In one sentence
Accounts, credits, and subscription services are planned for release with 2.0.0 and are not yet available to the public. The following also describes how data will be handled once these services become available.
AI Selection Translator can be used in two ways. Bring your own key: the content you want to translate is sent directly to the AI platform you configured, without going through us. Credit-based translation: the content is forwarded by our server to the model provider to complete the translation, and the server does not store the original text or the translation. Account, billing, and anti-abuse data is limited to what is necessary for operation, is not used for advertising, and is not sold.
What is sent during translation
Only when you actively trigger a translation (context menu, keyboard shortcut, or clicking the translate button) is the following content sent over HTTPS:
| Content | When | Sent to when using your own key | Sent to when using credit-based translation |
|---|---|---|---|
| The text you selected | Using selection translation | Your chosen provider | Our server, then forwarded to the model provider |
| The text inside a region you marked | When you click the translate button on the selected area | Same | Same |
| Text you type into the translation panel | Clicking Translate | Same | Same |
| Recognized text from video subtitles | When video subtitle translation is enabled | Same | Same |
| The image you choose to translate | Using image translation | The vision platform you choose | Our server, then forwarded to DeepSeek |
For your own key, you can choose OpenAI (ChatGPT), DeepSeek, and DeepL. Requests are sent to https://api.openai.com, https://api.deepseek.com, and DeepL's https://api-free.deepl.com (for paid keys, https://api.deepl.com), respectively.
Credit-based translation requests are sent to https://app.huaci.app and forwarded by the server to DeepSeek; when DeepSeek is temporarily unavailable, text translation switches to the same model on Fireworks AI (US node). Image recognition uses DeepSeek Flash. Images, recognized text, and translations remain in memory only briefly during request processing and are not written to any database or logs.
How these platforms handle the content they receive is governed by their respective privacy policies:
- OpenAI：openai.com/policies/privacy-policy
- DeepSeek：platform.deepseek.com/downloads
- DeepL：deepl.com/en/privacy
- Fireworks AI：fireworks.ai/privacy-policy
Not sent: page content you have not actively translated, browsing history, cookies, or form data. The extension does not automatically scan or upload anything in the background.
Audio handling for experimental video subtitles
Video subtitles are off by default. When enabled, audio from the current tab is recognized locally by default, which may require downloading a browser language pack; audio is sent to Google's speech recognition service only when you explicitly choose "use cloud recognition," subject to the Google Privacy Policy. The recognized subtitle text is then sent to the translation platform or our servers according to the selected translation mode. We do not receive or store video or audio, and we do not provide hosted audio/video transcription.
Account data
After registration or login, we store:
- Email and username — used for login, account recovery, and contacting you. Names, avatars, or other profile information are not stored.
- Login method — when signing in with Google, only the Google account identifier and verified email are stored.
- Login session — only the type (website or extension) and time are recorded; device model, location, and device fingerprint are not recorded.
- Credits and subscription — records of credit grants, deductions, and refunds, subscription status, and the order amount, currency, refund status, and billing country.
Usage Records
Each point-based translation records: character count, points deducted, model and provider, input and output token counts, target and source languages, duration, result (success, failure, or rejection with reason), and the two-letter country code provided by the network service provider. These records are used for billing, abuse prevention, and service statistics, and do not contain the source text or translation. You can view your records under "Usage & Points" in the user center.
Duplicate Claim Prevention for Free Trial
After installing the extension, free points are automatically claimed once. To prevent repeated claims from the same network or browser, we store: an encrypted, irreversible digest of the network address (the address itself is not stored; for IPv6 only the first 64 bits are used), and a random marker cookie written by the welcome page on app.huaci.app (only its digest is stored in the database). We do not use device fingerprints.
Payment
Subscription payments are processed by Creem as the Merchant of Record, including collection, taxes, and receipts. Payment information such as bank cards is submitted directly to Creem and is neither visible to us nor stored by us. We only store the subscription and order numbers, status, amount, currency, and billing country provided by Creem. How Creem handles your data is governed by its privacy policy (creem.io/privacy).
Cookie
- Login session — an HttpOnly cookie on
app.huaci.app, used to keep you signed in on the website. - Preferences — language and color scheme (
lang,theme), shared between the website and the user center. - Browser marker — see "Duplicate Claim Prevention for Free Trial" above.
There are no advertising cookies and no third-party analytics cookies.
What stays on your machine
The following data is stored via chrome.storage.local on your device and is not synced through your Chrome account:
- API Key — used only to authenticate with your chosen platform in request headers; it is never sent to us
- Extension login token — sent only to
app.huaci.app, used for point-based translation and account status - Preferences — target language, model in use, and individual toggles
- Regional translation rules — "domain + CSS selector" entries you add manually
You can clear all of it from the options page at any time, or simply uninstall the extension (uninstalling removes it all).
Retention and Deletion
Account, points, orders, and usage records are retained until you delete your account; transaction records required by law (e.g., for tax purposes) are retained as required. To export or delete your account and related data, email support@huaci.app, and we will process it within 30 days.
What we do not do
- We do not store the source text or translation you translate
- We do not use advertising, tracking, or third-party analytics SDKs
- We do not sell or rent your data, nor use it for advertising
- Your translation content is not used to train models
The full source code of the extension and the server is published under GPL-3.0 for independent verification: github.com/csswork/AiTranslation.
Permissions
| Permission | Why |
|---|---|
contextMenus | Provide the translate entries in the right-click menu |
storage | Stores the above settings and login token locally |
scripting | Inject the needed script into the current page when you trigger a translation |
activeTab | Act only on the tab you are working in |
tabCapture、offscreen | Reads audio from the current tab only when you enable video subtitle translation; recognized locally by default, sent to Google when you explicitly choose cloud recognition |
Access to api.openai.com, api.deepseek.com, api-free.deepl.com, api.deepl.com |
Sends translation requests to your chosen platform when using your own API Key |
| Optional access to your own API origin | Requested only if you enter a custom API base URL (a proxy or relay), and only for that single origin. The prompt appears when you click "Test connection"; it never asks for all sites |
| Content script on all sites | The user may select text or specify a translation region on any web page; the content script provides the translation entry point and only filters selections that contain no text |
Contact
For any questions or data requests, email support@huaci.app, or open an issue on GitHub Issues.