This notice covers the AltKit browser extension from version 2.4 onwards. The controller, Your rights, the complaint authority, transfers and retention are described in the main privacy policy, which applies to the extension in full.
The extension can create alt text in two ways: through Your free AltKit account (hosted generation), or with Your own API key for an AI provider You choose. You pick the mode in the extension settings; it never switches between them on its own.
What the extension does with Your data
- Images, hosted generation: only when You click "Create Alt Text" or use the context menu, the extension sends that one image to altkit.app. With the "Create Alt Text" button it reads the image from the page and sends it together with the address of the page You are on; with the context menu it downloads the image in Your browser, without Your cookies, and sends it together with the image's web address. Versions before 2.5.1 sent only the image's web address, and altkit.app downloaded the image from it, without Your cookies or sign-in. From there it is processed exactly as described in the main policy: our AI service passes it to DeepSeek to write the description, the image itself is not stored, and the generation counts towards Your account's daily limit. The alt text and that page or image address are saved in Your library, so You can see where each description was made, until You delete them or Your account. If You turned on library previews in Your account, the extension also sends a small preview of the image (at most 360 pixels, under 100 KB), made in Your browser, which is kept with the library item until You delete it or Your account; with previews off, the extension makes and sends none.
- Images, own key: if You added Your own API key, the extension sends the image and the alt text instructions directly from Your browser to the provider You chose (OpenAI, Anthropic, Google Gemini, DeepSeek or xAI). For an image You right-click, the extension first downloads the image itself (without cookies) so it can send it. AltKit receives nothing from these requests - no image, no alt text and no key - and does not log them. The provider acts for You under Your own account with it; its own terms and privacy policy apply, and usage and charges are between You and that provider. AltKit's daily limit does not apply.
- Your API key: stored only in the extension's local storage on that device. It is never synced to other devices, never sent to AltKit, and deleted when You remove it in the extension or uninstall it. The settings page shows only a short preview of the key.
- Sign-in: You sign in through Three Things Media Accounts (auth.altkit.app) using the OAuth authorization-code flow with PKCE. The extension then holds an AltKit access token, kept in the browser's extension storage and readable only by the extension itself, and sends it as an
Authorization: Bearerheader with each request to altkit.app. It does not use website cookies. Signing out deletes the token; it also expires on its own. - Settings: Your chosen mode, provider, model and similar choices are stored locally in the extension.
- Nothing else: the extension does not read Your browsing history and does not run analytics or telemetry.
Permissions
The extension asks only for what it needs: storage (settings, sign-in token and Your API key), the context menu, access to the active tab when You use it (to read the image You chose), the browser's sign-in support, and network access to altkit.app and auth.altkit.app. When You add an API key, the extension asks for permission to reach that provider's API address only. On supported social sites it adds the "Create Alt Text" button to the alt text dialog; it does not read the rest of those pages.
Your controls
- Nothing is sent until You ask for a description.
- Sign out in the extension or on Your account page; deleting Your account there removes Your data as described in the main policy.
- Remove Your API key in the extension settings at any time.
- Uninstalling the extension removes everything it stored locally, including Your API key.
Contact
Privacy questions: support@threethingsmedia.net.