Privacy policy

Last updated 13 September 2026

This policy explains what Refract collects, why, and how you can control it. Refract is built and operated by Lumen Digital Holdings Ltd, a company registered in England and Wales.

What we collect

When you create an account, we store your email address and a password managed securely by our authentication provider (we never see or store your password in plain text).

When you use the extension, we store:

• Your credit balance and how many credits you've used
• A log of each analysis you run — the type (Quick Scan or Deep Verify), the URL of the page analysed, and the date — so we can show you your usage and enforce fair use of your plan
• Your subscription plan and billing status, if you subscribe

We do not store the full text of articles you analyse, and we do not track your general browsing activity. The extension only reads the page you're actively on when you choose to run an analysis.

How article content is used

When you run an analysis, the text of the article you're viewing is sent to third-party AI providers — Anthropic (Claude), OpenAI (GPT-4), and Google (Gemini) — to generate the analysis. This content is sent for the sole purpose of producing your result and is not stored by us afterwards. Each provider's own privacy policy governs how they handle data sent to their API.

Payment information

If you subscribe to a paid plan, payment is handled entirely by Stripe. We never see or store your card details — we only receive confirmation of your subscription status from Stripe.

Cookies and tracking

The Refract browser extension does not use tracking cookies or third-party advertising trackers. This website uses no cookies beyond what's strictly necessary for it to function.

How long we keep your data

We keep your account data for as long as your account is active. If you delete your account, we delete your profile, credit history, and usage log within 30 days, except where we're required to keep billing records for legal or tax purposes.

Your rights

You can ask us to access, correct, or delete your personal data at any time by emailing us at the address below. You can also delete your account directly from within the extension's settings.

Where your data is stored

Account and usage data is stored with Supabase, our database provider. Our backend infrastructure runs on Cloudflare Workers. Both providers maintain their own security and compliance standards.

Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page and, where appropriate, notify you directly.

Contact

Questions about this policy or your data can be sent to hello@readrefract.com.