Privacy Policy

Last updated: 9 October 2026

Feedzy.ai is local-first: by default, everything you capture stays in your browser, on your device. An optional account adds zero-knowledge, end-to-end-encrypted cloud sync across your own devices and team sharing — and only then does anything leave your machine for our server, as ciphertext we can never read.

The short version

• No analytics, telemetry, advertising, or tracking SDKs are bundled or contacted — no Google Analytics, no Sentry, no Mixpanel.
• We never see your feedback content. The optional cloud is end-to-end encrypted; our server stores ciphertext only.
• Your password is never sent, even at sign-in (a zero-knowledge OPAQUE proof replaces it).
• AI features use the API key you provide and send only to the provider you choose.
• You stay in control: export, delete your data, or revoke a device's access at any time.

What stays on your device

By default, 100% of your data lives only on your machine, in your browser's storage:

When data leaves your device

Every outbound request is triggered by an explicit action you take, and uses a key, token, or account you control. The full list:

Feedzy links

A Feedzy link (https://app.feedzy.ai/l/#…) points to a Feed, to one of its pieces or to one message of its thread. A piece is designated by its identifiers — the id of the piece; for a piece of a comment, the id of that comment and the piece's own id within it — with its number (#2.3, the numbering the prompt uses) as a readable label: deleting a comment, or removing a piece from it, does not make an old link point at another piece. The side panel, the viewer (“Copy link”) and your AI agent write them, so you can paste them into a plan, a pull request or an artifact.

A link carries identifiers only, never content, and they live in the URL fragment (after #), which browsers never send to any server: not to app.feedzy.ai, not to the CDN that serves the page. The page /l is static and makes no request: it only asks the Feedzy extension of this browser to open the link, and the extension opens its own viewer on that Feed — if this browser has it. The page receives a status code (“opened”, “not in your Feedzy”…), never a title, a text or an identifier. Anyone can open your link; only a Feedzy that already holds the Feed can show it.

With Max Cloud, the link also opens in your dashboard. If this browser's extension can't open it — it doesn't hold that Feed, or there is no extension, on a phone for instance — and you are signed in to app.feedzy.ai in this browser, the page hands the link over to your dashboard in the same tab: the identifiers go through that tab's session storage, never into an address or a request. The dashboard downloads your encrypted Feeds as it always does and looks for the Feed after decrypting them in your browser — our server is never told which Feed you opened. If the Feed isn't among what you can read, the dashboard says so, and whom to ask for access.

The optional cloud account (zero-knowledge)

If — and only if — you create an account and sign in, Feedzy.ai syncs your feedback across your own devices and enables team sharing. This is opt-in; the default experience sends nothing to our server.

• Your password is never transmitted. Authentication uses OPAQUE (RFC 9807): the server verifies a zero-knowledge proof and stores no crackable password hash.
• Your content is end-to-end encrypted in your browser before upload (AES-256-GCM). The server stores ciphertext only and cannot decrypt it.
• What the server does see in clear (necessary to route and sync): your sign-in email, a per-install device id and per-device activity timing, event ids, timestamps, and the sharing/permission graph — and, when an AI agent working through our hosted MCP relay asks a human to decide something, that a decision is waiting, on which Feed, and when (never the question itself). It never sees your feedback content or your password.
• Decision e-mails — off by default. If you switch on “Email me when a decision is waiting for me” in My account, then when an agent of the hosted MCP relay posts a decision on a Feed you receive, we e-mail you a link to it, in your account's language — and nothing else: not the question, not the Feed, which stay end-to-end encrypted. The link carries only the ids of the Feed and of that message, after the “#” of the address: opening it sends them to no server — neither ours nor the CDN that serves the page. (The hosted MCP relay itself is an opt-in where a Workspace entrusts its key to our relay so it can decrypt the queue for its AI agents, each decryption logged — the decision signal reveals nothing more than that.) Turn the e-mail off in the same place.
• Notifications (web push) — per device, off until you switch them on. If you turn on notifications in the extension (“Notify me when Feedzy is closed”) or on a device in the web app (“Get notified on this device”), your browser gives us a push address and two encryption keys for that device, which we store. Web push services: that address belongs to the push service of your browser — Google (Chrome and Android), Mozilla (Firefox), Apple (Safari, iPhone and iPad), Microsoft (Edge) — chosen by the browser, not by us, and every notification travels through it. Most of them are EMPTY wake-ups: “something changed, fetch it”. One carries data — the web app's “a decision is waiting for you”: a link to that decision (the Feed's id and the bubble's id, nothing it says), encrypted end-to-end to your device (RFC 8291). The push service sees when a message is sent and how big it is, never what it says. Turn notifications off in the same place.
• Encrypted media (screenshots, voice) is uploaded to Cloudflare R2 in the European Union via short-lived presigned URLs our backend mints. R2 only ever holds ciphertext; it is a storage sub-processor, not a recipient of readable data.

Third-party services & sub-processors

• Anthropic, OpenAI, GitHub — contacted only when you have entered your own key/token and trigger the matching feature. Your prompt, audio, or query goes straight to that provider with your key; the provider sees what you send them, as with any direct API call (these calls are not end-to-end encrypted to us — they don't involve us at all).
• Feedzy.ai backend (api.feedzy.ai) — our own first-party server, opt-in, zero-knowledge (ciphertext only).
• Cloudflare R2 (EU) — encrypted-blob storage for the optional cloud; ciphertext only.
• Resend — our transactional e-mail provider (account e-mails such as address verification, recovery and billing notices, and the decision e-mails above if you turned them on): it receives your e-mail address and the message, which never contains your feedback content — with one exception that the team decides: a reply it chooses to send to a visitor of its public widget, which carries the text of that reply.
• Web push services (Google, Mozilla, Apple, Microsoft — whichever your browser uses) — only if you turned notifications on for a device: they carry our notifications to it, see when and how big, and never read them (empty, or encrypted end-to-end to your device).
• Google Chrome Sync — if you enable Chrome's own Sync, Chrome relays your chrome.storage.sync profile (which includes your display name and email) through Google's sync servers. This is Chrome's mechanism, under your Google account; we never receive it.

Data we never collect

We do not collect analytics or usage telemetry, do not phone home for update checks or remote config, do not read the cookies or storage of sites you visit, do not read your browsing history, and do not inject ads or modify foreign pages beyond the capture/picker overlays you invoke. We never sell or transfer your data to third parties, never use it for unrelated purposes, and never use it to determine creditworthiness or for lending.

Permissions, and why

Automatic redaction

A privacy filter is on by default. Before any text is stored or exported, Feedzy.ai replaces emails, Luhn-valid card numbers, IBANs, JWTs, and API-key-shaped tokens (Bearer / sk- / pk- / ghp_ and similar) with neutral placeholders. You can install the extension on a work machine without leaking a key into a screenshot or prompt.

Your controls

• Export your data to a JSON file at any time (with the option to strip screenshots).
• Delete any feedback, or clear everything, from the panel.
• Revoke a device's access and rotate your recovery key from the account settings (cloud accounts).
• Regenerate your device id on demand.
• Uninstalling the extension removes all local data.

Data controller

Feedzy.ai is operated by Anthony Fantinati, trading as Blazing Ideas, a sole trader (auto-entrepreneur) established in France, who is the data controller for the optional cloud account. Postal address: 466 Bis chemin de Blazin, 30000 Nîmes, France (SIRET: 515 266 997 00037). You can reach the controller for any privacy matter at privacy@feedzy.ai. When you use the extension purely locally (no account), we process no personal data and there is no controller relationship.

Legal basis for processing (GDPR Art. 6)

• Performance of a contract — processing the routing metadata (sign-in email, device id, event ids, timestamps, sharing graph) needed to deliver the cloud sync and team-sharing you signed up for.
• Consent — creating an account and enabling the cloud is entirely opt-in; you may withdraw at any time by deleting your account or signing out, which stops all server-side processing.
• Legitimate interests — keeping the service secure and preventing abuse (e.g. rate-limiting, device caps). We do not process your data for marketing or profiling.

Data retention

• Local data lives only on your device until you delete it or uninstall the extension; we set no retention period because we never hold it.
• Encrypted cloud events & blobs are retained while your account is active. When you cancel, a grace window applies before the encrypted pool is purged; deleting your account removes them.
• Routing metadata (email, device records, sharing graph) is kept for the life of the account and deleted on account deletion, subject to any short backup-rotation window.
• AI / transcription requests are not stored by us at all — they go directly to the provider whose key you entered; recorded audio is discarded right after transcription.

Your rights under the GDPR

Because the cloud is zero-knowledge, we hold your content only as ciphertext we cannot read — but for the routing metadata we do process, you have the rights to:

• Access — request a copy of the personal data we hold about you (the extension also exports your own data to JSON at any time).
• Rectification — correct inaccurate data (e.g. your display name or email).
• Erasure — delete your account and its data ("right to be forgotten").
• Portability — receive your data in a structured, machine-readable format.
• Restriction / objection — ask us to limit or stop certain processing.
• Withdraw consent — at any time, without affecting prior lawful processing.
• Lodge a complaint — with your local supervisory authority (in France, the CNIL).

To exercise any of these, email privacy@feedzy.ai; we respond within one month.

Contact

Questions or a privacy-affecting bug? Email privacy@feedzy.ai or open an issue on our public repository. Please don't include sensitive content in a bug report.