Overview
FanFan Cards is a local-first Chrome extension. The developer does not operate a server that receives extension user data, does not use advertising, analytics, or tracking services, and does not sell user data.
Without an AI provider configured, lookups and translation go through the Google Translate endpoint; with one configured, they go to the provider you chose. Data is sent to a third party only when you actively look up, translate, or turn on GitHub sync.
Data the extension processes
- Website content and page information: when you actively select, explain, or translate content, the extension reads the selected text, the nearby sentence or paragraph, the page title, and the page URL. Paragraph and full-page translation read visible text on the current page.
- FanFan mode and saved-word highlights: when you enable FanFan mode, the extension scans visible text on the current page and matches it against the word library stored in your browser. Matching and highlighting happen entirely on-device. Page content is not sent to an AI provider, the developer, or another third party.
- YouTube captions: when you turn on bilingual captions in the YouTube player, the extension reads the current video's caption-track list and caption text. Caption requests are made from the page context to
youtube.com, so they carry the browser's existing YouTube cookies in the same way as the page's own requests. The extension does not read, store, or transmit those cookies. A one-time validation parameter generated by the player is used only for the immediately following caption request; it is not retained or sent to the developer or another third party. - Input-box translation (triple space): the extension listens to keystrokes in web page input fields only to detect three consecutive spaces; when triggered, the existing text in that field is sent to your chosen AI provider for translation and replaced in place. Input is never logged or stored.
- Learning data: saved words, explanations, source sentences and URLs, review history, learning activity, and user settings.
- Authentication information: AI service API keys entered by the user and, if GitHub sync is enabled, a GitHub token entered by the user.
Cards, review history and learning activity are stored in your own browser through chrome.storage.local. During first-time setup, you are asked to choose a configuration folder; after you grant access, settings, AI API keys and the GitHub token are saved in a configuration file in that folder. You can also choose local-only configuration or explicitly enable browser account sync; only then are these settings and credentials written to browser-managed chrome.storage.sync for syncing across devices signed in to your browser account. Where browser sync is unavailable, they stay on this device only. Existing installations keep their previously selected configuration method. You can switch to local-only under Configuration sync. The developer cannot access this local data or your browser sync storage.
Data retention and deletion
Local data remains until you clear it in the extension, remove the extension's data, or uninstall the extension. You can export your cards at any time and can clear translation caches or all cards from the settings page.
Data synced to GitHub is governed by the settings and actions of your own GitHub repository and can be deleted by you on GitHub at any time.
Security and minimum permissions
The extension does not load or execute remote code. External requests use HTTPS; only a local development endpoint may use http://localhost. Access to a custom API endpoint is requested for that specific host only after you click “Test connection.”
The extension injects a script into the page context on youtube.com. It is used only to read public video and caption-track information from the player, record the one-time validation parameter described above, and make the same-origin caption request. The script cannot access extension APIs, does not read other page data, and does not communicate with a server operated by the developer.
The extension's use of information follows the Chrome Web Store User Data Policy, including its Limited Use requirements:
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Contact
For questions about this policy, email [email protected] or contact the developer through GitHub Issues ↗.