This Privacy Policy explains what the Whisk Green Automator Chrome extension ("the Extension", "we", "us", or "our") and the backend service that supports it actually collect, why we collect it, how long we keep it, and the choices you have. It replaces all earlier versions of this policy.

1. Overview

Whisk Green Automator is an assistive automation tool. It submits prompt queues that you enter into your own signed-in Google Flow session and helps you download the resulting images. The Extension also has an optional account system that provides a free daily generation allowance and, if you choose to buy one, a Pro subscription.

This means three things, and we want to be direct about them:

• You can use the Extension without creating an account. In that case we still process a small amount of anti-abuse data (a device fingerprint and a one-way salted hash of your IP address) and a daily usage counter, because that is the only way a free daily allowance can be enforced fairly.
• If you create an account or buy a subscription, we also process the account, usage and payment records described in Sections 2 and 5.
• Your prompts and generated images are never uploaded to our servers. They stay between your browser and your own Google account (see Section 2.4).

2. Information We Collect

We collect the three groups of data below, and nothing else.

2.1 Account data (only if you choose to create an account)

• Email address - used as your account identifier and to contact you about your account or subscription.
• Display name - shown to you inside the Extension.
• Password (hashed) - if you sign up with email and password, we store a bcrypt hash of the password. The plaintext password is never written to disk or kept in our records.
• Authentication method - that the account signs in with an email address and password. There is no third-party or social sign-in.
• Account creation date and last activity timestamp - used to keep the account record accurate and to show you the state of your account.
• Device identifier linked to the account - the device identifier described in Section 2.2 is recorded with your account so that free-allowance abuse (for example many accounts created from one computer) can be detected.
• Session record - when you sign in we create a session that stores its creation time, expiry, last activity, your device identifier, the salted IP hash described in Section 2.2 and a truncated browser user-agent string, so that the session can be validated, refreshed and revoked.

2.2 Guest / anti-abuse data (collected even without an account)

To enforce the free daily generation limit without requiring an account, the Extension and our backend process:

• A device fingerprint computed locally in your browser - browser platform, number of CPU cores, screen resolution and colour depth, IANA time zone, and a hash of the WebGL vendor/renderer strings.
• A device identifier generated for that installation from those signals (a random installation identifier is used when a fingerprint cannot be computed).
• A one-way salted hash of your IP address - a keyed (HMAC-SHA256) hash of the address your requests come from. The raw IP address is not stored. It is used to recognise several free installations sharing the same connection, or repeated attempts to reset the allowance, and it is kept with the anonymous device record only - it is never attached to your name, email, prompts or images.
• The number of generations used per day and the date of the last daily reset.

2.3 Usage data

• The number of images generated per day.
• Your remaining and consumed credit balance.
• Your subscription plan and status (free, trial or Pro).
• Product interaction events needed to keep the quota counter in sync (for example "a generation finished" or "the daily counter was reset"). These events carry counts and identifiers, never prompt text or image content.

2.4 Data Not Collected

3. How We Use It

• To create and secure your account, sign you in, and keep the session valid.
• To count generations and apply the free daily allowance or your Pro entitlement.
• To detect and prevent abuse, fraud and attempts to bypass limits (for example re-installing to reset the free allowance, or running many profiles on one computer).
• To keep your Pro access active after a purchase and to apply it on every device you sign in on.
• To process payments and let you manage or cancel a subscription (through Stripe).
• To deliver remote configuration, including feature flags, Flow API settings, version checks and a kill switch that can disable the Extension if it must be stopped.
• To answer your support requests and to comply with legal obligations.

We do not use this data for advertising, we do not build advertising profiles from it, and we do not use your prompts or generated images to train models.

4. Device Fingerprint & Anti-Abuse Data

The Extension's free allowance is per device, not per browser profile. Without a device-level signal, simply re-installing the Extension or creating another Chrome profile would reset the allowance for everyone, and the free tier could not exist.

How it works

• The fingerprint is computed locally in your browser from signals that any web page can read: browser platform, number of CPU cores, screen resolution and colour depth, IANA time zone, and the WebGL vendor/renderer strings. Those signals are reduced to a device identifier with a one-way SHA-256 hash.
• Our backend receives that device identifier plus the fingerprint signals it is built from (GPU strings, screen, time zone, core count) and the daily usage counter, so that re-installs and extra browser profiles can be linked to the same physical device.
• The salted IP hash described in Section 2.2 is used only in combination with the device fingerprint - for example to notice that many installations share one connection - and never on its own to identify a person. The raw IP address is not retained.

What it is not used for

• It is not used for advertising or profiling, and it is never sold or rented.
• It is not used to track you across other websites, and it is not shared with advertisers or data brokers.
• It is not linked to your prompts or your generated images.

5. Payments

Purchases are processed by Stripe, Inc. When you upgrade, you are redirected to Stripe's hosted Checkout page and the payment happens there.

• We never receive or store your card number, CVC, or full billing details. Card data is entered on Stripe's page and stays with Stripe.
• Our server stores only what is needed to link the purchase to your account and keep Pro access active: the Stripe customer id, the subscription id, the checkout session id, the plan, the payment status, and the email address Stripe returns for that customer.
• Managing or cancelling a subscription is handled through Stripe's billing customer portal.
• Stripe processes payment data under its own privacy policy, as an independent controller of payment information.

6. Third-Party Services

These are all the external services the Extension and our backend contact, and why:

• Google Flow (flow.google.com, flow-content.google) - the Extension automates your own signed-in Flow session to submit the prompts you enter and to download the resulting images. Prompts and generated images are handled locally in your browser; our own servers never receive them.
• Our backend (menumake.net/whisk/api.php) - account creation and login, quota accounting, entitlement issuing, subscription status, and remote configuration / kill-switch checks.
• Stripe - payment processing and the billing customer portal (see Section 5).
• timeapi.io - a public time API used only to obtain the current UTC date, so that daily free-credit resets cannot be gamed by changing the computer clock. Only the request itself is sent; no user data is transmitted.
• Firebase - the Extension's build carries the Firebase SDK as a leftover dependency, but it is never initialised: no Firebase project is configured, no API key exists anywhere in the build, and the Extension requests no Firebase host access. Nothing is ever sent to Firebase.

These providers process data under their own privacy policies. We do not control their independent processing, and we do not give them your data for their own marketing purposes.

7. Permissions Explained

The Extension requests the following Chrome permissions, each for a concrete function:

• storage - keeps your settings, prompt queue, cached quota and session state locally inside your Chrome profile.
• sidePanel - renders the Extension's user interface next to the page.
• tabs - used to find the Google Flow tab you already have open, confirm from its URL that it is a Flow page, and send automation messages to it. We do not request the history permission and we do not read or store your browsing history.
• downloads - saves the generated images you ask the Extension to download.
• scripting - injects the automation helper into the Google Flow page you are using.
• offscreen - runs background work (keeping the quota counter in sync with the server) while the side panel is closed.

Host access is declared for https://flow.google.com/*, https://flow-content.google/*, https://gemini.google.com/*, https://chatgpt.com/*, https://menumake.net/* and https://timeapi.io/*. Google Flow is the only site the Extension automates automatically; Gemini and ChatGPT are accessed only when you explicitly open the optional AI Prompt Studio feature from the side panel. No page content is read or collected from any other site, and no broader wildcard host access is requested.

8. Where Data Is Stored / Retention

• On the operator's server - account records, entitlement records, payment references and quota counters are stored in access-controlled files and databases on the backend host, reachable only by the operator and by administrators who need them for support.
• Locally on your device - settings, cached quota and the device identifier are stored in Chrome's extension storage. They are removed when you uninstall the Extension, and clearing the Extension's data clears them.
• Session tokens expire. Authentication tokens are time-limited and must be renewed.
• Account data is kept while your account is active, and for a short period afterwards where we need it to meet accounting obligations and to prevent abuse.
• Guest / anti-abuse records (device identifier, fingerprint signals and daily counters) are kept for as long as needed to enforce the free allowance and detect abuse.
• Payment records linked to Stripe are kept as long as tax and accounting law requires.

9. Data Sharing

We do not sell or rent personal data, and we do not share it with advertisers or data brokers. Data is shared only with the service providers that make the product work - Stripe (payments), Google Firebase (remote configuration) and our hosting provider - and only to the extent needed for those functions. We may also disclose data if we are legally required to, or where it is necessary to protect our rights, our users or the security of the service.

What We Never Do

• We do not sell or rent personal data.
• We do not use your prompts or generated images for advertising or for model training.
• We do not read your browsing history.
• We do not collect data from pages other than Google Flow.
• We do not store card data.

10. Your Rights

Depending on where you live, you may have rights under data protection laws such as the GDPR or the CCPA/CPRA. We honour the following requests for everyone, wherever you are:

• Access - ask what account, usage and payment-reference data we hold about you.
• Correction - ask us to fix data that is inaccurate or incomplete.
• Export - ask for a copy of your account and usage data in a portable format.
• Deletion - ask us to delete your account and the data linked to it.
• Objection / restriction - ask us to stop or limit certain processing, and withdraw consent where processing is based on consent.

To exercise any of these rights, email support@menumake.net. We may ask you to verify that you own the account before we act, and we aim to respond within 30 days. Exercising your rights will never be used against you - we do not discriminate against users who make privacy requests, and we do not sell personal information.

What deletion means: deleting your account removes your account record, the device link and your quota history from our systems, and unlinks your purchase from your account. It does not erase the payment records Stripe must keep for tax, accounting and fraud-prevention purposes under its own legal obligations - those records stay with Stripe. If you never created an account, we may not be able to identify you from a request alone, but we will delete any guest record we can locate.

11. Children

The Extension is not directed to children. It is intended for users who are at least 13 years old (or older, where your country sets a higher minimum age for digital services), and it is designed to work with a signed-in Google account, which has its own age requirements. We do not knowingly collect data from children. If you believe a child has provided data to us, contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy when the Extension, the backend or the applicable rules change. The "Last updated" date at the top of this page always reflects the current version, and any material change will be reflected here - and, where appropriate, announced inside the Extension - before it takes effect. Continuing to use the Extension after an update means you accept the revised policy.

13. Contact Us

If you have questions, requests or complaints about this Privacy Policy or about how your data is handled, contact our support team at support@menumake.net.