TextPhantom Privacy Policy

When you translate

• The images you choose to translate and the address of that page go to the TextPhantom API server set in the extension (Tools › Advanced › Custom API URL). If you have not set one, the TextPhantom server at api.kuju29.com is used; that address is carried by Cloudflare and the server runs on Hugging Face.
• Auto-translate (2026.10.29.3): after you turn on “Auto-translate in this tab” and press ▶ in a tab, the images and address of each page that tab then shows on the same site are sent the same way as when you translate, without pressing on each page. It stops when you press ⏹, reload the page or the tab goes to another site. Other tabs and other sites are not sent. The switch is off by default.
• The page address is used for two things only: so the server can load the image from that site (some sites need to know which page an image belongs to), and to keep each story’s context apart when translating with AI.
• The server passes the image to Google Lens to read the text in it. The image is kept in a temporary file only while the text is read, then deleted.
• Translations kept for reuse (the cache) stay on your device. The server also keeps recent results in memory for a short time so the same image is not read twice; they are gone when the server restarts.

When you translate with AI

• The recognised text, the target language and your translation style go to the AI you choose. If you turn them on, Story memory (names, terms and a short summary of earlier pages of the same series, kept in this browser) and the page image (“Send page image to AI”) go with it.
• Your own API key (Manual): the request goes through the TextPhantom API server to that provider (for example OpenAI, Anthropic, Google, DeepSeek, Groq, Together, Featherless, Hugging Face or OpenRouter). Your key goes with each request so the server can call that provider; it is used for that request only and is not stored (the server keeps only a one-way fingerprint of it, to keep different keys’ results apart).
• A model on your own computer (Local, for example Ollama or LM Studio): requests go straight from your browser to that program on your computer; the AI step does not go through the TextPhantom server.
• Paid: the text goes from the TextPhantom API server to the TextPhantom account service, then to OpenRouter, which passes it to the company that runs the model you picked. The finished translation is kept encrypted for 15 minutes, so a dropped connection can still collect it, then erased.
• Login (your own AI website account): see “Login” below.

Install ID

The extension creates one random ID per browser profile and attaches it to translation requests, so the server can limit how many requests one device makes and give the free trial credits once per browser. It is not made from your data and is not linked to your name or email. A copy is kept in the browser’s sync storage: if browser sync is on, your other computers signed in to the same browser account get the same ID.

Your IP address

Like every internet request, yours carry your IP address. Cloudflare and the TextPhantom servers use it to limit request rates and stop abuse. The account service keeps only a keyed one-way fingerprint of it, to limit sign-in codes and free trials per network. The API server does not write IP addresses to its logs.

Menu language

If you choose a menu language other than English, the extension’s menu text is translated with Google Translate. Only the menu text is sent — no images, email or account data. Text that is already written in Thai (such as this page and the permission screen) is not sent for translation.

Other services the extension contacts

• MangaDex: on MangaDex pages the extension reads the chapter’s information from MangaDex’s public API (it sends the chapter ID).
• Model prices and exchange rate: when you open Usage, the extension reads the public price of the chosen model from OpenRouter or Featherless (it sends the model name) and the USD/THB rate from Frankfurter. No personal data is sent.
• The site you translate: the extension loads the image from that site, as your browser already does.

Paid (TP credits)

• When you sign in to Paid, your email, credit balance and purchase history are kept by the TextPhantom account service.
• Sign-in codes are emailed to you through Resend. The admin may also email you about your account or announcements about the service.
• Each Paid translation records its time, model, token counts and cost, to charge and refund credits. The text is not recorded.
• The account service keeps one-way fingerprints of your install ID and the browsers you sign in with, to apply the free-trial and refund rules once per browser.
• You pay on Stripe’s page. Card details never pass through the extension or our servers.
• Sent only after you agree (Agree and start).

Login (your own AI account)

• Gemini and DeepSeek: that website’s sign-in cookie goes only to the TextPhantom API you use, and only for your own translation requests.
• The extension never asks for or stores your password.
• Claude and ChatGPT: requests go from your browser to that website directly; your TextPhantom account verifies that it is you. If you sign in to ChatGPT through OpenAI’s page, the token it gives is kept in this browser.
• OpenRouter and Hugging Face: you sign in on that website’s own page; the key it grants stays in this browser, translation requests go from this browser to that website, the TextPhantom API sees only an account reference, and you can revoke it on that website.
• Sent only after you agree (Agree and start).

Chat with the admin

• Messages and files you send are kept by the TextPhantom account service.
• The admin reads them to reply to you.
• Sent only after you agree. Before that, “Contact admin” is grey and no chat button appears on web pages.

When we ask you to agree

• The first time you open the TextPhantom window (the toolbar icon) you see “Before you start” in that window; no new tab opens (Firefox and Thunderbird open it as a tab after installing). You agree once; people who used an earlier version see it once after updating. It is not asked again unless the extension changes what it sends, to whom or why.
• “Not now”: nothing is sent and the extension stays off. Next time you see a small card with “Review and agree” instead of the whole screen again.
• Before you agree, the extension sends nothing at all. If you translate on a web page first, the TextPhantom window opens so you can agree (Firefox and Thunderbird open a tab); then translate again.
• “Agree and start” covers translation and account data together, so no permission screen pops up later when you use Paid, Login or chat.
• Firefox: the browser also asks about account data in its own prompt. If you decline there, translation still works, but the Paid, Login and chat buttons are grey (second picture); clicking one asks again. “Sign out” always works.
• You can withdraw in one click in Tools › Privacy & data in the TextPhantom window, or under “Your choice” below. After that the extension sends nothing and asks you to agree again before you use it.

Diagnostic logs

• Off by default. The switch is in Tools › Advanced, under “Custom API URL”: “Send diagnostic logs to the API server”. Hover its name to see the explanation.
• When it is on, error and timing logs go to the API server.
• Logs never contain passwords, tokens, cookies or full email addresses.

On your device only

• All your settings.
• The API keys you enter (a key is sent only with your own translation requests, so the API server can call the AI you chose; the server does not keep it).
• Login keys and tokens (OpenRouter, Hugging Face, and ChatGPT signed in through OpenAI).
• Story memory and translations kept for reuse.
• The names of fonts on this computer (read to let you pick a font, never sent).

Who receives what

How long it is kept

Security

• Everything is sent over HTTPS. The extension refuses to send account data or your API key over unencrypted HTTP to another computer.
• Secrets the account service must keep (such as keys of connected services, and Paid results) are encrypted. Sign-in codes are checked against a keyed one-way hash and never kept in plain text.

What we don’t do

• We don’t sell your data.
• We don’t use it for ads.
• We don’t track your browsing; the extension knows only the address of the pages you translate (with auto-translate, the pages of that site the tab shows after you press ▶).
• No person reads your data, except the admin reading chat messages you send and diagnostic logs you turned on, or when needed for security or by law.
• We don’t share data with anyone not listed on this page, unless the law requires it.
• Chrome Web Store Limited Use:

The use of information received from this extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

Contact and deletion

Email plan291037@outlook.com to see, correct or delete your account data.

Withdrawing stops new sending at once. Data already sent is removed on the schedule under “How long it is kept”; account data is deleted when you ask.

Changes to this page

If what is sent, to whom or why changes, we update this page and its effective date, and the extension asks you to agree again. This page is also published at https://api.kuju29.com/privacy (the same text).

Permissions the extension asks for

Your browser lists these when you install. This table says what each one is used for.