, and visible-page or element screenshots when the selected feature needs them. It also handles audit findings and scores, muted-issue rules, preview edits, fix packs, exported reports, audit-history metadata, chat prompts and responses, AI tool traces, provider and model settings, custom endpoint addresses, and any provider API key you choose to save.

Prism's declared content scripts match ordinary pages at <all_urls>. The vitals script starts at document_start and observes current-page performance measurements in memory; the main page bridge loads at document_idle. A full audit, element inspection, accessibility-tree read, token extraction, viewport capture, screenshot, preview edit, export, or AI tool read occurs when you open Prism and invoke the relevant user-facing workflow. Prism reads active-tab details through the tabs capability and does not request the chrome.history API. Running an audit saves a local history entry unless storage fails. If usable AI credentials are already configured, completing that user-started audit also automatically requests an executive summary from the configured provider. Chat sends what you type and, while the Attach page context setting is enabled, a compact current-page context summary. Vision, deep-analysis, responsive-critique, component-generation, and visual-history actions can additionally attach screenshots, element crops, audit evidence, or tool results.

These are the Chrome capabilities declared by this extension and the narrow product purpose assigned to each one.

Prism uses this information only to audit accessibility, UX, SEO, performance, and security; measure page vitals; inspect elements and accessibility structure; extract and export design tokens; preview reversible fixes; generate and export audit reports or fix packs; preserve and compare audit history and visual regressions; emulate requested viewport sizes; and provide the AI summary, chat, vision, analysis, or code-generation action you request. It is not used for advertising, unrelated profiling, credit or eligibility decisions, resale, or data-broker services.

The data is not used for personalized advertising, unrelated profiling, credit or eligibility decisions, resale, or data-broker services.

Rule-based analysis runs in the inspected page and extension contexts. Prism stores settings, provider configurations and API keys, muted findings, and up to 60 audit-history entries in chrome.storage.local in the Chrome profile where it is installed. Compressed visual-history screenshots are stored in the extension's IndexedDB database with a least-recently-used limit of 10 screenshots per website origin. Current chat state, tool traces, live performance readings, page context, element-inspection results, and unapplied preview state are generally held in extension or page memory for the active session. The theme bootstrap also reads the prism-theme value from extension localStorage. Prism has no Selfhood Studios application backend, account, sync, analytics, advertising, or telemetry service. API keys and other locally stored values are not separately encrypted by Prism; they rely on Chrome-profile, operating-system, and device security.

Selfhood Studios cannot inspect, recover, or restore data that remains only in your browser profile.

Prism does not send extension data to Selfhood Studios. When a configured AI workflow runs, Prism sends requests directly to the active endpoint: DeepSeek, OpenAI, OpenRouter, Anthropic, xAI, or the custom OpenAI-compatible URL you supplied, which may be a local service such as Ollama or LM Studio. Depending on the action, the recipient receives the API credential or authorization header, provider and model choice, system instructions, your prompt and recent conversation, the page address and title, compact page text and metadata, audit findings, DOM or accessibility evidence, computed-style or token information, AI tool results, and optional page screenshots or element crops required to answer. A configured cloud provider receives ordinary network metadata such as IP address, request time, and HTTP headers. If you configure an http endpoint, its payload is not protected by HTTPS; use http only for a trusted same-device or private-network service. Inspected websites do not receive Prism audit data merely because they are inspected, although any reversible preview you deliberately apply changes the current rendered DOM in that tab. Selfhood Studios receives information only if you deliberately send it for support or if disclosure is legally required. Prism does not sell or rent user data or share it with advertisers or data brokers.

No data is sold or rented, shared with data brokers, or transferred for personalized, retargeted, or interest-based advertising. External recipients process data under their own terms, privacy policies, account settings, and retention controls.

Audit history is capped at the newest 60 entries. Visual-history screenshots are capped at 10 per website origin and the least recently accessed capture is evicted when that limit is exceeded. You can delete an individual history entry, clear all history and its linked captures, clear muted issues, reset settings, or remove saved provider credentials in Prism. Session-only page context, chat state, tool traces, inspection data, and performance observations are discarded when the relevant extension or page context closes, reloads, or is replaced. Other local settings remain until you reset or delete them or uninstall Prism. A copy already sent to an AI provider or custom endpoint follows that recipient's account settings, contract, logs, and privacy and retention policies; Selfhood Studios cannot retrieve or delete that copy.

Before uninstalling, use the extension's delete, clear, reset, or export controls where available. Uninstalling normally removes browser-managed extension storage from that Chrome profile.

You control whether optional remote processing is configured and can reduce, remove, or avoid the data handled by the extension:

• Use Prism without adding an AI key to keep rule-based audits, inspection, tokens, exports, and history on-device.
• Choose a compatible local custom endpoint and enable local heavy mode to route AI calls to that local endpoint instead of a cloud provider.
• Turn off Attach page context before sending chat if you do not want the compact page summary included; avoid vision and screenshot actions when an image is not needed.
• Remove a saved API key, change the active provider or endpoint, clear muted issues, delete one history entry, clear all audit history, reset settings, or uninstall Prism.
• Do not inspect pages containing secrets or personal data you do not want Prism to handle, and review the receiving provider's policy before enabling cloud AI.

• Prism does not create a Selfhood Studios account or send audit data, page content, credentials, or history to a Selfhood Studios backend.
• Prism does not include Selfhood analytics, advertising, telemetry, session replay, or cross-site tracking.
• Prism does not request Chrome's browsing-history permission and does not read a blanket list of previously visited pages.
• Prism does not sell data, share it with data brokers, or use it for personalized advertising, eligibility decisions, or unrelated profiling.

Remote requests containing user data or credentials use secure transport such as HTTPS or WSS, except a user-configured service that is deliberately hosted on the same device or private network. Authentication information is not publicly disclosed.

Local data relies on Chrome's extension isolation and the security of your Chrome profile, operating system, and device. No security measure is absolute; protect your device account and revoke a provider credential if you believe it has been exposed.

User data is used only to provide or improve Prism's disclosed single purpose and user-facing features. Selfhood Studios does not permit personnel or contractors to read extension data. Routine human access is not possible because Selfhood Studios does not receive extension content.

The limited exceptions are when you explicitly send specific data for support, access is necessary to investigate security or abuse, disclosure is required by law, or data is first aggregated and anonymized for lawful internal operations.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Where a feature sends data to a third party, the transfer must be disclosed before it begins and occur only after an affirmative user action. You can avoid the transfer by not invoking or enabling that optional feature, and you can remove local data through the controls described above.

Analytics on this marketing website are separate from the extension and cannot access its stored content. Website practices are explained in the studio-wide privacy policy.

For a privacy question, rights request, or security report, contact Selfhood Studios. Do not send API keys or unrelated private content.