Why First Privacy Policy

Why First is a local-first browser extension: what you browse never reaches us. This policy describes the five things that do leave your device or reach our services — a daily anonymous version check, the Pro license requests, the optional AI reader, the account and order records created when you buy something, and the payments our merchant of record processes on our behalf.

What stays in your browser

By default everything the extension keeps stays in your browser's local extension storage (browser.storage.local), and none of it is sent to us:

• The list of sites and URL rules you configure.
• The short intent notes ("reasons") you optionally write during a check-in.
• Raw usage statistics: visit counts and time spent per rule, per day.
• Local-only extras: your judgement ratings, the day's exception allowance, and the signed Pro credential described below.

We do not operate a browsing-data backend: we receive no domains, no URLs, no notes, no page content and no browsing statistics from the extension, and we hold no browsing history about you.

Anonymous daily version check

Once a day, the extension sends a single request to our service to check whether a newer version is available. That request carries three fields: a random installation ID generated on your device (not a hardware fingerprint), the extension's build version, and the browser family (Chromium or Firefox). It carries no account, credential, domain, URL, note, page content or browsing data of any kind.

Our service stores, per UTC day, a salted hash (HMAC-SHA256 with a server-side secret) of the installation ID together with the browser family and the version, so it can count daily active installations and 30-day retention. The hash means the service can recognise the same installation across days — that is what retention counting requires — but the raw installation ID is never stored on the server. The record contains no browsing data and is not linked to any account, order or license.

Choosing "Clear all data" in the extension's settings deletes the installation ID. The next check generates a new random ID, so the service cannot associate the old records with the new one — the installation appears as a brand-new install. There is no user-facing toggle for the check itself; a build with no hosted service origin configured sends nothing at all.

What the extension can see

When you navigate to a site you have configured a rule for, the extension sees the domain and URL path you are heading to, in order to decide whether to show the check-in page. It never reads page content, form fields, cookies, or anything you type into other websites.

The AI reader (optional, off by default)

The AI reader judges whether the note you typed matches the site you are opening. It is off by default, and nothing is sent while it is off — the local checks run instead. When you switch it on and a note is being judged, the extension sends your note, the domain, and any site note or site agreement you wrote for that site to the AI endpoint you chose:

• Your own provider or endpoint (you supply the API key): the request goes straight from your browser to that provider, and never passes through Why First.
• The judgement service Why First ships (api.whyfirst.app, which forwards each judgement to TypeSafe, our AI provider) or a judgement run through your Why First account: the request reaches our judgement service and is forwarded to TypeSafe for an answer.

Our judgement service stores the accounting of a judgement — how many judgments it spent, when it ran, which provider answered — and deliberately does not store the note text, the prompt or the verdict. The extension shows you which of these destinations is in force before anything is sent, and never sends your browsing history, a URL, or a page's contents.

Zero Model Training Guarantee: User-entered intent notes, reasoning prompts, and domain parameters transmitted to our hosted evaluation endpoint are processed strictly ephemerally for real-time inference. They are never stored, logged as training corpora, or used to train, fine-tune, or improve any proprietary or third-party AI models.

What we keep when you buy something

Buying Pro or AI intent judgments requires a Why First account, identified by your email address and protected by a password. An account exists so that an order, an entitlement and a judgment balance can belong to someone. It holds:

• Account details: your email address and the name you gave at sign-up.
• Sign-in sessions: a session record per sign-in, with the IP address and user-agent string it was created from, so a session can be revoked.
• Orders: one row per completed payment — the product, the amount and currency, the payment partner's transaction and customer identifiers, and whether the order was refunded or charged back.
• Entitlements: which purchase (or manual grant) currently grants you Pro.
• AI intent judgments: your balance, an append-only ledger of every movement (grants, spends, reversals), and the usage accounting of judgements that ran through us.
• Payment events: the payment partner's own webhook payloads, kept verbatim for audit and cleared to an empty payload 30 days after the event is settled; a hash of the original payload is kept.
• Operator audit records: which member of staff took an action, on whose account, and why — required for balance adjustments and account suspensions.

None of it contains a domain, a URL, an intent note, a page or a visit. Deleting a rule, a note or your statistics never touches these records, and vice versa.

Payments and the merchant of record

Pro and AI intent judgments are sold through our payment partner, Creem, acting as the merchant of record. It sells to you on its own hosted checkout page, collects and remits tax, issues the receipt, and keeps the order, customer and refund records that consumer and tax law require it to keep; that processing is governed by its own privacy policy. We never see or store your card details.

When our checkout can prefill the payment page, we send the partner the email address on your account. The payment partner's records and ours are joined by the order and transaction identifiers, so a refund reported by the partner is matched to the purchase it belongs to — which is how a refund reverses the entitlement and any judgments the purchase granted.

Pro entitlement and offline verification

When you purchase Pro, your entitlement is credited directly to your Why First account upon checkout. When you sign in to the extension, our server verifies your account entitlement and issues an offline-verifiable, cryptographically signed credential that is saved in your browser's local extension storage.

The signed credential carries an offline grace period — 60 days by default, configurable between 30 and 90 days, counted from the last successful issue. While you are offline, Pro keeps working for that period. Past it, and until the next successful check, Pro features switch off and the extension falls back to Free; your rules, statistics and notes are never deleted, and one successful check restores Pro.

While you are online, the extension refreshes in the background, normally about once a week or two. If you sign out or clear your data, the stored credential is wiped from local storage. Refunded or revoked purchases stop working at the next successful sync, which is why we do not promise an exact revocation time.

Cross-device sync

The extension's optional cross-device sync of rules and settings is built but not offered in this release, so no rules or settings leave your device for another one today. If we enable it, it will use your browser's own sync service (Google for Chrome, Mozilla for Firefox) under your browser account's terms, it will carry rules and settings only, and browsing history, intent notes and statistics will never be part of it. Why First is not part of that exchange and cannot read the synced data.

Third parties

• Our merchant of record sells Pro and AI intent judgments, collects tax, and keeps order and customer records as tax and consumer law requires. It receives the email address on your account when its checkout can prefill it, and nothing about your browsing.
• Our AI provider (TypeSafe) receives the note, the domain and any site note or site agreement for judgements that run through Why First, in order to answer them. We have no agreement with it that would let us identify you by your browsing, and we send it no account identifier.
• Your own AI provider or endpoint, which you configure yourself and which receives your note directly from your browser. You supply its key, and its own terms govern that request.
• Your browser vendor, only if cross-device sync is ever switched on.

Retention

• Browsing data: never on our servers, so there is nothing for us to retain.
• Account, order, entitlement and judgment records: kept while your account exists, and order records for as long as tax and consumer-protection law requires.
• Payment event payloads: cleared 30 days after the event settles; the payload hash remains.
• The judgment ledger and operator audit records are append-only by design: a correction is a new entry, never an edited one.
• Sign-in sessions: until you sign out, the session expires, or an operator revokes it.

Your controls and your rights

• Delete any rule, note, statistic or rating from the extension's settings at any time.
• "Clear all local data" in Settings removes everything the extension has stored, including the local Pro credential.
• Uninstalling the extension removes all locally stored data.
• Write to support@whyfirst.app to ask about your account data: a copy of what we hold, a correction, or the deletion of your account. We will answer within 30 days. Where an order must be kept for tax or consumer law, we will say so and keep only that record.

Contact

Questions about this policy, the product, a purchase or your account data all reach the same address: support@whyfirst.app.

Changes

We may update this policy. Material changes will be noted in the extension's changelog and on this page with a new "Last updated" date.