Last updated: 24 September 2026
This policy explains what the Quessa browser extension and its backend service collect, why, who it is shared with, and how to get it deleted. It applies to the Quessa extension and the service running at this domain, operated by Quessa ("we", "us").
| Data | Why |
|---|---|
| Email address | Identifies your account and is how we contact you about it. |
| Google account email (only if you choose "Continue with Google") | Google confirms your email address to us so you can sign in without a password. We request only the openid, email and profile scopes, and we use nothing from your Google account beyond the verified email address. |
| Password | Stored only as a salted PBKDF2 hash. We never store, log, or transmit your password in readable form and cannot recover it. |
| Plan / role | Determines your daily question allowance (free, pro, or VIP). |
| Stripe customer & subscription ID | Links your account to your subscription so billing works. |
| Account created / last sign-in timestamps | Account administration and abuse investigation. |
| Data | Why |
|---|---|
| Number of questions answered per day | Enforces your plan's daily allowance. We store a count, not the questions. |
| Question content and surrounding page text | When you ask for help with a question, its text (and the answer choices shown with it) is sent to our server and forwarded to OpenAI to generate an explanation, together with any extra instructions you have written in the panel. Nothing is sent until you ask. See section 2. |
| Screenshots you select | If you use the Screenshot tool, the area of the visible page you select is sent to our server and forwarded to OpenAI so it can read the question. Only the area you select is sent, only when you use the tool, and it is not stored by us. |
| IP address | Rate limiting on sign-in, registration, and administrative endpoints, to prevent brute-force and automated abuse. Held only as a counter against a short rolling window, and overwritten as that window rolls. |
| Signed-in devices | Each sign-in creates a session record holding the time, and a one-way scrambled form of your IP address and browser identification string. It is what limits how many devices can use one account at the same time, so that a paid account is not shared with a group. Deleted when you sign out, when it is replaced by a newer device, when you reset your password, when you delete your account, or after 30 days unused. |
| How many networks an account is used from each day | Stored as a one-way scrambled form of the IP address — a count of distinct networks, never a list of places you have been — to detect one account's credentials being shared. Deleted after 7 days. |
| Service | What it receives | Why |
|---|---|---|
| OpenAI | The text of the question you asked us to help with, along with any surrounding page context the extension collected to answer it accurately, or the screenshot area you selected. | Generates the answer. Governed by OpenAI's privacy policy and API data-usage terms. |
| Stripe | Your email address and subscription status. | Processes payments. Card details are entered directly with Stripe and never reach our servers — we never see, store, or transmit your card number. |
| A sign-in token, only if you use "Continue with Google". | Confirms your email address. We send the token to Google to verify it and do not store it. | |
| Cloudflare | Standard request metadata, including IP address, as our hosting and database provider. | Runs the service and protects it from abuse. |
We do not sell your personal information. We do not share it with advertisers, data brokers, or analytics networks. We do not use it to build advertising profiles. We share it only with the processors above, and only to operate the service — or where we are legally required to.
The use of information received from the Quessa extension, and from Google APIs, adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. In particular: we use the data only to provide the extension's single purpose (explaining and helping with the questions you ask about); we do not transfer it except as described above to operate that purpose, to comply with law, or as part of a merger or acquisition; we do not use or transfer it for personalised advertising; we do not use or transfer it to determine creditworthiness or for lending; and no human reads it except with your explicit consent, for security investigations, or to comply with law.
Some data is stored locally in your browser and is never transmitted to our servers:
| Permission | What it is used for |
|---|---|
| Site access (a fixed list of learning platforms) | The extension works on a set of learning-platform domains (for example Canvas, Blackboard, Moodle, Brightspace, Open edX and McGraw Hill) so it can read the question on the page you are looking at. It does not send page content anywhere except when you ask for help. |
| Optional site access (any other site) | Not granted at install. Chrome asks you first, and only for the one site you choose to enable Quessa on. You can revoke it at any time from the popup or from Chrome's extension settings. |
storage | Saves your sign-in state and your appearance settings. |
scripting, activeTab, tabs, webNavigation |
Lets the extension place its controls on the page (including inside embedded course frames), read the question you asked it about, and capture the screenshot area you select. The tab's address is used only to decide whether Quessa is enabled for that site; it is not sent to us. |
identity | Powers the optional "Continue with Google" sign-in. |
sidePanel | Shows the Quessa panel in Chrome's side panel. |
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict its processing. To exercise any of these, email aspet.app@gmail.com from the address on your account.
Open the extension, go to Settings → Account, and use Delete My Account — this immediately and permanently deletes your account record and its associated usage history, and cancels any active subscription. There is no confirmation email and no undo window. If you would rather we do it for you, email aspet.app@gmail.com from your account's email address and ask us to delete it; we will confirm once it is done.
You can remove the extension at any time from your browser's extensions page. Removing the extension deletes everything it stored locally, but does not by itself delete your account on our servers — use the process above for that.
If you are a California resident, you have the right to know what personal information we collect and how we use it (sections 1 and 2 above), to request a copy of it, to request its deletion, and to not be discriminated against for exercising those rights — we will not degrade or withdraw the service because you made a request.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done so.
To make a request, email aspet.app@gmail.com from the address on your account. We will respond within the timeframe required by law.
Passwords are stored only as salted PBKDF2 hashes. All traffic between the extension and our service is encrypted in transit over HTTPS. Access to administrative functions is restricted and rate-limited. No system is perfectly secure, but we take reasonable measures appropriate to the data we hold.
Quessa is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has created an account, contact us at aspet.app@gmail.com and we will delete it.
If we change this policy materially, we will update the date at the top and, where the change affects how your data is used, notify account holders by email.
Quessa
Email: aspet.app@gmail.com
Governing law: California, United States