Privacy & data

This page is the long version of the marketing privacy page — the same facts, but written for someone who wants the field-level detail before installing. If you've read the source, none of this should surprise you; if you haven't, this is what you'd find there.

Two principles drive every choice below:

• Data lives on the device. The default storage for anything butter knows about your dashboard is your browser. Every sync layer that moves it elsewhere is either Chrome's own (which we don't operate) or opt-in (Pro cloud sync).
• Some things reach off-device by design. We used to say the AI Inbox was the only one; that's no longer true, so here's the full list. The AI Inbox and AI Meeting Prep each send a small slice of your PR / issue / event metadata to OpenAI via our Edge Functions — we don't retain the triage payload itself, though see below for what we do retain around it. Clicking, completing, or dismissing an AI Inbox item records an interaction event on our side. Signed-in users send first-party analytics events to our own backend. And sharing a setup explicitly uploads it. Every one of these paths is enumerated field-by-field on this page.

Where data lives

Every outbound request

A full enumeration of every domain butter calls from your browser. All of these are direct browser → service requests; we don't proxy the third-party ones. The *.supabase.co rows are our own backend — those are the requests that actually reach us.

OAuth: what the auth-worker actually sees

GitHub, Linear, and Google Calendar integrations use OAuth. butter operates a small Cloudflare Worker (butter-auth.try-butter.workers.dev) that holds each OAuth app's client_secret so you don't have to register your own apps. The worker is briefly a middleman in the handshake:

• You click Connect. The worker redirects you to the provider's authorise page with the appropriate scopes.
• You approve. The provider redirects back to the worker with an authorisation code.
• The worker exchanges the code for a token. Uses its client_secret against the provider's token endpoint.
• The worker hands the token to your browser via a chromiumapp.org redirect (URL fragment). It keeps no persistent state — the source is open and the README is explicit about this.

From that point on, your browser holds the token in chrome.storage.local and talks directly to api.github.com, api.linear.app, or googleapis.com. The worker is not in the data path for any subsequent fetch.

The AI Inbox: exact payload

This request fires when the widget runs a triage. The background notification check (the single Enable notifications toggle in Settings → Notifications) deliberately does not call it — notifications read your most recent cached triage, or fall back to raw item counts fetched directly from GitHub / Linear, so background checks never send anything to OpenAI and never spend your free daily run. When the widget does triage, the Edge Function receives a JSON body containing, for each PR:

• title
• url
• repo
• author
• updatedAt
• draft

And for each Linear issue:

• identifier
• title
• url
• teamKey
• stateName
• priority
• updatedAt

Plus a Bearer header with your Supabase JWT (used for Pro authentication, never forwarded to OpenAI). The Edge Function passes the structured payload to OpenAI, returns the model's response, and discards the input. The triage payload itself isn't persisted on our side, and per OpenAI's API terms, no model training on it.

Three things around the triage are persisted on our side, so we're saying so plainly:

• Interaction events. Clicking, completing, or dismissing an item writes a row to ai_inbox_interactions with the item's title, author, repo, team key, priority, and source.
• Those events feed future triages. The Edge Function reads your last 30 days of interactions into the prompt so the model learns what you tend to act on versus dismiss.
• Free-tier run timestamps. Each successful free-tier triage records a row in ai_inbox_runs to enforce the one-a-day cap.

Things that are not sent: PR diffs, review comments, commit history, Linear issue descriptions, issue comments, attachments, your OAuth tokens, or your IP address beyond the standard request metadata the Edge Function platform sees.

AI Meeting Prep: exact payload

Only relevant if you have the Calendar widget on your dashboard and a Pro subscription. The Edge Function receives a JSON body containing, for the next upcoming event:

• id
• title
• description (truncated at 1,000 chars)
• startMs, endMs
• attendees: email, displayName, isSelf
• location
• joinUrl

Plus up to thirty of your most recent GitHub PRs (same fields as the AI Inbox above) and up to thirty Linear issues, so the model can spot which work items relate to the meeting and surface them as references in the brief.

Things that are not sent: any other calendar's events, events outside today's window, PR or issue bodies, your OAuth tokens for any provider, attachments, or IPs beyond what the Edge Function platform sees. The brief is cached on your device for two hours so re-renders of the new tab don't re-bill the model.

Stripe (Pro billing)

Pro is billed through Stripe. We never see or store card details — Stripe handles checkout and stores the card on its own infrastructure. On our side we keep only the minimum needed to wire your subscription to your butter account: your email, your Stripe customer ID, your subscription ID, and whether your plan is active.

What we don't do

• No third-party analytics SDK — but there is first-party analytics. No Segment, no Mixpanel, no Heap, no Google Analytics in the extension. The extension does send product events to our own Supabase Edge Function (analytics-track): an event name plus small properties — things like new_tab_open (which fires on every new-tab open), widget_added with the widget ID, and AI Inbox view / action events. Events only send while you're signed in, and are scoped to your user ID server-side. Signed out, nothing is sent. No page content, no URLs you visit, no keystrokes.
• No ads, no tracking pixels. butter doesn't have an ad business model and won't grow one. The free tier is paid for by the Pro tier.
• No selling data. The data path is: your browser → your devices → our Supabase backend for the signed-in paths listed above (analytics, interactions, cloud sync) → OpenAI only for the AI Inbox and AI Meeting Prep triage payloads. There is no other consumer of it.
• No required account. Free butter doesn't need an account; the AI Inbox and cloud sync are the only features that require sign-in.

Deleting your data

• Layout / mode / theme choices — uninstall the extension, or clear chrome.storage.sync via chrome://extensions → butter → Storage → Clear. If Chrome sync is on, other devices will reflect the clear on next open.
• OAuth tokens — disconnect from Settings → Connections, or revoke the integration from the provider's settings.
• Cloud sync payload and account data — turn cloud sync off in Settings → Account. There's no in-product account-deletion button yet; to have your account and its server-side rows (dashboard payload, interaction events, analytics) deleted, email support@trybutter.xyz and we'll do it. Pro subscription cancellation goes through Stripe's customer portal.
• Cached network data — also lives in chrome.storage.local; the Storage panel above clears it too. Caches re-fetch on demand.