Parle — Privacy Policy

Last updated: 11 August 2026

This policy applies to the Parle browser extension, Chrome Web Store item bbigpojahnmkdbdnbcmadnhbjlemibom. It is the policy the store listing points at.

It is deliberately the same set of facts the extension itself shows you on its first screen and on its settings page. If the two ever disagree, the extension is what actually runs; tell us and we will fix the document.

1. What is sent off your machine, and to whom

1.1 Hacker News — hn.algolia.com

Sent: the address of the page you are reading, after canonicalization (up to four alias forms of it). Nothing else — not the page's title, not its contents. An earlier version of Parle also searched each network for the page's title; that feature was removed, and with it the only reason a lookup ever needed anything but the address.

Credentials: none. No cookies, no key, no account. The request is anonymous in the sense that it carries no identity of yours — but the address itself is the content of the request, and the service and its network path can see it.

1.2 Reddit — www.reddit.com, falling back to old.reddit.com

Sent: the same canonicalized address, and nothing else.

Credentials: your own Reddit cookies are attached to the first attempt (credentials: "include"), because Reddit answers 403 to a cookie-free request from most addresses. This means that if you are signed in to Reddit, the request that carries the address of the page you are reading goes out as you, and it shares your account's rate limit. The fallback attempt is cookie-free. Reddit can be switched off entirely on the settings page, in which case nothing is sent to it and nothing Reddit previously supplied is shown.

1.3 X

Nothing. The code that would contact X is compiled out of this build (__PARLE_X__ = false), so the requests are not merely disabled, they are absent from the shipped file. You can verify this in the package.

1.4 Link shorteners — t.co, bit.ly and similar

Only while you are already on Hacker News, Reddit or X, and only if you answered the first-run question with "Look pages up automatically": Parle issues a HEAD (and one GET if that is refused) for a shortened link that was on the page you were already looking at, to learn where it points. Nothing about any other page you have read is involved. Capped at 150 requests an hour, deduplicated per page, and cached. No credentials.

1.5 Comment bodies — only when you open a discussion, or ask for a summary

Parle fetches the comments of a discussion from hn.algolia.com/api/v1/items/… or www.reddit.com/comments/….json in two situations, both of them started by you:

• You open the panel on a page that has discussions. The panel shows one tab per discussion and reads the busiest one so that it has something to show. Opening another tab reads that one. One request per discussion you actually look at.
• You press Summarise these discussions, which reads up to six of them so a summary can be written from what was said.

Never on a page load, and never for a page whose panel you did not open. Hacker News is asked with no credentials; Reddit is asked with your cookies, as in 1.2.

1.6 Your AI Provider — only when you press that same button, and only if you connected one

If you have connected a Provider on the settings page, pressing that button sends the page's address and the text of the comments just fetched to the endpoint you configured — your own API key's endpoint, your pasted ChatGPT token's endpoint, or nowhere at all if you chose your browser's built-in on-device model, in which case the text never leaves the machine.

This is the largest thing Parle ever sends anywhere, and it is the only thing that never happens without a deliberate click. The panel states, before you click, how many discussions would be read and where the text would go.

Whatever that Provider does with the text is governed by your agreement with them, not by this policy.

1.7 Us

Nothing. There is no backend and the extension contacts none.

2. What limits the sending

• Nothing at all is sent until you answer the first-run question. On install, Parle opens one screen naming where the address goes and asks whether it should look pages up automatically or only when you click the toolbar button. Until that question is answered, no address leaves your browser on any page, whatever else is configured — and pages you are already on are not harvested either.
• Answering "Only when I ask" means nothing is sent as you browse. The toolbar button still works on every page.
• The skip list. Parle does not look up pages matching a built-in list — banks, webmail, health, government, adult sites, social feeds, private and internal addresses — nor addresses that visibly carry a token or credential. This list is incomplete and will miss things, including services nobody has told us about and short share links that look like ordinary addresses. See section 6.
• The fragment is always discarded. Nothing after # in an address is ever sent. Tracking parameters are stripped before sending.
• Only the tab you are looking at. Background tabs, links opened to read later, and session restore produce no requests.
• Top frame only. Embedded videos and ad iframes never become a page Parle asks about.
• Per-site pause, your own additional exclusions, and per-site overrides, all from the settings page or the toolbar button.

3. What is stored, where, and for how long

Everything Parle stores is in your own browser profile, in a Cache store named parle. Nothing is stored anywhere else, by anyone, at any time.

Nothing derived from a lookup is written to disk as readable content. The part of the code that harvests is given a store that can write; the part that looks up is given one whose writes stay in memory and die with the service worker.

You can inspect the entire store yourself. Open the extension's service worker console and run:

caches.open("parle").then(c => c.keys()).then(k => k.map(r => r.url))

Deleting it. The settings page has one prominent control that clears everything above except your settings, and a finer control that clears only the record of what was looked up. Uninstalling the extension removes all of it.

4. Your AI Provider key is stored in the clear

If you connect a Provider using an API key or a pasted token, that credential is stored in the settings entry above as ordinary text.

A Manifest V3 browser extension has no keychain and no secure element available to it; there is nothing better to put a key in than the same store every other setting goes in. Anything that can read your browser profile can read the key. We do not encrypt it, we do not protect it, and it is not safer here than anywhere else. The settings page says so at the point where you paste it.

Use a key you can revoke. The key is sent only to the endpoint you configured, and only when you press the summarise button.

5. What we do not do

• We do not sell, rent, share or transfer your data to anyone. There is no "anyone" — no server of ours receives anything.
• We do not use your data for advertising, profiling, credit assessment or lending decisions.
• We run no analytics, no crash reporting, no A/B testing and no telemetry.
• We do not read the content of the pages you visit. Parle uses the address, which the browser hands the extension directly. On Hacker News, Reddit and X — and nowhere else — it reads that page's own links, thread identifiers, scores and comment counts, keeps only those pointers and numbers, and discards the markup.
• We do not execute remotely-hosted code. Everything that runs is in the package you installed.

6. Three things this policy will not claim

These are stated as refusals so that no part of this document can be read as making them. Each was measured, and each is unsupportable.

1. Not "your browsing is private." It is not. Every page you read that is not skipped produces requests to other companies carrying that page's address.
2. Not "we exclude addresses carrying credentials." The rules catch several common shapes. A short share link that looks like an ordinary address cannot be detected at all.
3. Not "we protect sensitive categories." A list of sites cannot cover health, internal company tools or documents, and the best lists available are measurably missing well-known providers.

The skip list is a floor, not a guarantee. It is why the extension gives you a global switch to turn automatic lookups off, a per-site pause, and the ability to add your own entries.

7. Children

Parle is not directed at children and collects nothing from anyone, including children.

8. Your rights

Because no data about you is ever transmitted to or held by this project, there is nothing for us to disclose, correct, export or delete on request. Everything Parle holds is on your own device and under your own control; the settings page deletes it and uninstalling removes it.

Requests concerning data held by Hacker News, Reddit or your chosen AI Provider must go to those organisations, under their own policies.

9. Changes

Material changes to what Parle sends or stores will be reflected here and in the extension's own first-run and settings copy in the same release. The extension's copy is generated from the build, so it cannot silently drift from what the code does.

10. Contact

Issues and questions: ziahamza.com/parle/support or support@ziahamza.com, or hello@ziahamza.com.

Source, under AGPL-3.0-only, including every disclosure above as testable code: github.com/ziahamza/parle-extension.