Privacy policy
Cotton is a helper in Chrome's side panel. It notices what matters on the page you're on, for your projects and goals, and helps you there. To do that it has to read what's on your screen, so this page says exactly what it reads, why, where it goes, how long it's kept, and how you delete it.
Cotton is run by Second Principle Labs Private Limited, 502 Seashell Apartments, Greenfields Complex, A. B. Nair Road, Juhu, Mumbai 400049, India. Questions about this policy or your data: hello@heycotton.app.
What Cotton reads, and why
- The page you're on. When noticing is on, Cotton reads the text of the page in front of you and takes a picture of what's on screen, so it can tell whether something there matters to your projects and goals. It does this only after you say yes on the welcome page or in the panel, only on the page you're looking at, and never in private windows. You can pause it at any time.
- Pages it never reads. Banks, health, sign-in and payment pages, plus any site you add to its list. On those, Cotton doesn't look at the page at all.
- What you ask and what you make. Your messages to Cotton, the answers, and what Cotton keeps for you (notes, lists, saved passages, reminders).
- Your projects and goals. What you tell Cotton you're working on, in your words. This is how it decides what's worth mentioning.
- Your account. Your name, email address and password (stored as a one-way hash by our sign-in provider; we never see it), the place and time zone you give us, and your plan.
- A tab's sound, only when you ask. If you turn on listening for a tab (a call or a video), Cotton turns its audio into text to help you with it. It starts only on your click and stops when you stop it or the tab closes.
- Accounts you connect, only if you do. If you connect Gmail, Google Calendar, Google Drive, Notion or another service, Cotton reads from it only what a request of yours needs. You can disconnect any of them at any time.
- Pages you've read, kept on your computer. "Remember the pages I read" keeps the words of pages you read in your browser, on your computer only, so you can find them again. They never leave it. It's on when you set Cotton up, with the switch right there to turn it off, and you can turn it off any time in Settings.
- Anything else you ask of it, only when you ask. If you ask Cotton to read other pages for you, to read messages in a chat tab you have open, or to repeat steps you show it, it reads only what that request needs, in your own browser. Passwords, card numbers and one-time codes are never recorded. If other people send you something through a link you shared from Cotton, what they send is kept in your account, for you.
- How you use Cotton. How many credits each thing used, and basic error logs, so we can bill fairly and fix problems.
What we never do
- We never sell your data, and never use it for advertising.
- We never use it to decide anyone's credit, lending or employment.
- We don't let the AI providers we use keep it or train on it (see below).
- We don't read your data ourselves, except when you ask us to help with a problem, to keep the service safe, or when the law requires it.
Cotton's use of information it receives through Chrome follows the Chrome Web Store User Data Policy, including its Limited Use requirements.
Where it goes
What Cotton reads goes from your browser over an encrypted connection to Cotton's server, and from there only to the services that do the work:
| Service | What it does for Cotton |
|---|---|
| Vercel | Runs Cotton's server (London region). |
| Supabase | Stores your account and what Cotton keeps for you (London region). |
| OpenRouter, and the AI model providers it routes to | Understands pages and writes answers. Requests are sent with data collection switched off, to providers that don't store or train on them. |
| TypeSafe | Small, quick judgments (for example, whether a page is a sign-in page). |
| Deepgram | Turns a tab's sound into text, only when you ask Cotton to listen. |
| Firecrawl and DeepSeek's reader | Reads public web pages by their address, when Cotton needs a page you're not on. |
| Composio | Connects the accounts you choose to connect (Gmail, Calendar, Notion and others). |
| Stripe | Takes payments for plans. We never see or store your card. |
| Resend | Sends Cotton's emails (codes, account and billing notices). |
| Google (sign-in and reCAPTCHA) | If you sign in with Google, Google tells Cotton your name and email address, nothing else. On the sign-in page, Google's reCAPTCHA checks that you're a person; Google's own privacy policy covers what it collects there. |
| Open-Meteo | Suggests places as you type where you are, while you set Cotton up. Only what you type in that box is sent, from Cotton's server, not from your browser. |
These services act on our instructions and may only use your data to provide their service to us. Some of them are in the United States; where data leaves the UK or the European Economic Area, it's protected by the standard contractual clauses or an equivalent safeguard.
How long it's kept
- Pictures of pages taken for noticing are used for that one look and are not kept. Pictures that become part of a conversation (when you ask about a page, or Cotton checks its work while helping you) are kept with that conversation, like the rest of it.
- Your messages, notes, lists and the rest are kept for as long as you have an account, so Cotton can remember them for you. You can delete any of them yourself at any time.
- When you delete your account, everything is deleted from our systems straight away. Backups roll over within 30 days.
Your choices and rights
- Pause or limit. Pause noticing with one click, or add any site to the list Cotton never reads.
- Delete everything. In your dashboard, Settings → Your account → Delete my account. We email you to confirm, and then it's done.
- See, correct or take a copy. Write to hello@heycotton.app and we'll answer within 30 days.
- Wherever you live, you can ask us what we hold about you, have it corrected or deleted, and object to how it's used. If you're in the UK or the EU, you can also complain to your data protection authority. In California you have the rights the CCPA gives you, and we don't sell or share personal information as it defines those terms.
Children
Cotton isn't meant for anyone under 16, and we don't knowingly keep data about them. If you think a child has an account, write to us and we'll delete it.
Changes
If we change this policy in a way that matters, we'll tell you in Cotton or by email before it takes effect. The date at the top always shows the latest version.