Gravity for Chrome — Privacy Policy

Gravity for Chrome is a side panel that shows Gravity’s brand intelligence about the website you are visiting. This policy describes what the extension reads, what it sends, and what it keeps.

What the extension reads in your browser

• The address of the active tab (its domain, and on Instagram, TikTok, YouTube, LinkedIn or Facebook, the profile name in the path), its title and the icon Chrome shows for it. Nothing else of the page is read — no page content, no form fields, no cookies of the sites you visit — except when you ask for it (below).
• The page you request, only when you click “Request this site”. On a site Gravity doesn’t know yet, that button scrolls the page from top to bottom to take a full-page screenshot, puts the page back where it was, and copies its HTML as displayed. Nothing is captured otherwise. If the page shows personal information (for example because you are signed in to that site), it can be part of the capture: use the button on public pages.
• On every website, the site’s name — for the Gravity button. A small script runs on the pages you open to show the Gravity button at the right edge of sites where Gravity has data, before you open the panel. It reads nothing from the page except the site’s name (to remember where you hid the button), and adds nothing to the page unless Gravity has data for that site. You can turn the button off in the panel’s Settings (On websites) or hide it on a single site with its ×.
• Your sign-in. If you sign in with an email address and password in the panel, they are sent over HTTPS to Gravity’s sign-in service, which opens your session; the extension does not store them. Signing in with Google happens on Google’s and Gravity’s own pages. Afterwards the extension relies on your Gravity session cookie on app.gravity.benchr.ai; it never sees your access token.

What the extension sends, and to whom

• To Gravity (app.gravity.benchr.ai) only. The domain of the active tab, or the social profile name, is sent to Gravity together with your session, to fetch the brand page. On an Instagram profile that no brand owns, the profile name is also used to fetch that account’s page from Gravity’s creator database (its public profile, metrics and recent posts), and on a website that isn’t a store, its domain is used to fetch the investor behind it from Gravity’s investor database. This happens each time the panel is open and the active tab changes. Gravity records which brand pages your account requested (date, count, source “extension”) for product analytics and fair-use monitoring; creator and investor pages are not counted.
• Sites with data (the Gravity button): when you are signed in and the button is on, the domain of the site you open — never the page address, its path or its title — is sent to Gravity to ask whether Gravity has data on that site, at most once a day per site; the answer is only yes or no. Gravity does not record these questions: no usage record, no log of the domain, and they don’t count toward your daily limit. Nothing is sent while you are signed out, while the button is off, or on a site where you hid it.
• Watchlist and lists: when you save a brand, the brand’s domain and your list choices are sent to Gravity and stored with your account, exactly as on the Gravity web app. When you follow an Instagram account with the star of its page, its profile name is stored with your account’s watched accounts, and when you watch an investor, its identifier joins your watched investors — as on the web app.
• Share: a shared brand link carries a token from Gravity, valid two minutes — the time for WhatsApp, Slack or LinkedIn to fetch its preview image, which Gravity draws only with it; afterwards the link still opens the page, with Gravity’s generic preview. WhatsApp and your mail client open with the message already written. Slack accepts no pre-filled message in a link, so the extension opens its composer and types the message there — with your permission, asked for app.slack.com at the moment you click. It only writes the message you are sharing; it reads nothing from that page, and the message is also copied to your clipboard as a fallback.
• Invite a friend: when you are signed in, the extension asks Gravity for your personal invite link (a code tied to your account); it is also added to the brand links you share. Sharing the invite link works like sharing a brand. Gravity records which accounts signed up through your link, and shows you a masked version of their email address.
• Request a site: when you click “Request this site” on a site Gravity doesn’t know yet, the full-page screenshot (JPEG) and the page’s HTML (compressed), with the page address, its title, the page and window size, the extension version and your browser version, are sent to Gravity with your session. Gravity stores them in its own storage to evaluate the site for its index, and records which account sent the request.
• Report an error: currently sends nothing (the button acknowledges your click); when enabled, it will send the brand domain and your message to Gravity.
• Usage analytics: when you are signed in, the extension sends Gravity a few usage events — panel opened, brand page viewed (with the brand’s name, and whether you came from its website or a social profile), creator page viewed (never the account’s name), investor page viewed (with its domain), empty brand page shown (with its domain), tab opened, clicks on Unlock, Invite, Share and “Open in Gravity app”, and site requests. Each event carries the brand’s domain when a brand page is shown (and, for a site request, the domain of the site you asked for), your plan (free, subscriber or referral) and the extension version. Gravity attaches them to your account (account identifier and email address) and forwards them to PostHog, its product analytics provider, on servers in the European Union, to understand how the extension is used. The domain of a site Gravity doesn’t know is never sent — only the fact that an unknown site was opened — unless you ask Gravity to add that site with “Request this site”. Nothing is sent when you are signed out.

The extension talks to no server but Gravity, apart from the brand’s own website (its favicon), the store’s own image server — for a Shopify store, cdn.shopify.com — for the product pictures of the Products tab, loaded without telling it which page you are on, Gravity’s image storage at Cloudflare R2 (influencer profile pictures, Instagram post pictures and ad visuals) and, if you signed in with Google, Google’s image server (googleusercontent.com) for your own profile picture, shown on the account button — Gravity receives its address from Google when you sign in. An account without a Google picture shows its initial: no avatar service (such as Gravatar) is contacted. Share opens WhatsApp, Slack or your mail client with your message. Brand icons come from the tab you have open, from Chrome’s own cache, or directly from the brand’s website — never from an icon service; the brand icons drifting behind the sign-in screen and the empty screens are bundled with the extension. Country flags are served by Gravity. No analytics or advertising SDK is embedded — usage events go through Gravity, as described above — and the extension loads no remote code.

What the extension stores

• On disk, a few preferences. The appearance you choose in Settings (system, light or dark), the order in which you arranged the blocks of a brand page, and the Gravity button’s settings — on or off, its height on the page, and the names of the sites where you hid it (the last 500) — are kept in the extension’s own local storage. Nothing else is stored; your sign-in lives in the app.gravity.benchr.ai cookie managed by Chrome.
• In memory, briefly: brand pages you just viewed (5 minutes), your lists (1 minute), your invite link (1 minute) and your session status (30 seconds) are kept in the extension’s background process to avoid repeated requests. They disappear when the process stops or when you sign out. Gravity’s yes-or-no answers for the Gravity button are kept for 24 hours at most, per site, in the browser’s session storage — in memory, never written to disk, cleared when Chrome closes or when you sign out.

Permissions, and why

tabs

To know the address of the active tab and follow it as you browse. Chrome labels this “Read your browsing history”: the extension only reads the current tab’s address and sends its domain to Gravity as described above; it does not read or store your history.

activeTab, sidePanel

To open the panel when you click the icon.

favicon

To show site icons from Chrome’s cache instead of asking an external service.

Script on all websites

To show the Gravity button at the edge of sites where Gravity has data. Chrome words it “Read and change all your data on all websites”: the script reads nothing from the page but the site’s name, and the only thing it adds is the button, in its own isolated element. Turn it off in Settings → On websites.

storage

To keep the Gravity button’s settings (on or off, position, sites where you hid it) and, in memory only, Gravity’s answers for 24 hours.

All sites, on request

Asked only the first time you click “Request this site” on a page where you didn’t open Gravity from its icon: it lets the extension scroll that page, take the screenshot and copy its HTML. Chrome words it “Read and change all your data on all websites”; the extension reads a page only when you click that button, changes nothing on it, and puts it back where it was. You can withdraw it at any time in Chrome’s extension settings.

scripting + app.slack.com

To type the message you are sharing into Slack’s message composer. Asked at that click, for that site only, and used to write — never to read the page.

Host permission app.gravity.benchr.ai

To talk to Gravity with your session.

Your rights

Your Gravity account data (profile, lists, usage records) can be accessed, corrected or deleted from the Gravity web app or by contacting us. Uninstalling the extension removes it entirely; it leaves no data on your computer. Processing is based on the contract that governs your Gravity subscription; data is hosted in the European Union.

Changes

We will update this page when the extension’s behaviour changes, with the date above.