Loading
Loading
Your chats stay on your device. We store only what Fudici needs to work.
| Data | Where it lives | Why | How long | Who can see it |
|---|---|---|---|---|
| Raw agent step text | Extension local storage only | Lets the user reveal a step later | Until the user clears it or uninstalls | User only |
| Commitment salt | Extension local storage only | Opens a content commitment | Same as above | User only |
| Watch mode on this device: the person's rules, each site an agent used with a SHA-256 digest of the conversation that first used it, when it was last used and whether it was flagged as a first time (up to 2,000 sites), the day watch began on this device, this month's agent spend, and the last 20 steps a rule would have stopped (title and one line of facts) | Extension local storage only | Shows what the rules would have stopped, as it happens | Sites: the 2,000 most recently used; hits: the last 20; until the user uninstalls | User only |
| Step counter per ChatGPT conversation or per tab an agent works in, keyed by a SHA-256 digest of the conversation id or of the tab's random session id | Extension local storage only | Numbers the steps of a conversation across page loads | The 500 most recently used conversations, until the user uninstalls | User only |
| Whether "Watch agents on every site" is on, and when you last asked to turn it on | Extension local storage only | Remembers the setting, and finishes turning it on once Chrome allows it | The setting: until the user turns it off or uninstalls; the request time: until the setting is on, the request is refused, or the setting is turned off | User only |
| Per open tab: the agent you said is working in it and the site you said it for, a random session id, and the steps from that tab in the last minute (action, site, kinds of fields, time) to limit how many a page can send | The browser's session storage for the extension only | Records steps only in tabs where an agent is working, grouped per tab | Until the tab closes, the tab leaves that site (the agent), the setting is turned off, or the browser quits; the recent steps: one minute | User only |
| Your answers to whether Fudici should have stopped a step a rule caught: the step, the rule, stop or fine, and when | Database | Shows which of your rules fit how you use your agent | Until you delete your account (a changed answer replaces the old one) | User, service |
| Your rules: a purchase over an amount, a month over an amount and a first time on a site, each on or off | Database | Lets each paired browser watch with the same rules | Until you change them or delete your account | User, service |
| Receipt body | Database | Statement, matching, verification | Until account deletion | User, service |
| Envelope, log leaf | Database, public log | Verification | Leaf permanent, receipt until deletion | Leaf public, envelope user and service |
| Device public key | Database | Verify device signatures | Until account deletion | User, service, and anyone the user shares a receipt with |
| Device name (such as Chrome on macOS) and when it was paired, last seen or unpaired | Database | Lists your paired browsers on Setup | Until account deletion | User, service, and Fudici's operator when you ask us for help with your account |
| Pairing code, kept only as a SHA-256 hash, with when it was made, when it expires (10 minutes) and when it was used | Database | Pairs one browser with your account | Until account deletion | Service only |
| Merchant record | Database | Matching | Order reference redacted after 180 days, row deleted after 24 months, except while the user's own dispute names it, which keeps it until the dispute closes | User, service |
| Ingest counts | Database | Caps what a stranger can do with a forwarding address | Today's and yesterday's; older days are removed when the next mail arrives, so a user who gets no more mail keeps their last counts until the account is deleted | Service only, and the user in their export: per day, how many messages, LLM calls and failures, and how many records per sender domain |
| Email body | Not stored | Extraction only | Dropped after extraction | Service during processing |
| Card transactions at merchants the user's agents dealt with | Database | Matching | Raw description redacted after 180 days, row deleted after 24 months, with the same dispute exception | User, service |
| Card transactions at other merchants | Not stored. Never leave the browser. | None | None | User only |
| Email address | Supabase Auth | Login, statements, alerts | Until account deletion | User, service, and Fudici's operator as a masked address (k***@outlook.com) |
| Help we gave your account: what was done (such as unpairing a browser you asked us to unpair), when and why, from a fixed list | Database | A record of each time we looked up or changed your account | 24 months; the link to your account is removed when you delete it | User (in the export), Fudici's operator |
| Product events | Database, allowlisted names | Measure statement opens and flag reviews | 13 months | Operators, and the user in their export |
| A shared receipt, as the link holder sees it | Database | Lets someone the user chooses verify one receipt | Until the link expires or is revoked (at most 365 days) | Anyone with the link: the signed receipt and the device details needed to check it, never the user's email or user id |
| Signed monthly statement | Database, and as a PDF in a private storage bucket | Lets the user show what their agents did in a month | Until account deletion | User, service, and anyone the user gives it to: the month, a display time zone, every action of the month with its time, assistant, site, amount, status and match, the totals, flag counts and a Merkle root over the month's receipts; never the user's email, user id or chat text |
A shared receipt shows its holder the signed body (merchant domain, amount, date and summary) and what checking the signatures needs: the device key id, which is the same for every receipt the device signs, so two shared receipts show they came from one device; the receipt's sequence number; the session tag, which two receipts from one conversation share, or for steps recorded on any site two steps from one tab; the device time; which agent and how the extension knew (the agent's own page, its tab group, or the person's own choice for that tab), and the model when the agent's page showed it; the extension version; and when the device was registered or revoked.
Someone you give a statement PDF to sees the time of each action, so they can tell which entries in the public log are yours. Log entries show when each receipt was logged, but no content, amounts or account.
| Provider | What they process | Why |
|---|---|---|
| Supabase | All server-side data | Database, auth, functions, storage |
| Vercel | Web requests | Hosting |
| Cloudflare | Forwarded emails in transit | Inbound email routing |
| Resend | Email address, statement email content | Outbound email |
| LLM provider for extraction | A redacted excerpt of a forwarded email when deterministic parsers fail: sender domain, subject, and lines with amounts, order numbers or dates | Merchant field extraction |
| OpenTimestamps calendars | Checkpoint hashes only | Anchoring |
When our own parsers cannot read a forwarded email, an AI provider sees a short redacted excerpt, never the whole email. We use only a provider that has agreed not to store or train on it.
You can export or delete everything yourself. Deleting removes every row and file tied to your account. Copies in our backups expire within 7 days, and restoring a backup never brings deleted data back.
Download everything gives you one file with every record in your account. You need to be signed in.
Delete everything removes your account and all of it at once. You need to be signed in.
Entries in the public log remain. They show when each receipt was logged, but no name, email, account or content, and removing them would break the proofs of every other user.
Unless you turn on the setting below, the extension reads only chatgpt.com. It sends Fudici a short record of each step your agent takes there, such as the site, the action, any amount and how it ended. What you and the agent wrote stays on your device.
A setting in the extension, "Watch agents on every site", is off until you turn it on. Turning it on asks Chrome for permission to read every https site, to add Fudici's reader to those pages, and to see the names of your tab groups; turning it off gives the permission back. Even then Fudici records nothing unless an agent is working in the tab, as far as it can tell: the tab is in a group named after an agent (such as "Claude" or "ChatGPT"), or you marked the tab in the extension, which keeps it marked on that site until you unmark it, leave the site or close the tab. Fudici does not record other tabs. In those tabs it reads which kinds of fields a submitted form had, such as an address or a card, never what was typed, and the page headings to spot a confirmation page. It sends Fudici the site, which agent and how Fudici knew (its tab group, or you said so), the action and how it ended. The agent you choose for a tab, from a fixed list, is signed into each step and shown to anyone you share it with. There is no field to type a name, so a name you might give it is never signed.
We never sell this data, use it for advertising or lending, or let people read it except to keep the service secure, to help you when you ask, or when the law requires it. To run Fudici we count steps, sites and answers across all accounts. A site or a group of accounts shows only when at least 3 accounts are in it, and no steps, sites or agents are ever shown for one person. To help you, Fudici's operator sees your account as a masked email, the day it joined, how far it got (signed up, paired, recording, answering), its number of paired browsers, the day it was last active and the extension version.
The use of information received from the Fudici extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.
We record 7 kinds of events with your account, and nothing else. No third-party trackers.
Write to support@fudici.com.
Last updated 2026-10-22