Privacy Policy

• Account. Every visitor gets an anonymous guest account on first visit, identified by a random ID. If you add an email address, we store it to sign you in with a magic link. There are no passwords and no social logins.
• Your provider API keys and tokens. Barlow runs on your own Google, OpenAI, and Anthropic credentials. They are encrypted at rest with AES-256-GCM and are decrypted only for the moment a request is sent to that provider on your behalf. They are never shown back to you in full, never shared with other users, and never used for anything other than your requests.
• What you make and ask. Prompts, chat messages, generated images and videos, images you upload, and video frames you capture in the extension are stored so you can come back to them.
• Usage records. For each request we keep the model, token counts, and an estimated cost so the Usage page can show you what your keys are spending. We do not bill you; there is nothing to pay Barlow.
• Technical data. Standard server logs, a Cloudflare Turnstile check when a guest account is created, and anonymous page analytics from Vercel. We do not use advertising trackers.

The extension only runs on three sites, and does one specific thing on each:

• youtube.com. It adds a panel beside the video. When you ask a question it reads the video's URL and title, the caption transcript from your own YouTube session, the playback position, and any frames you capture with the camera button or paste or drop into the panel. These are sent to barlow.ai and from there to the AI model you chose. The transcript is used for that answer and is not stored; your question, the answer, and captured frames are saved to your chat history.
• arxiv.org. It offers a side panel for the paper you have open. The paper's URL is sent to barlow.ai, which fetches the PDF from arXiv and passes it to the model with your question.
• barlow.ai. It mirrors your sign-in session into the extension so you do not have to sign in twice. Your provider API keys never leave the server and are never visible to the extension.

The extension does not read any other website, does not read your browsing history, and does not run in the background on pages it is not built for. It has no analytics of its own.

• AI providers. Your prompts, attached images, frames, PDFs, and transcripts are sent to Google, OpenAI, or Anthropic, whichever model you picked, using your own key. Their handling of that data is governed by their terms for your account, not ours.
• Infrastructure. Barlow runs on Vercel, Google Cloud (storage and compute), and Supabase (database). Emails are sent through Resend. These providers process data only to run the service.

We do not sell your data, share it with advertisers, or use it to train models.

• Guest accounts that have not been used for 30 days are deleted, along with everything in them.
• Accounts with an email address are kept until you ask us to delete them.
• You can delete individual canvases, images, and chats at any time from inside the app.
• Removing a provider key from your Account page deletes it from our database immediately.

• Use Barlow as a guest without ever giving an email address.
• Remove the Chrome extension at any time from chrome://extensions. It leaves nothing behind in the browser except what Chrome itself keeps for any extension.
• To delete your account and everything in it, or to ask anything about this policy, send a message from the feedback page and we will take care of it.

If this policy changes in a way that matters, the date at the top will move and the change will be described here. Continuing to use Barlow after that means you accept the updated policy.