Summary: SimpleReview collects only the minimum data needed to function: a session token stored locally on your device to avoid repeated logins, and the element context you explicitly choose to review. Your data is never sold or used for advertising. AI processing runs via Codex (OpenAI) through the platform's subscription — no browsing history or page content is collected outside of what you explicitly select.
The following table describes each category of data SimpleReview collects, its purpose, and legal basis under GDPR:
| Data | Source | Purpose | Legal basis (GDPR Art. 6) | Storage |
|---|---|---|---|---|
| JWT session token (authentication token after Google Sign-In) | Issued by our server after you authenticate; sent from the terminal page via postMessage |
Allows the extension to reopen your AI terminal session without requiring you to log in again each time | Performance of a contract (Art. 6(1)(b)) | chrome.storage.local on your device only; never sent to third parties; cleared when you uninstall the extension or it expires |
| Element context (tag name, text, CSS path of the element you click "Fix it" on) | Collected only when you explicitly click the "Fix it" button on a specific element | Builds the review prompt sent to the AI; includes tag, visible text, and DOM path of the selected element only | Performance of a contract (Art. 6(1)(b)) | Stored temporarily in chrome.storage.session (cleared when the browser session ends); transmitted to our AI terminal as part of the prompt |
| Page URL and title (of the tab where you click "Fix it") | Active tab, only when you click "Fix it" | Included in the review prompt so the AI understands the context of the element | Performance of a contract (Art. 6(1)(b)) | Transmitted to our AI terminal as part of the prompt; not stored independently |
| Screenshot (visible viewport of the page at the moment of "Fix it") | Captured via html-to-image library only if the page's Content Security Policy allows it; skipped silently if blocked |
Gives the AI visual context to identify layout or design issues | Performance of a contract (Art. 6(1)(b)) | Uploaded once to op.wpmix.net/upload (public temporary storage); URL appended to the AI prompt; not linked to your account |
| Google account email and display name | Google Sign-In (OAuth 2.0), only when you authenticate in the side panel | Authentication and workspace identification in the AI terminal | Performance of a contract (Art. 6(1)(b)) | Stored on our server linked to your workspace; retained until you delete your account |
| IP address (from server access logs) | Automatically when you connect to our service | Security monitoring and abuse prevention | Legitimate interest (Art. 6(1)(f)) | Server access logs retained for up to 14 days, then automatically deleted |
We do not collect: browsing history, content of web pages you visit (beyond the single element you explicitly select), location data, microphone or camera data, or financial information.
host_permissions — it cannot access arbitrary websites you browseSimpleReview requests the following permissions and uses them strictly as described:
chrome.storage.local) and temporarily buffers element context (chrome.storage.session).The extension has no host_permissions declared in its manifest. It does not have blanket access to websites you visit.
SimpleReview does not use tracking cookies or advertising cookies. The extension uses:
| Service | Data Shared | Purpose | Location | Their Privacy Policy |
|---|---|---|---|---|
| OpenAI (Codex) | Your review prompt (element context + page URL). AI processing runs through the platform's Codex subscription. | AI-powered code fix generation | USA | openai.com/policies/privacy-policy |
| Anthropic (Claude) | Your review prompt, if you select Claude as the AI agent | Alternative AI-powered code fix generation | USA | anthropic.com/privacy |
| Google OAuth | Email address and display name (from Google account, on sign-in) | Authentication in the AI terminal | USA | policies.google.com/privacy |
| op.wpmix.net (our service) | Screenshot image (JPEG, visible viewport only), if captured | Temporary public URL for screenshot in AI prompt | Finland, EU (Hetzner) | This policy |
| simpledashboard.wpmix.net (our service) | Review prompt, session JWT, element context | AI terminal — executes the code fix in your isolated workspace | Finland, EU (Hetzner) | This policy |
chrome.storage.local until it expires or you uninstall the extension.chrome.storage.session — cleared when the browser session ends (typically on browser close).op.wpmix.net; not linked to your identity; may be purged after 7 days.If you are located in the European Economic Area (EEA), you have the following rights under GDPR:
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
The lead supervisory authority for OnOut OÜ (Estonia) is the Estonian Data Protection Inspectorate (aki.ee).
SimpleReview is not directed at children under 13. We do not knowingly collect personal data from children.
We may update this policy to reflect changes in our practices or legal requirements. The "Last updated" date at the top will reflect any changes.
Data controller: OnOut OÜ
Trading name: NoxonThemes
Country of registration: Estonia, EU
Email: [email protected]
Website: onout.org