Privacy Policy — Octopus AI Toolbox for Trade

1. Scope

This policy applies to the Chrome extension “Octopus AI Toolbox for Trade / 外贸章鱼AI工具箱”, the website https://octotool.net, and the Octopus account authorization service used by the extension.

2. Account information

The extension requires an Octopus account. During registration, login, authorization, refresh, verification, or logout, the website account service may process: name; email address; account ID; role; session expiry; authorization consent record; extension device/session information; plugin access token; and plugin refresh token.

The website uses an HttpOnly cookie and a server-side session record to remember customer sign-in. Customer website sign-in sessions currently last up to 90 days. Extension authorization currently expires 20 days after authorization; refreshing a short-lived access token does not extend that deadline. If your website sign-in remains valid, you can authorize the extension again without re-entering your password. Sign-out, password changes, account restrictions, or revocation may require you to sign in again.

Website sign-out ends the current website sign-in session. Extension sign-out revokes the current extension authorization and clears its local authentication credentials. These actions do not delete local conversations or task files. Clearing extension storage is not required for normal authorization renewal.

• Access tokens are stored only in extension session storage.
• Refresh tokens are stored in local extension storage.
• Extension logout sends a revocation request to the Octopus website account service and clears local authentication credentials.

3. Task and website content

With your action and consent, the extension may process prompts and instructions; selected text; webpage title, URL, and visible content; DOM context needed for a task; screenshots and images you select or capture; files and assets you import; annotations, notes, drafts, and task results; tool results and necessary task history.

• If you authorize a webmail page as part of a generic browser task, visible message content and sender/recipient information may enter task context.
• There is no dedicated Gmail API integration, mailbox synchronization, contact synchronization, or built-in bulk email sending feature.

4. Model services

Model requests are sent to the model service you select or configure. Depending on your task and data-sharing choices, requests may include prompts, authorized page content, files, screenshots, annotations, relevant tool results, and necessary history. Your model credential authenticates the corresponding service. Avoid putting credentials in prompts, files, or screenshots you share.

5. Local storage

The extension stores conversations, task files, annotations, skills, settings, checkpoints, page leases, diagnostic logs, and recordings in browser local storage or IndexedDB. It does not upload these items through Chrome Sync and has no developer telemetry backend.

Diagnostic reports are copied or exported only by you. In release builds, diagnostic reports hide stacks and tool inputs and show model configuration only as whether a key exists.

6. Third-party services

Optional connectors send the inputs and authentication information needed for the features you enable to their corresponding services. These may include queries, domains, URLs, page or product details, task instructions, and content you choose to publish.

When you configure and enable a supported remote MCP connection, the extension sends protocol requests and enabled tool calls over HTTPS. Calls may include the tool name and necessary task arguments. The current release supports the DataForSEO MCP service. Connector settings and credentials are stored locally; credentials authenticate the corresponding service. Tool results may enter task context sent to your selected model service.

Jev is optional browser assistance. When configured and enabled, it can send task instructions, page URLs, and structured control observations, including labels, values, options, and frame identifiers, to the configured TypeSafe/Jev service. Its responses help the extension choose browser actions; the extension still performs those actions through its existing executor.

Data may therefore pass between services as part of a task: for example, a DataForSEO tool result or browser observation may be included in a request to your selected model service. Removing local credentials stops their local use; it does not delete records already held by a remote service. Each receiving service's policies and account settings govern its processing, retention, billing, and any training use.

• model API endpoint
• DataForSEO API and MCP service
• Apify
• Chrome UX Report / CrUX
• WordPress HTTPS REST endpoint
• configured TypeSafe/Jev service

7. Screen recording

Screen recording starts only after you select a page, browser window, or screen source. Recordings and crops are processed and stored in this browser’s IndexedDB. They are not uploaded automatically. Microphone access is off unless you enable it.

8. Browser tasks

Browser tasks run within the scope of pages and actions you select or authorize. They may read pages and perform clicks, typing, scrolling, screenshots, and result organization. Once you delegate a task, actions may run automatically within that scope; the extension does not ask for confirmation before every step. You can stop the task, and read-only mode prevents browser writes. Chrome permission prompts, sign-in requirements, and connector-specific authorization still apply. Stopping does not undo actions already completed by a website or service.

Tasks must respect website authentication, captchas, paywalls, permissions, and site protections. Check an interrupted or uncertain external result before attempting the same action again.

9. Limited Use

The developer uses data to provide the account service and the extension features you request. The developer does not sell user data, use it for personalized advertising or creditworthiness, share it for unrelated purposes, or use it to train the developer's machine-learning models.

Data sent to your selected model service or enabled connector is used to provide the requested feature. The receiving service's policies and account settings govern its processing, retention, and any training use. Review those terms and settings before sharing sensitive data. This policy does not promise that every service you choose has identical retention or training rules.

10. Retention and deletion

Local data remains until you delete it, clear extension data, or uninstall the extension. Account profiles and authorization records are stored by the website account service; signing out or session expiry does not delete the account record. The 90-day and 20-day periods describe authentication validity, not a promise to delete all records after those periods. For account or data deletion requests, contact [email protected].

Third-party copies remain under the receiving services' policies and settings. Deleting extension data does not automatically revoke server-side authorization or delete remote records.

11. Children

The product is intended for business and foreign-trade workflows. It is not directed to children.

12. Changes

Material changes to functionality or data handling will be reflected in this policy before or when the updated extension is released.

13. Contact

• Privacy: [email protected]
• Support: [email protected]
• Data requests: [email protected]

中文摘要

产品品牌为 Octopus AI Toolbox。扩展会处理账号资料、任务内容、授权网页内容、截图、批注、文件和本地诊断信息。普通客户官网登录状态当前最长保留90天，插件授权20天到期，刷新 access token 不会延长期限。官网仍已登录时，可直接重新确认授权，无需为常规到期清除本地资料。

用户委托的浏览器任务可在授权范围内自动执行，并非每一步都弹出确认；可停止任务或使用只读模式。模型请求发送到所选或配置的服务。启用的 DataForSEO MCP 会把完成任务所需参数发送给对应 HTTPS 服务，结果可能进入模型上下文；启用 Jev 时，任务指令、页面 URL 和结构化控件观察会发送到所配置的 TypeSafe/Jev 服务。通用网页任务可处理授权网页邮箱的可见内容，但没有专用 Gmail API、邮箱同步或内置邮件群发功能。

开发者不出售数据、不做广告定向、不用于开发者模型训练；接收方的处理、留存及训练使用取决于其服务条款和账号设置。退出或授权到期不等于删除账号和第三方记录。隐私、支持和数据请求请联系 [email protected]。