Privacy Policy

Last updated: July 29, 2026

This Privacy Policy ("Policy") describes how SumGPT ("SumGPT," "we," "us") collects, uses, shares, and protects your personal data when you use our Chrome extension and the sumgpt.app website (collectively, the "Services").

We take your privacy seriously. This Policy is designed to be transparent about our data practices. By using our Services, you agree to the practices described in this Policy.

We may update this Policy from time to time. Material changes will be communicated through the Services or via email. Minor updates may take effect without separate notice. All changes are effective upon posting.

1. Data Controller

Your personal data is controlled by the individual developer operating SumGPT:

Data ControllerEnes Öztekin, an individual developer operating as SumGPT
AddressKARAPINAR BELDESİ YUKARI ÇUKUR MAH. TEMENLER ÇUKUR CAD. NO: 49
ÇAYCUMA / ZONGULDAK
Email[email protected]
Websitehttps://sumgpt.app

2. Personal Data We Collect

We collect personal data in three ways: (1) information you provide directly, (2) information collected automatically, and (3) information we receive from third-party services.

Important: SumGPT automatically retrieves YouTube video transcripts (captions) and sends them to our AI provider to generate notes. Transcripts are processed solely for note and quiz generation. Please keep this in mind when watching videos that may contain sensitive or private information.

2.1. Information You Provide

  • Account Registration: When you sign up, we collect your email address and name. If you sign in with Google, we receive your name and email from Google. Your Google password is never visible to or stored by us.
  • Preferences: Your extension settings — such as model choice, note language, and custom instructions — are stored in your account.
  • Content: Structured notes, quiz questions, and your quiz answers are stored in association with your account.
  • Communications: When you contact us, we collect your name, email address, and the content of your message.

2.2. Information Collected Automatically

  • Browser and Device Data: The extension uses Chrome's local storage (chrome.storage.local) to cache your settings, session, and notes for offline functionality.
  • Usage Data: We may collect anonymized metrics such as extension status (active/inactive), number of videos processed, and quiz statistics.
  • YouTube Transcripts: SumGPT automatically fetches the transcript (captions) of the YouTube video you're watching. This only happens when the extension is active and you are on a video page.
  • Video Navigation Detection: The extension detects when you navigate between YouTube videos (e.g., clicking a related video) to initialize note-taking for the new video. Only the current video URL is read — no browsing history is stored or transmitted.

2.3. Information From Third Parties

  • Google OAuth: When you sign in with Google, we receive your name and email address from Google.
  • Supabase: Your account, notes, and quiz data are hosted on Supabase. You can review Supabase's privacy policy here.

3. How We Use Your Data

We use the personal data we collect for the following purposes:

  • Service Delivery: Generating structured notes and quizzes from YouTube transcripts, saving your content, providing gap tracking, and syncing across devices.
  • Account Management: Creating and maintaining your account, authentication, session management, and account security.
  • AI Processing: Sending transcript content to the OpenAI API solely for note and quiz generation. Per OpenAI's API data usage policy, content sent through the API is not used to train models.
  • Communications: Sending account-related notifications, service updates, and responding to your support requests.
  • Improvement & Debugging: Analyzing service performance, detecting and fixing errors, and improving the user experience.
  • Legal Compliance: Meeting our legal obligations and responding to lawful requests from authorities.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

  • Consent: You give explicit consent when you create an account and agree to this Policy.
  • Contractual Necessity: Processing is required to deliver the Services you've requested.
  • Legal Obligation: We may process data to comply with applicable laws and regulations.
  • Legitimate Interests: Processing for security, fraud prevention, and user experience improvement, balanced against your privacy rights.

5. Third Parties We Share Data With

We share your personal data with the following service providers only to the extent necessary to deliver the Services:

Service Provider Purpose Data Shared
OpenAI (OpenAI, L.L.C.) AI processing for note and quiz generation YouTube transcript text, existing note content, system instructions. Per OpenAI's API data usage policy, API-submitted data is not used for model training.
Supabase (Supabase, Inc.) Authentication, database hosting, and data synchronization Email address, name, hashed password, notes, quiz data, user answers, settings. Data is hosted in Supabase's Frankfurt (Germany) region.
Google (Google Ireland Ltd.) Authentication via Google OAuth When you sign in with Google, your name and email address are transmitted to us by Google.
PostHog (PostHog, Inc.) Website analytics on sumgpt.app Page views, button clicks (e.g., CTA, FAQ, navigation), device type, browser version, and approximate location derived from IP address. Data is hosted in the EU (eu.i.posthog.com). The Chrome extension itself does not use PostHog — only the sumgpt.app website.

These providers process data solely on our behalf for the stated purposes and are subject to their own privacy policies. When data is transferred internationally, we ensure appropriate safeguards are in place.

We may also share personal data in these circumstances:

  • Legal Authorities: To comply with a legal obligation or respond to lawful requests from judicial or administrative authorities.
  • Protection of Rights: To exercise or defend our legal rights, or to prevent fraud or abuse.
  • Business Transfers: In the event of a merger, acquisition, or sale of all or part of SumGPT's assets, your data may be transferred to the acquiring entity.

6. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this Policy, or as required by applicable law. When you delete your account or request deletion, we remove your data from active databases within a reasonable timeframe. Some data may persist in backups for legal or dispute resolution reasons — in such cases, the data is no longer actively processed and is accessed only when necessary.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

  • Supabase Row Level Security (RLS): Database-level access control ensures each user can only access their own data through row-level authorization policies.
  • Encryption: All data transmission occurs over HTTPS. Passwords are hashed using bcrypt and stored by Supabase.
  • Authentication: Supabase Auth provides JWT (JSON Web Token) based session management with automatic token refresh.
IMPORTANT: No method of transmission over the Internet is 100% secure. While we take commercially reasonable measures to protect your data, we cannot guarantee absolute security. Please do not share your account credentials with anyone.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  1. Right to know whether your personal data is being processed.
  2. Right to request access to your personal data.
  3. Right to know the purposes of processing and whether data is used accordingly.
  4. Right to know the third parties to whom your data has been transferred.
  5. Right to request correction of incomplete or inaccurate data.
  6. Right to request deletion of your data under certain conditions.
  7. Right to request that corrections or deletions be communicated to third parties who received your data.
  8. Right to object to decisions based solely on automated processing that produce legal effects concerning you.
  9. Right to seek compensation for damages resulting from unlawful processing.

To exercise these rights, contact us at [email protected]. We will respond to your request as soon as possible and no later than 30 days. Requests are generally processed free of charge, though we reserve the right to charge a reasonable fee for manifestly unfounded or excessive requests.

9. Children's Data

Our Services are not directed at children under 16. We do not knowingly collect personal data from children under 16. If we learn we have collected data from a child under 16, we will delete it promptly. If you are a parent or legal guardian and believe your child has provided us with personal data, please contact us.

10. Cookies & Tracking Technologies

10.1. Chrome Extension

The SumGPT Chrome extension does not use browser cookies or any third-party tracking technologies. The extension stores necessary data in Chrome's local storage (chrome.storage.local). This data resides only on your device and is not automatically transmitted to us. Supabase synchronization only occurs when you are signed in and as a result of your actions.

10.2. Website Analytics (sumgpt.app)

Our website at sumgpt.app uses PostHog, a product analytics service provided by PostHog, Inc., to understand how visitors interact with our website. PostHog helps us improve our landing page and documentation by showing us which pages are visited and which features attract interest.

PostHog collects the following information when you visit sumgpt.app:

  • Pages viewed and time spent on each page
  • Button clicks (e.g., "Add to Chrome" CTAs, FAQ item expansions, navigation links)
  • Device type, browser name and version, operating system
  • Approximate geographic region derived from your IP address (country/city level)
  • Referring website or source (e.g., search engine, social media)

PostHog uses cookies and local storage to identify returning visitors. All analytics data is processed and stored on PostHog's servers in the European Union (eu.i.posthog.com). We do not send any personal data from your SumGPT account (email, notes, quiz results) to PostHog. The analytics are limited to website browsing behavior.

You can opt out of PostHog tracking on our website by enabling your browser's "Do Not Track" setting or by using your browser's built-in tools to block third-party cookies and scripts. You can learn more about PostHog's data practices in their Privacy Policy.

10.3. Advertising

We do not use third-party advertising cookies or serve targeted advertisements on sumgpt.app or within the Chrome extension.

11. Third-Party Links

Our Services may contain links to third-party websites not controlled by us (e.g., YouTube, OpenAI, Supabase). We are not responsible for their privacy practices. This Policy applies only to SumGPT. We recommend reading the privacy policy of any third-party site you visit.

12. Policy Changes

We may update this Privacy Policy from time to time. Updates will be posted on this page and the "Last updated" date will be revised. For material changes, we will notify you through the Services or via your registered email. Your continued use of the Services after changes are posted constitutes acceptance of the updated Policy.

13. Contact

For questions, comments, or to exercise your rights regarding this Privacy Policy, you can reach us at:

When making a privacy-related request, please use the email address associated with your account and clearly state your request so we can verify your identity.