EvoQuery Privacy Policy

Last Updated: February 28, 2026

Overview

EvoQuery is a Chrome extension that queries 8 AI models simultaneously and analyzes consensus, contradictions, and reliability across their responses. We are committed to protecting your privacy and being transparent about our data practices.

Data We Collect

Account Information

When you create an account, we collect:

Email address (for authentication and account management)
Password (stored as a one-way SHA-256 hash, never in plain text)
Usage counts (to enforce tier limits)
Subscription tier and status

Query Data (Anonymized Research Data)

Important: When AI models significantly disagree on a response (consensus score below 95%), we may save anonymized query data for AI reliability research. This includes:

Your query text
AI model responses (compressed or full depending on divergence level)
Consensus score, contradiction types, and model agreement patterns
Domain classification of the query topic
Query mode (Quick or Deep)
An internal user ID (not your email — cannot be used to identify you externally)

This data is NOT linked to your email address. You can opt out of this collection at any time in extension settings with no loss of functionality.

API Keys (BYOK — Bring Your Own Keys)

Pro users may provide their own API keys for AI providers. These keys are:

Stored locally in your browser using Chrome's chrome.storage API
Transmitted to our backend only to make API calls on your behalf
Never logged, stored in our database, or retained on our servers beyond the duration of a single request
Never shared with any third party

We recommend setting spending limits at your provider's dashboard as an additional safeguard.

Technical Data

API request logs (timestamps, response codes) — retained 90 days
Error logs — retained 180 days

Data We Do NOT Collect

Queries where AI models agree (95%+ consensus) are not stored
Browsing history or web page content
Location data or precise IP addresses
Personal files or documents
Cookies or tracking pixels
Payment card information (handled entirely by LemonSqueezy)

How We Use Your Data

Account Data: Used solely for authentication, usage tracking, tier enforcement, and service communications. We do not sell your email address or personal account information to third parties.

Anonymized Query Data: May be used to:

Build AI reliability indices tracking model disagreement patterns over time
Create research benchmarks for AI consensus and contradiction analysis
License to researchers, AI labs, and institutions studying AI model behavior
Generate aggregate reports on frontier and open-source model divergence

Data Sharing and Disclosure

We Do Not Sell Personal Information

We do not sell, rent, or trade your email address or personal account information.

Service Providers

We share personal data only with essential service providers:

Supabase — Database hosting (receives account information)
Railway — Backend API hosting
LemonSqueezy — Payment processing (receives email for billing)

AI Processing Services

When you submit a query, only the query text (not your email or account info) is sent to the AI providers you have enabled. Current providers include:

Anthropic (Claude) — anthropic.com/privacy
OpenAI (GPT-4o) — openai.com/policies/privacy-policy
Google (Gemini Flash 2.0) — policies.google.com/privacy
xAI (Grok) — x.ai/privacy
Groq (Llama 4 Scout, Llama 4 Maverick, Llama 3.3, Qwen3) — groq.com/privacy

These services process queries under their own privacy policies. Your email address is never included in requests to these providers.

Sale of Anonymized Research Data

We may sell, license, or provide anonymized query data (queries where AI models significantly disagree) to AI companies, research organizations, and enterprises. This data contains no personally identifiable information and cannot be linked back to you.

Legal Requirements

We may disclose data if required by law, court order, or government request, or to protect our rights and user safety.

Business Transfers

If EvoQuery is acquired or merged, user data may be transferred to the new entity. You will be notified via email of any ownership change.

Data Retention and Storage

Account Data: Retained for the lifetime of your account. Upon account deletion, personal data is permanently deleted within 30 days.

Anonymized Query Data: Stored indefinitely for research purposes. Because this data is not linked to your identity, it cannot be selectively deleted upon request.

Technical Logs: API logs retained for 90 days, error logs for 180 days.

International Data Transfers

Your data is stored on servers located in the United States (Railway, Supabase). If you access EvoQuery from outside the US, your data will be transferred internationally. By using EvoQuery, you consent to this transfer.

How the Extension Works

When you use EvoQuery:

Your query is sent to our secure backend API over HTTPS
Our backend forwards the query to AI providers (frontier and/or open-source depending on your mode selection)
Responses are analyzed locally for consensus, contradictions, and hallucination risk, then returned to your browser
In Deep Mode, your query is semantically reformulated into multiple variants and run across all selected models
If models disagree significantly (below 95% consensus), anonymized data may be saved for research unless you have opted out
Your email address is never included in the research database

Chrome Storage

The extension uses Chrome's local storage API to save authentication state, user preferences, model selections, and BYOK API keys. This data stays on your device. API keys are never synced to our servers beyond the duration of a single request.

Chrome Web Store Limited Use Disclosure

EvoQuery's use of data received from Chrome extension APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements:

Data is used only to provide and improve EvoQuery's core functionality (multi-model AI comparison)
Data is not transferred to third parties except to AI providers as necessary to process queries, and to LemonSqueezy as necessary to process payments
Data is not used for advertising purposes
Data is not used to determine creditworthiness or for lending purposes

Data Security

We implement the following security measures:

All communication between the extension and our backend uses HTTPS encryption
Passwords are stored as SHA-256 hashes — we never see your actual password
API keys are never logged or persisted server-side
Timing-safe key comparison prevents credential timing attacks
Rate limiting and request signing prevent unauthorized API access
Database encryption at rest via Supabase

No method of electronic storage is 100% secure. We cannot guarantee absolute security.

Your Rights

Access: Request a copy of your account data
Correction: Update your email and preferences through extension settings
Deletion: Request deletion of your account and associated personal data within 30 days
Opt-out: Disable research data collection at any time in extension settings — no functionality is affected
Export: Request your data in machine-readable format (JSON/CSV)

California Residents (CCPA)

California residents have the right to know what data is collected, the right to delete personal information, and the right to opt out of data sales. We do not discriminate against users who exercise these rights. Anonymized query data that cannot be linked to you falls outside the scope of personal information under CCPA.

European Residents (GDPR)

EU/UK residents have rights including access, rectification, erasure, data portability, and the right to object to processing. Our legal basis for processing is contractual necessity and legitimate interest. Contact us to exercise these rights.

Children's Privacy

EvoQuery is not intended for use by children under 13 years of age. We do not knowingly collect information from children. If we discover we have collected data from a child under 13, we will delete it immediately.

Changes to This Policy

We may update this privacy policy as EvoQuery's features evolve. Material changes will be communicated via:

Email notification to registered users (at least 30 days before changes take effect)
In-extension notification banner
Updated revision date on this page

Continued use of EvoQuery after changes indicates acceptance of the updated policy.

Data Breach Notification

In the event of a data breach affecting personal information, we will notify affected users via email within 72 hours and report to relevant authorities as required by law.

Contact

If you have questions about this privacy policy or want to exercise your data rights, please contact us at:
https://github.com/dbc00perdev/evo_query_extension/issues

In Summary: We collect your email for account management. When AI models significantly disagree on a query, we may store anonymized data for AI reliability research — this cannot be traced back to you, and you can opt out at any time. We do not sell your personal information. Pro users can provide their own API keys, which are never stored on our servers.