Privacy policy
This policy explains what Tangy collects, where it is kept, who handles it, how long we keep it and what you can do about it. Tangy has two parts, and they work differently: the Tangy extension for Chrome, and this website (tangyassistant.com), including the optional website account. “We” and “Tangy” mean the developer of Tangy.
In short
- The extension has no Tangy server. Your chats, memory, settings and API key stay on your computer.
- The website stores personal data only if you create an account: your email, a scrambled password, and an optional name.
- We do not sell your data, show ads, track you across sites or use your data to train AI.
- You can delete your account yourself, at any time, from the account page.
Part 1: The Tangy extension
Kept on your computer only
Your chat history, facts you ask it to remember, usage counts, settings and your API key live in Chrome’s extension storage on your device. Nothing is sent to Tangy’s developer. You can turn history off in Settings, and delete everything from Menu, then Privacy, then “Delete everything Tangy stored”. Uninstalling the extension also removes it.
What leaves your computer
- Your messages, plus page text, selected text, files, and bookmark or history results that you choose to include or that a question needs, are sent to the AI provider you picked in Settings (Anthropic, Groq or Google Gemini), using your own API key, under that provider’s own privacy terms. Tangy reads a tab only when you ask.
- Your API key is sent only to the provider it belongs to, as the login for that request.
- Voice input uses Chrome’s built-in speech recognition, which sends your audio to Google’s speech service to turn it into text. Tangy never receives, records or stores the audio, only the text. Read-aloud uses the voices on your device.
- Commands such as “search for …” open a Google or YouTube results page in a new tab, so your search words go to that site exactly as in a normal search.
Permissions and why
- sidePanel: shows the Tangy panel.
- storage: keeps your settings, history, memory and key on your device.
- activeTab and scripting: read the page you are on, and scroll it, only when you ask.
- contextMenus: the right-click actions (ask, explain, summarise, rewrite, translate).
- alarms and notifications: set reminders and show them when due.
- tabs, tabGroups (optional): list, switch, group and close tabs, only if you press Allow in Settings.
- bookmarks, history (optional): find and add bookmarks and search your history, only if you press Allow in Settings. Results are shown on your computer and sent to your chosen AI provider only if your question needs them.
- Address-bar keyword “tg”: a shortcut to ask Tangy from the address bar.
- Host access to api.anthropic.com, api.groq.com and generativelanguage.googleapis.com: to talk to the AI provider you chose, and nowhere else.
The extension does not use website accounts today. Creating an account does not connect your extension data to us.
Part 2: Website accounts
You can create a free account on the sign-up page. It is optional. If you do, we store the following in our database:
- Email address: to identify your account and log you in, and to contact you about it.
- Password, scrambled: we keep only a one-way hash (made with PHP’s standard password hashing, bcrypt). We never store the password itself and cannot read it.
- Name: only if you type one.
- News choice: whether you ticked the box to hear about Tangy news.
- Dates: when you signed up and when you last logged in.
Why we use it, and our basis: to run your account (you asked for it, so this is needed to provide it), to keep the site secure, and, only if you opted in, to tell you about Tangy news such as new features and Tangy Plus (your consent, which you can withdraw at any time by unticking the box on your account page). We do not currently send marketing emails automatically. If we start, we will send them only to people who opted in, and every email will say how to stop.
Security records
To slow down password guessing and automated sign-ups, the site briefly records failed and repeated sign-up and log-in attempts: your IP address, a scrambled form of the email used, the kind of attempt and the time. These are used only for that purpose and are deleted automatically after about a day. The clean-up runs when people sign up or log in, so on a very quiet site it can take a little longer.
The log-in cookie
If you sign up or log in, the website sets one cookie called tangy_sid. It only keeps you logged in, cannot be read by scripts on the page, is sent only to this website, and is a session cookie that goes when you close your browser or log out. The matching session record is kept on our server. We set no other cookies.
How long we keep it
- Account details: until you delete your account.
- Security records: about a day.
- Emails you send to us: as long as needed to help you, then deleted.
Deleting your account
Log in, open the account page, type your password and choose “Delete my account”. This removes your email, name, password hash and dates from our live database straight away. Our hosting provider may keep routine backups for a limited time, so copies can remain there until the backup is overwritten, and we do not use backups for anything else. If you cannot log in, email support@tangyassistant.com and we will delete the account after checking that it is yours.
Not available yet
Email verification and automatic password reset are not built yet. This means we have not confirmed that an email address belongs to you, and if you forget your password you need to email us. Please use a real address and a password you do not use elsewhere.
Part 3: This website in general
- Server logs: our hosting provider, Hostinger, keeps standard logs of requests to the site (such as IP address, time, page and browser type) to run and protect its servers. We do not use them to profile visitors. How long they are kept is set by Hostinger’s own policies.
- No third parties on the pages: the site loads no analytics, ads, trackers, social buttons, third-party fonts or third-party scripts.
- Links: if you follow a link to another site, such as the Chrome Web Store, that site has its own privacy practices.
Who handles your data
- Hostinger: hosts the website, the database and our support mailbox, and processes that data for us on our behalf.
- Your chosen AI provider (Anthropic, Groq or Google): receives what you send from the extension, under its own terms and as the controller of that data. We never see it.
- Google (Chrome): provides Chrome’s speech recognition for voice input.
We do not sell, rent or share personal data with anyone else, and we do not use it for advertising or to train AI. We may disclose data if the law requires it.
Where your data is stored
Website account data is stored on servers operated by Hostinger. These may be in a country other than yours, and data may move between countries to run the service. We rely on Hostinger’s own safeguards for this. Your extension data stays on your own computer.
How we protect it
- The site is served over HTTPS.
- Passwords are stored only as bcrypt hashes.
- Log-in and sign-up are rate-limited, and error messages do not reveal whether an email has an account.
- The log-in cookie is HttpOnly and SameSite, and requests from other websites are refused.
- The server’s private files, such as the database settings, are blocked from public access.
No system is perfectly secure. If a breach affects your personal data in a way that could harm you, we will tell the people affected and the authorities as the law requires.
Your rights and choices
Depending on where you live (for example under India’s Digital Personal Data Protection Act, 2023, or the EU or UK GDPR), you may have the right to see, correct and delete your data, to withdraw consent, to ask for a copy, and to complain to a data protection authority. You can change your name and news choice, log out or delete your account yourself on the account page. For anything else, email support@tangyassistant.com. We aim to reply within 30 days. You can also remove extension permissions at chrome://extensions and delete extension data in Tangy’s Settings and Privacy pages.
Children
Website accounts are for people aged 18 or over, or the age of adulthood where you live. The Tangy extension is not directed at children under 13, and we do not knowingly collect data from children. If you think a child has made an account, email us and we will delete it.
If Tangy Plus launches
A hosted option would send your requests through a Tangy server to an AI provider. That would be a real change from today, when the extension has no Tangy server at all. Before it launches, this policy will be updated to say exactly what that server receives, how long it keeps it and who processes it. You will always be able to keep using your own key instead.
Changes and contact
If this policy changes in a way that matters, we will change the date above and, for account holders, put a notice on the site. Questions, requests or complaints: support@tangyassistant.com.