AssisT Privacy Policy

Adaptive Accessibility Chrome Extension

Last Updated: 13 September 2026
Effective Date: 13 September 2026
Applies to: AssisT 1.0.0

1. Overview

AssisT is a Chrome browser extension that provides accessibility features for students and learners. This privacy policy explains exactly what data AssisT accesses, stores, and (in limited cases) transmits—and what it never does.

We built AssisT with a fundamental principle: your educational data belongs to you. We don't need it, don't want it, and have designed the extension so we never receive it.

2. What Data We Collect

We collect nothing. AssisT operates entirely on your local device and does not collect, store, or transmit any personal information to Fiavaion or any third party we control.

3. What Data Is Stored Locally

AssisT stores data using Chrome's secure local storage API (chrome.storage.local). All preferences stay on your current device only — they do not sync across devices. User-created content is also stored locally only.

3.1 User Preferences (chrome.storage.local)

• Feature toggles (which features are enabled/disabled)
• Text-to-Speech settings (voice, speed, pitch, highlight colours)
• Speech-to-Text settings (language, auto-punctuation mode, confidence threshold)
• Visual settings (font choice, spacing, dark mode preset, overlay colours)
• Keyboard shortcut customisations
• Selected user profile (ADHD, Dyslexia, etc.)
• Text customisation sync preference (whether to apply settings to all open tabs or current tab only)
• Translation language preferences (last-used source and target language, recently-used languages list)
• AI model preferences and cloud mode preference

Note: All preferences are stored locally on your device only. Nothing is sent to Fiavaion.

3.2 User-Created Content

• Annotations & Sticky Notes: Notes you create are stored locally in IndexedDB, organised by the webpage URL where you created them
• Citations: Bibliography entries and citation projects you create are stored locally
• Mind maps: Maps you create, including their notes and any text captured with "Add to mind map", are stored locally in IndexedDB
• Authorship Shield writing history: If the Authorship Shield companion feature is on, a record of how your writing developed is kept on your device. It is never uploaded, and it leaves your device only if you copy the report and send it yourself
• Custom Vocabulary: Words you add to your Speech-to-Text dictionary

3.3 Temporary Processing Data

• OCR Results: Text extracted from images is held in memory only during your session and is not persisted
• Translation Cache: Recent translations may be cached briefly (5 minutes) to improve performance; this cache is cleared automatically
• Reading Progress: How far you've scrolled on a page (stored per-domain, locally only)

3.4 Optional API Keys

If you choose to use cloud AI features (Anthropic, OpenAI, Google, or Perplexity), you may provide API keys. These are:

• Stored locally on your device only using AES-256 encryption
• Never transmitted to Fiavaion
• Sent only to the service provider you configured, when you use that feature
• Encrypted at rest using Chrome's secure storage with AES-256-GCM
• Deletable at any time through the extension settings

4. Chrome Permissions Explained

This is the complete list. Every API permission and every host permission in AssisT's manifest.json at version 1.0.0 appears below, with one line saying why it is there. Chrome shows you the same list at install time; if the two ever disagree, trust Chrome and tell us.

4.1 API permissions

4.2 Host permissions granted at install

These are the addresses AssisT is allowed to reach without asking again. Reaching an address is not the same as sending anything to it — the AI and model-download hosts are contacted only if you switch those features on.

On the four learning platforms above, AssisT can read page content to provide accessibility features. That content is processed locally and is never sent to external servers (except when you explicitly use an optional third-party service as described below).

4.3 Optional host permissions — asked for, never granted at install

4.4 Optional: Enable Everywhere

You may choose to grant AssisT permission to run on all websites using the optional permissions system. This is:

• Completely optional—AssisT works fully on educational sites without it
• Requested only when you click "Enable Everywhere" in the extension popup—never automatically
• Revocable at any time in Chrome Settings → Extensions → AssisT → Site access
• Built on Chrome's own consent flow—it uses the optional_host_permissions API, so Chrome, not AssisT, asks you and records your answer
• No automatic content script injection—Scripts only inject after you grant permission and reload tabs

When enabled, AssisT can provide accessibility features on any website. The behaviour is unchanged: content is processed locally and is not sent to external servers (except when you explicitly use an optional cloud feature).

4.5 Optional: Local AI Access

Local AI reaches an Ollama server running on your own machine, at the loopback address localhost or 127.0.0.1 on port 11434. That access is a second optional permission, separate from Enable Everywhere:

• Not requested at install: a student who never uses local AI is never asked for it
• Requested the first time you switch Local AI on, or apply a custom server address; Chrome shows an "Allow" prompt at that moment
• Granted per address: changing the server address asks again for the new one
• Revocable at any time in Chrome Settings → Extensions → AssisT

The permission lets AssisT talk to a server on your own computer. Nothing is sent anywhere else, and it grants no access to any website you visit.

4.6 How the optional permissions are designed

Fiavaion processes no personal data through AssisT, so no lawful basis arises for us to claim. The optional permissions are nevertheless built along data-protection lines, because that is the right shape for them:

• Explicit choice: you must actively choose to enable site access
• Granular control: Chrome allows per-site permission management
• Withdrawable: revoke permissions at any time without losing your settings
• Transparency: a plain explanation of why each permission is needed, above
• Data minimisation: only the permissions needed for the functionality you asked for

5. Third-Party Services (Optional)

AssisT includes optional integrations with third-party services. These are disabled by default and only activated when you explicitly enable and configure them.

5.1 Translation Services

For text translation, you can choose from these providers:

5.2 Dictionary Service

Word definitions are fetched from the Free Dictionary API:

• Data Sent: The single word you look up
• Website: dictionaryapi.dev

5.3 AI Features (Four Privacy Modes)

AssisT offers four distinct AI modes, giving you full control over privacy vs. capability trade-offs:

Model Selection: You choose which mode to use in AssisT settings. You can switch modes anytime without data loss.

6. What AssisT Never Does

• Collect or store personal information
• Track your browsing activity
• Use analytics or tracking services
• Share data with advertisers
• Sell or monetize user data
• Require account creation or login
• Transmit data to Fiavaion servers (we have no servers receiving user data)
• Access pages you don't visit (we don't run in the background on other sites)

7. Educational Privacy Laws

Fiavaion is not certified under any of the laws below and makes no compliance claim on your institution's behalf. What we can state is what the extension does, and what it does not do.

7.1 FERPA (United States)

AssisT is designed with the principles of the Family Educational Rights and Privacy Act in mind: no student data is collected. Fiavaion is not a school official, is not a FERPA-regulated entity, and makes no certification of compliance on an institution's behalf — what we can state is what the extension does:

• No student records collected: We never receive or store education records
• Local processing only: Student work is processed in the browser, not on external servers
• No third-party data sharing: We do not share any data with third parties
• Institutional control: because we receive nothing, there is no data flow for a data-sharing agreement with Fiavaion to cover. Your own agreement with any cloud AI or translation provider a student enables is a separate matter, and is yours

7.2 COPPA (Children Under 13)

AssisT is designed with the principles of the Children's Online Privacy Protection Act in mind: no data is collected from any user, including children. Fiavaion is not certified under COPPA and makes no compliance claim. What the extension does:

• No personal information is collected from any user, including children
• No account creation is required
• There is nothing for verifiable parental consent to authorise, because nothing is collected
• Cloud AI and cloud translation are off by default and require an adult's own API key to switch on

7.3 HIPAA

We make no HIPAA claim. AssisT is not a healthcare application, has not been assessed against HIPAA, and should not be described as HIPAA compliant. If your institution needs a HIPAA position on a tool used in a clinical or health-records context, treat AssisT as unassessed and evaluate it yourself.

8. GDPR — Our Position (European Users)

For users in the European Economic Area, United Kingdom, and Switzerland:

8.1 Controller status and lawful basis

Fiavaion processes no personal data through AssisT. We operate no server that receives data from the extension, so for AssisT we are neither controller nor processor of your personal data, and no lawful basis arises for us to rely on — there is no processing to justify. Settings, annotations, citations and mind maps stay in your browser's own storage on your own device; they are yours and we never see them. Any cloud AI or translation provider you choose to enable becomes your own processor, under the agreement you have with that provider — not a sub-processor of ours.

8.2 Your Rights

• Access: View all stored data via extension settings or Chrome DevTools (Application → Storage)
• Rectification: Edit any stored preferences or content through the extension
• Erasure: Delete all data by clearing extension storage or uninstalling
• Portability: Export your settings, annotations, and citations as JSON files
• Objection: Disable any feature or uninstall at any time

8.3 Data Retention

• Preferences: Retained until you clear them or uninstall
• Annotations/Citations: Retained until you delete them or uninstall
• Temporary data: Cleared when you close the browser or automatically after short periods

8.4 International Transfers

Fiavaion transfers nothing. If a student enables a provider, that student's text goes directly to that provider under the student's own agreement with it. The transfer is between the student and the provider; we are not in the path, and we have no transfer mechanism to disclose because we make no transfer. The providers AssisT can be pointed at, and what each receives, are listed in the sub-processor list.

9. Data Security

• Local encryption: Chrome's storage APIs use your operating system's encryption
• No network exposure: Since data stays local, there's no risk of interception in transit to our servers
• HTTPS only: Any third-party API calls use secure HTTPS connections
• Content sanitization: AssisT uses DOMPurify to sanitize HTML content and prevent XSS attacks

10. Your Choices

• Disable features: Toggle any feature off in the extension popup
• Clear stored data: Use the "Reset Settings" button in the extension
• Delete annotations: Remove individual notes or clear all via the Annotations panel
• Remove API keys: Delete saved keys in Settings → Translation
• Revoke site access: Change permissions in Chrome Settings → Extensions
• Uninstall: Removing the extension deletes all locally stored data

11. Changes to This Policy

We may update this policy to reflect new features or legal requirements. Changes will be:

• Posted at fiavaion.com/products/assist/privacy
• Noted in the extension's changelog on GitHub
• Indicated by updating the "Last Updated" date above

Material changes that affect your rights will be announced in the extension update notes.

12. Contact Us

Questions about this privacy policy or AssisT's data practices:

• Email: info@fiavaion.com
• Accessibility: accessibility@fiavaion.com — acknowledged within 5 working days
• GitHub: github.com/fiavaion/AssisT/issues
• Documentation: fiavaion.com/docs/assist
• Sub-processor list: fiavaion.com/docs/assist/sub-processors

13. Complaints

If you believe your data protection rights have been violated:

• Contact us first: info@fiavaion.com
• EU/EEA residents: You may lodge a complaint with your local Data Protection Authority (find your DPA)
• UK residents: Contact the Information Commissioner's Office

Change Log

• 13 September 2026 (AssisT 1.0.0) — Corrected the storage permission description: settings are held in chrome.storage.local and nothing syncs across devices. Renamed the Microsoft Translator provider to Azure Translator. Replaced the HIPAA considerations section with an explicit statement that no HIPAA claim is made. Restated FERPA as "designed with FERPA principles in mind" rather than a compliance claim, and restated the GDPR position: Fiavaion processes no personal data and any cloud provider you enable is your own sub-processor. Corrected the count of non-AI supports to 29. Added the accessibility contact address and a link to the sub-processor list. Listed every permission in the manifest, including offscreen and the Gemini, Hugging Face and raw.githubusercontent.com host permissions, which had been omitted. Removed the claim that the optional-permissions design "ensures GDPR compliance" and the claim that AssisT "complies with COPPA": Fiavaion is certified under neither, and section 8.1 now says plainly that no lawful basis arises because there is no processing. Restated international transfers: Fiavaion transfers nothing.
• 15 May 2026 (AssisT 0.9.1) — Previous version.