Privacy Policy

Mirage is a browser extension that changes how websites look and behave, using plain English. You describe what you want, typed or spoken. Mirage works out the change, shows it to you, and applies it once you approve.

If you tap the microphone, Chrome asks first. The recording goes to an AI provider only to turn your words into text. We do not keep the audio. We do not listen unless you tap it.

Your saved looks stay on your device. We also load a list of ready-made looks from our servers so we can offer them for the site you are on. If you sign in with Google, we store your email, a sign-in session, and credit and usage info so you can use free AI credits.

We keep anonymous usage analytics so we can see which features help and where things break. You can turn it off in Settings.

We do not sell your data. We do not show ads. We do not record your browsing history.

Mirage has one purpose: letting you customize the web pages you visit. Everything the extension collects or asks permission for exists to serve that. Nothing is collected for advertising, profiling, resale, or any purpose you did not ask for.

Mirage is not an ad blocker. If you ask to hide ads or a sponsored post, that is your change, the same as asking to hide a sidebar. You ask. You Apply. We do not collect anything extra for that.

This is the part people most want to understand, so here it is in full.

When you describe a change, Mirage sends your request and a snapshot of the current page to an AI provider. The provider writes a small piece of code that performs exactly the change you asked for. Mirage shows you the result first. Nothing is registered or kept until you press Apply.

Once you approve it, Mirage hands that code to Chrome's user scripts feature, which runs it on the sites you chose and only those sites. This is why Mirage asks you to switch on "Allow User Scripts" during setup. Chrome keeps that ability off until you grant it.

You can also install a ready-made look we offer for the site you are on. We load that list from our servers. We download the script when you Apply it, when you choose to read the code, or when the look is offered on the page. It does not run until you Apply. If we later publish a newer version, we do not replace a look you already applied. You would Apply again.

Two things follow from this, and both matter:

• Mirage does not pull scripts from random third-party sites or CDNs and run them behind your back. The only code that runs on a page is a look you approved with Apply, through Chrome's user scripts setting.
• Looks you have Applied are stored on your device, not on our servers. They run locally from then on. Reopening a site you customized does not call the AI again and does not send anything anywhere.

You can see every change you have approved in the extension, turn any of them off, or delete them.

Some changes need more than what is on screen. Sorting a feed by a date the site never renders, or building a custom view out of a list, means Mirage has to know what data the site itself is working with.

For those cases Mirage can look at the requests a site makes to its own API. This is off by default and stays off until you turn it on, it applies only to the site you turn it on for, and it covers same-origin requests only, meaning that site's own API and nothing else.

The split that matters here is between the shape of the data and the data itself:

• The shape is what can be sent to an AI provider. That means the request path with identifiers stripped out, such as /api/posts/:id/detail, the method, and the names of the fields that come back, such as items.0.published_at. A small, capped number of short example values goes with it so the model can tell a date from a title. It is a summary, never a full response.
• The data stays on your device. Mirage does not send response bodies, request bodies, or headers. Authorization headers, cookies, API keys, tokens, and anything shaped like a credential are stripped out before the summary is built, so they never reach a model or our servers.

When a change you approved uses the site's API, those calls happen in your browser, on the session you are already signed in with, the same way the site's own page would make them. They do not pass through us.

A hint from an API is never enough on its own. Mirage still has to match it to something real on the page before it will change anything.

When you ask Mirage to change a page, we process:

• The text you type. Your request and any follow-up messages, sent to an AI provider so it can build the change you asked for.
• Your voice, if you tap the microphone. Chrome asks before Mirage can hear you. We send the recording to an AI provider to turn it into text, and we do not keep the audio. After that, it is the same as text you typed.
• A snapshot of the page you are on. The URL, the page title, and a structured outline of the page such as tags, visible text, and layout. We may also send a screenshot of the tab so the change can be checked visually.
• Your account details, if you sign in with Google. Your email address, a sign-in session, and the credit and usage counts needed to run free AI credits.
• Basic operational records. Timings, error codes, and token counts for a request, so we can tell whether the service is working. These do not include the content of your pages.

Separately, we load ready-made looks from our catalog: names, short descriptions, and, when you Apply a look, read its code, or are offered it on the page, the script itself. That is so you can install a look you chose. It is not a request to change a page, and it does not send the page to an AI provider.

Looks you have Applied stay in your browser. The list of looks we offer is loaded from our servers so it can stay current. That list is not your browsing history.

A snapshot of a page is sent to an AI provider only when you start or refine a request. Mirage does not stream, sample, or watch pages in the background.

To learn what helps and what breaks, Mirage keeps anonymous usage analytics. This measures how the product is used, not who you are.

It is tied to a random id created on your device. It is never your email or your account. We record which features you use and how a request goes, like the panel opening or a change being started, applied, or failing, along with timings and error codes. For the site involved we keep only rough, non-identifying context: whether it is localhost and the top-level domain such as "com". We never collect the page address, the page content, or the text you type.

• What it is for: understanding usage and fixing problems, so we can make Mirage better.
• What it is not: it is never sold, never used for advertising, and never used to build a profile of the sites you visit.
• You can turn it off anytime in the extension's Settings. When it is off, nothing is sent.
• If you remove Mirage, Chrome opens a feedback page once. Getting there sends a single anonymous "uninstalled" signal, so we can count how many people leave. If you turned analytics off, Chrome opens that page directly and no signal is sent at all.
• The page asks what went wrong. Answering is optional and closing the tab sends nothing. What you write is kept separately and is not linked to the anonymous id above: we keep the reason you picked, anything you type, the version you were on, and an email address only if you choose to leave one so we can reply.

PostHog, our analytics provider, processes this usage data for us. It does not include your page content, your browsing history, or the text you type.

If you import userscripts from Tampermonkey, Violentmonkey, or a file, those scripts are read in your browser and stored on your device. We do not upload them, read them on our servers, or send them to an AI provider.

Mirage does not collect or transmit:

• Your passwords, cookies, or login sessions for any website.
• Your browsing history. We do not record which sites you visit or build a profile of them.
• Your personal messages, emails, or chats on other sites.
• Financial, health, or precise location data.
• Anything you type outside the Mirage prompt box. There is no keylogging.
• Your microphone, unless you tap it and allow it. Mirage does not listen in the background.

Chrome shows you a list of permissions when you install Mirage. Here is what each one is for:

• userScripts. Runs the changes you approved. This is the mechanism described above, and it is the core of how Mirage works.
• storage. Keeps your saved looks, your chat history, and your settings on your device.
• tabs. Reads the address of the tab you are looking at, so Mirage knows which site a change belongs to.
• webNavigation. Notices when a single-page app changes screens, so a saved look can reapply instead of disappearing.
• scripting. Lets Mirage talk to a tab that was already open before the extension started, so the side panel and a saved look can still reach that page.
• sidePanel. Draws the Mirage panel beside the page.
• identity. Optional Google sign-in, only if you want free hosted AI credits. Mirage works without an account.
• Access to websites. Mirage can customize any site you choose to use it on. It reads the address of the tab you are looking at so it can offer a matching look or reapply a look you already saved. It sends a snapshot of the page to an AI provider only when you ask for a change on that page.
• Microphone. Not on the install list. The first time you tap the mic, Chrome asks you to allow it for Mirage, so it can turn what you say into a request. You can refuse and keep typing.

AI providers. Your prompt and the page snapshot go to an AI provider so it can build your change. If you use the microphone, the recording goes there too, only to turn it into text. They process it to return the result. We do not sell this data and we do not use it for advertising.

Supabase. Our database provider. If you sign in with Google, it stores your email, sign-in session, and credit and usage info. The catalog of ready-made looks is stored there too, so the extension can show you looks that match the site you are on.

PostHog. Our analytics provider. It processes anonymous usage events for us, like which features you use, timings, and error codes, plus rough site context such as the top-level domain. It never receives your page content, your browsing history, or the text you type.

Calendly. Our scheduling provider. The booking calendar on our uninstall page is served by Calendly, so loading that page contacts them and they may set their own cookies, which their notice inside the calendar lets you accept or decline. They only receive your name, email, and any note you write if you actually book a time. Nothing you type into the feedback form on that page is sent to them.

We do not share your data with advertisers, data brokers, or anyone else.

Anything stored on your device, your saved looks and your chat history, stays until you delete it, clear the extension's data, or uninstall Mirage.

We do not store voice recordings. Once your words become text, we have no audio to keep.

On our side, prompts and request records kept for account continuity are held for up to 90 days, then deleted. Account records, your email and credit balance, are kept while your account is open and removed when you ask us to delete it.

Your saved looks: delete them in the extension. Gone immediately.

Everything on your device: remove Mirage from Chrome, or clear its data from the extensions page.

Your account: email trymirage.app@gmail.com with "Delete my account" and we will wipe your email, credits, and usage history completely. We do this within 30 days and confirm when it is done.

All communication between the extension and our backend is encrypted in transit.

Your saved looks never leave your browser, so no one can reach them remotely.

No one on the Mirage team reads the requests you send, the page snapshots created for them, or the recordings you make with the microphone. We access your account data, meaning your email and credits, only to help with a problem you report, to investigate abuse or a security issue, or when the law requires it.

Mirage follows the Chrome Web Store data rules:

• We do not sell your data, and we do not transfer it to third parties for their own purposes.
• We do not use your data for anything unrelated to customizing the pages you asked us to customize.
• We do not use your data for credit checks or lending.
• We do not download and run remote code as the extension's own logic. A look is installed only after you Apply, using Chrome's User Scripts API, which you have to turn on. We do not silently push a new script into a look you already applied.

Mirage's use and transfer of any data received through Google APIs and the Chrome Web Store adheres to the Chrome Web Store User Data Policy and the Google API Services User Data Policy, including their Limited Use requirements.

Mirage is not made for children under 13 and does not knowingly collect their data. If a child has given us their info, email us and we will delete it.

If we materially change how Mirage handles your data, we will notify you in the extension and, where required, ask for your consent before the change takes effect. We will also update this page and change the date at the top.

Email us at trymirage.app@gmail.com. We reply the same day.