1. Who We Are

Chameo (“we”, “us”, “our”) is a language-learning platform that enriches video subtitles using AI. Our website is chameo.online. You can reach us at chameo.online@gmail.com

2. Information We Collect

Account data: email address, display name, avatar URL — collected when you create an account via email or Google OAuth.
Usage data: number of subtitle conversions and audio extractions performed, reset daily. Used solely to enforce plan limits.
API keys (BYOK): If you provide a personal Gemini or Groq API key, it is stored encrypted in our database and sent only to the respective API provider.
Vocabulary: Words you look up and save are stored in your account.
Feedback: Messages you submit via the feedback widget, including your user ID and the page you were on.
Payment data: Subscription status and PayPal subscription ID. We do not store card numbers — all payment processing is handled by PayPal.
Technical logs: Error reports sent to Sentry (anonymised) and server access logs on Railway.

3. How We Use Your Data

To provide and improve the Chameo service.
To enforce plan usage limits.
To process subscription payments via PayPal.
To diagnose errors and fix bugs.
To respond to support requests.

We do not sell your personal data to third parties.

4. Third-Party Services

Supabase — database and authentication (EU region).
Google / Gemini API — AI subtitle enrichment.
Groq / Whisper — audio transcription for extraction.
PayPal — subscription payment processing.
Railway — backend hosting.
Vercel — frontend hosting.
Sentry — error monitoring (anonymised).

5. Chrome Browser Extension

The Chameo Chrome extension collects the following data when installed:

Authentication token: The extension reads your Supabase session token from localStorage on chameo.online and chameo.app pages only. This token is stored in chrome.storage.local and used solely to authenticate requests to the Chameo backend (vocabulary saving, usage tracking). It is never sent to any third party.
Subtitle content: The text of subtitles from the YouTube video you are actively watching is sent to the Chameo backend API for AI enrichment. No subtitle data from any other page or video is accessed.
Clicked words: When you click a word in an enriched subtitle, that word and its surrounding sentence context are sent to the Chameo backend to generate an explanation. If you are signed in, the word is saved to your personal vocabulary bank.
User preferences: Language selections, CEFR difficulty level, subtitle sync offset, and enable/disable state are stored in chrome.storage.sync and synced across your Chrome devices.

The extension does not monitor your browsing history, collect data from pages other than YouTube watch pages and the Chameo web app, or track any activity outside its stated purpose.

6. Cookies & Local Storage

We use Supabase session cookies for authentication. The browser extension stores your settings and enriched subtitle cache in chrome.storage.local and chrome.storage.sync. We do not use advertising or tracking cookies.

7. Data Retention

Account data is retained for as long as your account is active. You may request deletion at any time by emailing us. Extension subtitle caches expire automatically after 7 days.

8. Your Rights

Depending on your jurisdiction you may have rights to access, correct, or delete your personal data. Contact chameo.online@gmail.com to exercise these rights.

9. Security

All data is transmitted over HTTPS. API keys are stored at rest in Supabase, which applies AES-256 encryption at the storage layer. We follow security best practices but cannot guarantee absolute security.

10. Changes to This Policy

We may update this policy from time to time. The “Last updated” date at the top of this page indicates when the most recent changes were made. Continued use of Chameo after changes constitutes acceptance of the updated policy.

11. Contact

For any privacy questions, email us at chameo.online@gmail.com.

Privacy Policy