Rally AI

Rally AI — Privacy Policy

Effective date: 29 October 2026

Rally AI is a browser extension for people who use the Claude (claude.ai), ChatGPT (chatgpt.com) and Gemini (gemini.google.com) websites. It shows your usage limits for each one, helps you move between their tabs, and keeps a library of chats and prompts you choose to save.

In short: everything the extension does happens in your browser. It has no server, no account, no analytics or telemetry, and no advertising. It never sells your data or shares content without your action. The only websites it talks to are the AI providers you turn on. When it talks to them, it uses your existing session to do what you asked it to do there. An optional Obsidian action hands text to the local app only when you choose it.

1. What the extension accesses, and why

The extension has no access to any website until you give it. Each provider is off until you turn it on in Settings. Turning one on asks Chrome for permission to access that site. Access to all websites is a separate, optional permission (see 1.6).

1.1 Your usage limits

For each provider you turn on, the extension asks that provider’s own website for your current usage (for example, “Session: 40% used, resets at 3:00 pm”) and your plan name. It uses your existing signed-in session on that site, the same way the site’s own usage page does.

• These responses can include account details such as your email address, name, or account and organisation IDs. The extension removes (redacts) these before anything is stored or displayed in its diagnostics.
• ChatGPT requires a short-lived access token for this request. The extension fetches it again each time, holds it only for the duration of that request, and never stores, logs or exports it.
• Gemini requires page tokens. These are kept only in session memory (chrome.storage.session), which Chrome clears when the browser closes.

1.2 Conversations on provider pages

On the provider pages you’ve turned on, the extension reads the page to show its in-page features:

• Prompt timeline: reads the prompts in the chat you have open (from the page and from the provider’s own conversation endpoint), so you can jump between them. This is held in memory only, for the open chat, and is never stored.
• Copy Q&A: reads the turns you choose and copies them to your clipboard when you click.
• Export chat: reads the current conversation branch when you choose an option under Export chat. Markdown and JSON download it to a file on your device; Obsidian, OneNote and Notion put it on your clipboard for that app (1.5). The result contains unencrypted conversation text, source information and attachment placeholders. Conversation text is not redacted. Raw provider responses and authentication metadata are not included, and credentials, query strings and fragments are removed from the source URL.
• Response status: detects whether a reply is still being generated, so it can show status and, if you turn it on, notify you when it finishes.

Conversation content is not permanently stored by the extension, except for the titles of chats you save yourself (1.4). Text and screenshots you explicitly collect are retained temporarily in extension session storage (1.5). Exported files are separate copies you choose to download and control yourself.

1.3 Prompts you write and files you attach

• Prompt library: the prompts you create are stored on your device, word for word (titles, text, tags, folders, and the values you last filled in). They are not redacted, because redaction would change your prompts. Prompt text is never included in logs, diagnostics or debug info.
• Inserting and sending: when you insert a prompt, the extension writes it into the provider’s message box in the tab you are using. It sends the message only if you have turned sending on in Settings (it’s off by default), or as part of a chain you start and confirm yourself. The message then goes to that provider, the same as if you had typed it.
• Files: if a prompt has a file or image input, the file you pick is attached to the provider’s message box in that tab. It is held in memory only for that session and never saved by the extension. Once attached, it is uploaded by the provider’s own page, under that provider’s terms.

1.4 Chat library

When you save a chat to the library, the extension stores its address (URL), the provider, the title (by default the tab’s title, which you can rename) and the folders you organise it into. Emails in titles and folder names are redacted. The chat’s messages are not stored.

1.5 Selected text and clipboard collections

If you select text and use the extension’s chip to send it to an AI provider, the selected text stays in the page’s memory until you send or dismiss it. When you send it, the extension opens the provider’s new-chat page with your text filled in, unsent. Text too long for that, or text bound for Gemini, is copied to your clipboard instead so you can paste it. Only a character count is kept briefly (up to one minute) so the new tab can show a paste hint, never the text.

If you send a selection or a chat to Obsidian, the extension replaces your system clipboard with a note containing the text, the title you confirmed, the source URL and capture time (for a chat, also its provider and turn count), then requests the local Obsidian app through its URI handler. Source URL credentials, query strings and fragments are omitted. The text itself is not redacted or sent to an AI. The URI carries a note name and a clipboard instruction, not the note body. The extension stores no note, vault setting or credential and makes no request to a notes-service server.

The extension cannot confirm that Obsidian created the note. The clipboard remains available for manual pasting if the handoff fails. Notes created by Obsidian, including any subsequent syncing, are controlled by your Obsidian settings and that app’s data practices.

Notion and OneNote write the selected text or the chat, its formatting and source metadata to the system clipboard as HTML and plain text. You paste it into the target app yourself. The extension does not connect to either service, store access tokens, or write to a workspace or notebook. Executable HTML, styles, embedded content and remote image loading are omitted; copied text itself is not redacted.

Shared collection: excerpts you explicitly collect, screenshots you paste/import/capture, their source metadata and an optional prompt are stored verbatim in chrome.storage.session, shared across permitted normal tabs. This includes actual image bytes, not just filenames. The collection survives website navigation, page reloads and closing individual tabs. It is removed by Clear, browser-session end, or extension reload/disable/update. No collection content enters permanent storage, sync, logs, Diagnostics or debug exports. Private windows are excluded.

The visible tray supports ordering, removal and clearing. Limits are 20 mixed items, 500,000 text/HTML/metadata characters, 4 MB per PNG/JPEG/WebP image, a 6 MB serialized collection, and a 32,000-character prompt. Available browser session quota may be smaller. No text is silently truncated. Imported/pasted image files do not claim a source page; explicit viewport captures record the captured page’s title and a URL without credentials, query strings or fragments.

Insert attaches screenshot files and appends the prompt and text clips in the provider chat where you clicked, without sending. Attaching may cause the provider’s page to upload those files before you press Send, under that provider’s data practices. The extension verifies the insertion and leaves the batch available for reuse. Clear does not erase copies already uploaded, inserted into a draft, pasted elsewhere or written to the system clipboard.

Capture screenshot uses activeTab only after you open the extension toolbar popup and click the capture button. It captures the current visible HTTP(S) page, not the browser toolbar or other applications, and rejects private/restricted tabs and a tab that changes during capture. There is no background capture or clipboard monitoring. Screenshots may contain sensitive on-screen content; review them in the tray before inserting them into a provider.

1.6 Optional access to all websites

Two optional features need access to every website: showing the navigator (“Rally”) on every site, and the send-selection chip on every site. Chrome asks you before granting this, and only when you click to turn one of them on in Settings. You can remove it at any time.

With this access, Chrome lets the extension see the address and title of your tabs. The extension uses it to show its navigator and selection/collection tools. It does not record browsing history. Content you explicitly collect retains its source title/address temporarily in session storage as described in 1.5; shared collection requests require current site access.

1.7 Notifications

If you turn alerts on, the extension shows system notifications when you are close to a usage limit or a limit resets. “Response finished” notifications are opt-in, and show the chat’s title.

2. What is stored, and where

Persisted extension data is stored only in your browser, using Chrome’s extension storage. Files you explicitly export are saved by your browser to your chosen download location:

Stored on your device (chrome.storage.local)	Held only until the browser closes (chrome.storage.session)
Latest usage reading per provider (redacted)	Which open tabs belong to which provider
Last conversation address per provider	Gemini page tokens
Settings, alert history, onboarding progress	Undo snapshots and prompt editor drafts
Chat library (addresses, titles, folders)	Files you attached and the state of a running chain
Prompt library (word for word)	Send-selection paste hints (a character count)
-	Shared collection: text, screenshots, source metadata and prompt (verbatim)

The extension does not use Chrome Sync, so none of this is copied to your other devices or to Google. It keeps no usage history beyond the latest reading.

3. Sharing and selling

• The extension has no server. None of your data is sent to the developer. Content handoffs to a provider or the local Obsidian app happen only as described above and at your direction.
• No data is sold, rented or used for advertising, credit or lending decisions, or for any purpose other than the features described above.
• No analytics, tracking or telemetry of any kind is included.
• The extension does not use any AI service of its own. The only AI services involved are the provider websites you use yourself. Whatever you send to them is handled under their own privacy policies:
  • Anthropic (Claude): https://www.anthropic.com/legal/privacy
  • OpenAI (ChatGPT): https://openai.com/policies/privacy-policy
  • Google (Gemini): https://policies.google.com/privacy

Data leaves your device only when you move it yourself:

• by copying to your clipboard;
• by exporting a conversation, chat library or prompt library to a file (conversation and prompt exports contain unencrypted text);
• by handing selected text or a chat to the local Obsidian app, which may sync the note according to your Obsidian configuration;
• by copying the redacted debug info from Settings → Diagnostics;
• by inserting screenshot attachments or sending a message to a provider.

4. Limited Use

The use of information received from the extension’s permissions adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide the extension’s features. It is not transferred to anyone, not used for advertising, and no person reads it.

5. Your control

• Turn things off: each provider, each in-page feature and each type of alert can be turned off in Settings.
• Remove access: you can withdraw site access in Settings or on Chrome’s extensions page (chrome://extensions).
• Delete data: you can delete saved chats and prompts in the extension at any time. Uninstalling the extension deletes everything it stored.
• Clear collected content: remove individual entries or choose Clear in the shared collection. Ordinary navigation, page reloads and hiding the tray do not clear it. A browser-session end or extension reload/disable/update also removes session data. Copies already uploaded or pasted into another app are controlled by that app.
• Take your data: the open conversation, chat library and prompt library can be exported to a file. Downloaded files remain until you delete them, independently of uninstalling the extension.

6. Security

The extension has no server-side copy of your data. Requests to providers use HTTPS. Usage-account details are redacted before extension storage, and access tokens are never stored. User-selected collection content and screenshots are retained verbatim for the session, not redacted or encrypted by the extension; review them before sharing, inserting or exporting.

7. Children

The extension is not directed at children under 13 and does not knowingly handle their data.

8. Changes to this policy

If the extension’s data practices change, this policy will be updated before the change is released, and the effective date above will change. The full history of this policy is kept in this repository.

9. Contact

For questions about this policy or your data, contact the developer at the support email shown on the extension’s Chrome Web Store listing.