Browser Extension Privacy Policy

Extension: Damn — AI-tool discovery Software provider: Distortion Labs SAS, 66 avenue des Champs-Élysées, 75008 Paris, France — registered with the Paris Trade and Companies Register (RCS Paris) under No. 921 758 694. Contact: [email protected] Effective date: 28 July 2026

This policy explains exactly what the Damn AI-tool discovery browser extension does with data. It is written to be read in full — the whole point of the extension is transparency.

1. Single purpose

The extension has one job: help your organization understand which AI web tools are used on company devices, so it can be governed. When you open a website, the extension checks the site's hostname against a list of known AI providers (ChatGPT, Claude, Gemini, and similar). If it matches, it records that an AI tool was seen. If it does not match, nothing is recorded. That is the entire function.

2. What it looks at — and what it never touches

The extension reads only the hostname of pages you navigate to (for example chatgpt.com), and only long enough to classify it on your own device.

It never accesses, collects, or transmits:

  • the content of any page, or any text you type or read;
  • your keystrokes, screen, clipboard, files, or downloads;
  • your browsing history, bookmarks, cookies, or saved passwords;
  • URLs, page paths, query strings, titles, or form data;
  • anything at all from a site that is not a recognized AI tool.

Non-AI browsing is dropped instantly, on your device, and never leaves your browser. This is enforced by the extension's design and by its minimal permissions (see §5), not merely by policy.

3. What data leaves your browser

When (and only when) a recognized AI tool is detected, the extension sends a single, minimal record to your organization's own server. Each record contains only:

  • the AI provider matched (e.g. "OpenAI / ChatGPT");
  • a category and confidence level;
  • whether the match is dual-use (a domain that may or may not be AI);
  • the signal type (that it came from the browser) and a timestamp.

There is no field for a URL, page content, your identity beyond what you provided at enrollment, or anything you did on the site. The record describes existence ("an AI tool was seen here"), never activity.

4. Where the data goes — and where it does not

Reports are sent only to the self-hosted Damn server operated by your own organization, at the address configured when the extension was enrolled.

  • The data is not sent to Distortion Labs. We operate no server that receives it and we never see it.
  • The data is not sent to Google, to any advertising network, or to any third party.
  • The extension makes no other network connections.

5. Permissions

The extension requests the minimum permissions needed for its single purpose:

  • webNavigation — to know when you navigate to a page, so its hostname can be classified.
  • storage — to remember your enrollment and settings locally.
  • alarms — to schedule periodic reporting.
  • Host access (optional) — requested only for your organization's server address, so reports can be sent there. No content-script or page-reading permission is requested.

The extension has no access to tabs content, browsing history, cookies, or scripting.

6. Who is responsible for the data

Your organization is the data controller for the reports the extension sends — it decides to deploy the extension, it operates the server that receives the data, and it determines how that data is used. Distortion Labs provides the software but is not a processor of this data, because the data never reaches us.

If you have questions about how your employer uses discovery data, contact your organization. For questions about the extension software itself, contact [email protected].

7. Storage and retention

Enrollment credentials and settings are stored locally in your browser and can be removed by uninstalling the extension. Reported records are retained on your organization's server according to their retention policy. Uninstalling the extension stops all reporting immediately.

8. Your rights

Because your organization is the controller, data-subject requests (access, rectification, erasure, objection) are directed to your organization. Where applicable law gives you these rights, your employer is responsible for honoring them. You can stop the extension at any time by disabling or removing it.

9. Changes

We may update this policy; material changes will be reflected here with a new effective date.

Contact: [email protected] — Distortion Labs SAS, 66 avenue des Champs-Élysées, 75008 Paris.