Privacy policy

Last updated: November 8, 2026

Enlight checks text only when you ask it to. With your own API key it has no server in the path. If you choose Enlight’s hosted checks instead, a server we run sits between your browser and the AI provider, and keeps none of what you send.

What leaves your browser

When you run a check with your own key, Enlight sends the selected text, its surrounding paragraph (up to 1,500 characters), the page title and the page URL to the AI provider you chose in settings (Anthropic or OpenAI), using your API key. OpenAI requests are sent with storage turned off (store: false). The provider’s own privacy terms apply to that request.

When you check an image or a video, Enlight sends that image, or the frame you see, instead of selected text, together with its alt text, caption and the text of the post or article around it. To get the image, Enlight either downloads the image file again, without your cookies, or takes a screenshot of the visible tab and keeps only the part showing that image. The rest of the screenshot is discarded and never sent. When you mark an area with the picker, Enlight sends a screenshot of just that area, with the text of the post or section it was drawn on. The image is re-encoded before it is sent, which removes metadata such as where a photo was taken. Enlight asks the model never to identify people from their faces.

Hosted checks

If you pick Enlight in settings, the same things (text, paragraph, page title and URL, or the image and its context) go to Enlight’s service instead, which passes them to Anthropic on Enlight’s own key, and returns the answer. The service doesn’t store them and doesn’t write them to its logs; its logs hold an account ID, the result status and how long the check took. Anthropic’s own privacy terms apply to the request it receives, and Cloudflare, which runs the service, sees request metadata such as your IP address under its own terms. Your own API key, if you saved one, is never sent to Enlight.

What Enlight stores

On your device only, in Chrome’s local extension storage: your settings and API key (not synced to your Google account or other devices), cached results for 7 days, and your 50 most recent checks (for an image check, a small thumbnail of the image). Uninstalling Enlight deletes them. You can clear the cache in settings and the history in the side panel.

Your account (hosted checks only)

Signing in with Google gives Enlight your Google account ID and email address, and nothing else (the request asks only for openid and email). The service stores them with your plan, your subscription’s state and billing period, how many checks you have used in the period, and a hashed copy of each sign-in’s session token with the device label and dates. Payments are handled by Stripe: Enlight never sees your card number, and keeps Stripe’s customer ID. You can sign out of one device or all of them, and Delete account in settings cancels your subscription and deletes all of this. Stripe keeps its own records of past payments, as the law requires of it. In the extension, your session token is stored on your device like an API key would be (not synced).

What Enlight collects

Nothing beyond the account data above, and only if you use hosted checks. There is no analytics. If opt-in analytics are added later, they will be anonymous event counts only (check run, verdict, error type), never text, URLs or keys, and off unless you turn them on.

Permissions

Enlight only reads a page, or takes a screenshot of it, when you ask for a check on it (activeTab), and has no access to websites otherwise. It can also reach Enlight’s own service, for sign-in and hosted checks, and open Google’s sign-in window (identity).

Contact

Open an issue on Enlight’s GitHub repository.