Privacy Policy
We built Ouroboros with privacy as a first principle, not an afterthought. This policy explains exactly what we collect, why, and what we will never do with your data — in plain language.
Overview
Papercargo ("we", "us", "our") operates the website at papercargo.com and the Ouroboros browser extension ("the extension"). This Privacy Policy describes how we handle information in connection with both.
We are committed to minimal data collection. We collect only what is strictly necessary to operate and improve our products, and we give you explicit control over everything we do collect.
What we collect
The table below describes every category of data we may collect, the basis for collection, and whether it requires your opt-in.
| Data | Why | Basis |
|---|---|---|
| Prompt length (character count) | Understand usage patterns and complexity distribution | Opt-in |
| Complexity classification | Measure how well our routing logic works | Opt-in |
| Approval decision (accepted / rejected) | Understand whether improvements are useful | Opt-in |
| Backend type (OpenRouter, Ollama, etc.) | Prioritise which integrations to improve | Opt-in |
| Time to decision (milliseconds) | Measure whether the diff view is being read | Opt-in |
| Prompt content (original + improved) | Train better prompt improvement models | Opt-in — separate toggle |
| Email address (waitlist only) | Notify you when new features launch | You provide this |
All event data is tagged with an anonymous session ID generated fresh each browser session. It is never linked to your email address, IP address, or any other identifying information.
What we never collect
These things are never transmitted to our servers under any circumstance:
| Data | Note |
|---|---|
| Your API key | Stored locally in Chrome's encrypted storage only. Never leaves your device. |
| Your IP address | Not logged by us. Supabase may log it transiently per their infrastructure — see their policy. |
| Browsing history | We don't track which sites you visit. The extension only activates when you open the drawer. |
| Account information | Ouroboros has no accounts. There is nothing to collect. |
| Prompt content (without opt-in) | If you have not toggled on "Share prompt content", we never see your prompts. |
| Keystrokes or clipboard | We do not log what you type. Provenance tracking is local only. |
Ouroboros extension — how it works
When you use the Ouroboros extension, your prompt is sent from your browser directly to your chosen AI backend (OpenRouter, Ollama, OpenAI, Anthropic, or Azure OpenAI) using your own API key. Papercargo never sees this request.
The improved prompt is returned to the extension and displayed in the drawer. You approve or reject it. Only after you take an action does the extension optionally log anonymised metadata to our servers — and only if you have opted in during setup.
Your API key is stored in Chrome's local extension storage
(chrome.storage.sync),
encrypted by Chrome and synced across your signed-in devices if you use
Chrome Sync. We have no access to it at any point.
Provenance tracking (detecting whether content was typed, pasted, or auto-populated) happens entirely in your browser. This data is never transmitted anywhere.
Waitlist & website
When you sign up for the Ouroboros waitlist at papercargo.com/ouroboros, we collect your email address. We use it to:
Notify you when the extension is publicly available or when significant new features launch. That's it. We do not send marketing emails, share your email with third parties, or add you to any other list.
Your email is stored in Supabase (see Storage section). You can request deletion at any time by emailing us.
The papercargo.com website does not use cookies, analytics trackers, or any third-party scripts beyond Google Fonts (for typography).
Data storage & security
Anonymised event data and waitlist emails are stored in Supabase, a hosted PostgreSQL service with data centres in the EU. Supabase provides encryption at rest and in transit, and row-level security is enforced so that data can only be inserted — never read — via the public API.
Data retained in Supabase is accessible only to Papercargo. We do not grant third parties access to this data. You can review Supabase's own privacy and security policies at supabase.com/privacy.
Extension configuration (API key, settings, prompt library) is stored locally using Chrome's storage API. We have no access to this data.
Your rights
Regardless of where you are located, you have the following rights with respect to any personal data we hold:
Access. You can request a copy of any data we hold about you.
Deletion. You can request deletion of your email from our waitlist
or any event data associated with your session ID at any time.
Correction. You can ask us to correct inaccurate data.
Portability. You can request your data in a machine-readable format.
Objection. You can object to processing of your data at any time
by turning off data sharing toggles in the extension settings, or by
contacting us directly.
For extension users: you can clear all locally stored data at any time from the extension's Settings tab → "Clear all data & reconfigure". This removes your API key, configuration, and prompt library from your device instantly.
To exercise any of the above rights, email us at hello@papercargo.com. We will respond within 30 days.
Children
Our products are not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.
Changes to this policy
We may update this policy as our products evolve. When we make material changes — changes that affect what data we collect or how we use it — we will update the "Last updated" date at the top of this page and, where appropriate, notify waitlist members by email.
We will never retroactively apply new data collection practices to data already collected. Any expansion of data collection will require fresh opt-in consent.
Contact
If you have any questions about this policy or how we handle your data, we're easy to reach.
For privacy requests, data deletion, or any questions about this policy — email us directly. We don't have a legal department, you'll get a human.
hello@papercargo.com