Privacy Policy

Last updated: 2026-07-07

usum is a browser extension that generates AI summaries of YouTube videos. This policy explains, in the four categories the Chrome Web Store requires — what we collect, how we use it, how we store it, and how we share it — exactly what the extension touches, what leaves your browser, and what we keep. It is written to satisfy the Chrome Web Store Limited Use requirements.

1. Data we collect

usum only collects the minimum needed to produce your summaries, enforce the free tier, and unlock Pro after purchase.

Content you ask us to summarize

When you open a YouTube watch page and press a summarize button, usum reads, inside your browser:

• The video's public metadata (title, channel, length, id).
• The video's public captions / transcript.
• For the Comments mode only: the video's public top comments.

All requests to YouTube are made without your login cookies. usum does not read your YouTube account, watch history, your browsing on other sites, your cookies.

On our own usum.io installation page only, a referral link can save a random token in website local storage for up to 14 days. After installation, our activation page passes that token to the extension to connect the referring source or creator to the device. If you sign in, we connect this source to your verified account and subsequent product use, trial signals, and payments to measure which referrals are useful. We do not match people by IP address or browser fingerprint. The token contains no email or account details.

Account & identity data (only if you sign in)

Signing in is optional and only needed to carry your Pro subscription across devices. If you choose to sign in, we collect:

• Sign in with Google: when you consent, the extension obtains a short-lived Google OAuth access token through Chrome's identity flow and sends (posts) that access token to our backend at api.usum.io over HTTPS. Our backend uses the token a single time to call Google's userinfo endpoint and read your email address, your name, and your Google account identifier, and then discards the token — it is never stored. We do not receive your Google password and request no other Google data.
• Sign in with email & password: your email address, your name (optional), a password (which we store only as a salted hash, never in plain text), and a one-time verification code we email to confirm the address is yours.

Usage & device data

• An anonymous, randomly generated device id used to count free-tier usage and to unlock Pro after purchase.
• Usage counters: the device id, the email if you are signed in, a timestamp, and which mode you used — to enforce the weekly free-tier limit. We do not store the video content in these counters.

2. How we use the data

• Transcript / comment text is used solely to generate the summary you requested, and for nothing else.
• Email, name, and account identifiers are used only to authenticate you, link your device to your subscription, and restore Pro access across devices.
• Device id and usage counters are used only to enforce the free-tier limit and to recognize a Pro device.
• We do not use any of your data for advertising, profiling, or to train AI models.

3. How we store & retain the data

• Transcript / comment text is never stored. It is held in memory only for the duration of the summarization request and then discarded.
• Account, subscription, and usage records (email, name, hashed password, device id, usage counters, Pro status) are stored in our managed database (Supabase) over encrypted connections, and kept for as long as your account or device remains active so we can maintain your subscription and enforce fair use.
• On your device, the extension stores your settings, your anonymous device id, and your Pro/sign-in status locally via the browser storage API.

4. How we share the data

We never sell or rent your data. We share it only with the service providers strictly required to deliver the product:

• AI provider (OpenAI): the transcript / comment text is forwarded over an encrypted connection to OpenAI solely to generate your summary. OpenAI does not use API data to train its models.
• Google: if you use Sign in with Google, the Google OAuth access token described above is posted from the extension to our backend, which then presents it to Google's userinfo endpoint to verify your identity and retrieve your email and name. The token is used once and discarded, never stored.
• Payment processor (Dodo Payments, a Merchant of Record): if you buy Pro, Dodo Payments handles the checkout and stores your billing details. We never see or store your full card number — we store only your email and whether your account/device is Pro.

Permissions

• storage — to remember your settings, anonymous device id, and Pro/sign-in status on your device.
• Host access to our API — to send transcripts for summarization and receive the result.

The extension ships with all of its code inside the package. It loads no remote code.

Your choices & rights

• Signing in is optional — you can use the free tier without an account.
• Uninstalling the extension removes all locally stored settings and your device id. Website referral storage is separate: it is cleared after a successful handoff, expires after 14 days, or can be removed by clearing site data for usum.io.
• To access, export, or delete the server-side records tied to your account, email, or device id, email privacy@usum.io and we will comply.

Contact

privacy@usum.io