Privacy Policy

What’s New in This Version — and What It Means for Your Privacy

Version 2.5.1 makes BEAST smaller, quieter, and more private. Every change below either collects less, shows less, or keeps more on your own device. Each one links to the section that explains it — with the actual source code.

Who We Are

BEAST — Making Life Elegant (“BEAST”, “the Extension”, “we”, “us”, or “our”) is a Chrome browser extension developed and maintained by Nextania Technologies Private Limited. This Privacy Policy governs all data handling practices associated with the Extension and our related services.

By installing or using BEAST — Making Life Elegant, you agree to the practices described in this Privacy Policy. If you do not agree, please uninstall the Extension.

Scope of This Policy

This Privacy Policy applies to:

• The BEAST — Making Life Elegant Chrome Extension (version 1.6.0 and above, including v2.0.0, v2.1.0, v2.2.0, v2.3.0, v2.4.0, v2.5.0, and v2.5.1)
• Our backend infrastructure at architectx2.nextaniatechnologies.workers.dev and the BEAST Focus relay at beast-focus-relay.nextaniatechnologies.workers.dev, which signs you in and carries the tasks you delegate
• Our website at nextania.in
• Sign-in with your BEAST Focus account, through which the Extension receives your plan. Plans and payments themselves are managed in BEAST Focus at focus.nextania.in, not in the Extension.
• The voice typing, AI Polish, Select-to-Slides, document analysis, and community features introduced in v2.1.0
• The Focus Grid life-planner with its copilots, the Claudy prompt companion, Autopilot, reminders, sticky notes, and the multilingual wellness companion introduced in v2.2.0
• The features introduced in v2.3.0: the Focus Grid Team copilot for task delegation, Gamify Education learning games, the YouTube watch-and-question quiz, the YouTube comment-assistant and reminder companions, Claudy’s ability to send an open Gmail message to your Focus Grid on your explicit click, and cosmetic refinements to the interface and icons
• The features introduced in v2.4.0: Resume Studio (build a polished résumé from details you enter, with optional AI expansion of sparse entries); the Select-to-Slides deck engine now optionally illustrating slides with openly-licensed images from Wikimedia Commons and NASA; the Focus Grid Files evidence tracker and Agent-Crafted Checklists; the Field Helper Reminders drafts helper that inserts a message you composed into a Gmail compose box on your click; a permanent, privacy-positive coupling that binds one email to one license key to one BEAST ID so nothing need ever be re-collected; and refinements to input focus, notifications, and the interface
• The changes in v2.5.0 and v2.5.1: sign-in with BEAST Focus by verified work email and one-time code (with the Chrome profile’s email offered as a pre-fill); ✦ Delegate, which turns a Gmail message into a task for a BEAST Focus colleague; the BEAST sidebar now appearing only in Gmail; and the retirement of the Focus Grid planner and its Team copilot, the Claudy companion, the YouTube comment assistant, the free trial, and all in-extension payment screens

This policy does not apply to third-party services we integrate with (such as OpenAI, Google, or Resend), which maintain their own privacy policies linked in Section 7.

What We Collect

We collect the minimum data necessary to provide the Extension’s features. The table below details every category of data we handle.

What We Do Not Collect

• Your email content — We do not read, store, or scan your Gmail inbox. Email text is only processed when you explicitly press a BEAST action button, such as ✦ Delegate or Auto Compose.
• Browsing history — We do not track which websites you visit.
• Webpage content — We do not read, scrape, or transmit the content of any non-Gmail webpage you visit — except text you explicitly select, or place your cursor in, and then submit via a BEAST action button (such as AI Polish or Select-to-Slides). That text is processed on demand to fulfil your request and is never stored.
• Keystrokes or form data — We do not log anything you type outside of BEAST’s own sidebar. Text you deliberately submit to a BEAST action — for example AI Polish, Select-to-Slides, or voice typing — is processed only at that moment and is never logged or stored. BEAST’s writing helpers never attach to password fields or one-time-code / OTP fields, as proven by code in Section 5G.
• Cookies — We do not use cookies for tracking or analytics.
• Personal financial data — The Extension contains no payment screens and never handles payments. Plans are purchased within BEAST Focus, where payment processing is handled entirely by Cashfree (INR) and PayPal (international/USD). We never see or store your card details.
• Your Google account — BEAST does not use Google sign-in, OAuth, or any Google API to access your account, mail, contacts, or calendar. Its only identity call, chrome.identity.getProfileUserInfo, reads your Chrome profile’s email address solely to pre-fill the sign-in box; it is never stored, logged, or sent by itself (see Section 5C).
• Student personal data beyond the session — Student names and registration numbers entered during BEAST Quiz are never retained beyond seventy-five minutes and are never used for any purpose other than the live quiz session.
• A directory of users — BEAST keeps no searchable directory of people. When you delegate from Gmail, you choose only among your own BEAST Focus contacts — people you have already connected with in BEAST Focus — and the relay reveals a contact’s email address only to someone who already has that person as a contact.

No Trial, No Fingerprinting

From version 2.5.0, BEAST no longer offers a free trial and no longer creates any device fingerprint. Installing BEAST sends nothing to our servers: it simply opens the sign-in page.

Earlier versions created a one-way hash (SHA-256) of the IP address and browser user-agent, and, for email trials, a one-way hash of the email, solely to ensure one fair trial per person. These hashes are no longer created; any that remain from earlier versions are deleted automatically within 365 days of their creation, and were never sold, shared, or used for marketing.

Where BEAST Appears — and Why It Asks for Access to All Sites

From version 2.5.0, the BEAST sidebar and its floating button (✦) appear only in Gmail. On every other website BEAST is invisible and dormant, until you use one of the few features that are meant to help you wherever you are.

What BEAST Does Outside Gmail — Only When You Ask

• Select-to-Slides — select a passage on any page, and a small button offers to turn it into a slide deck. Only the text you selected is sent, and only when you click.
• Reminders — when a reminder you set is due, a friendly companion shows it on the tab you are using. The reminder lives only on your device.
• Google Forms builder — when you ask BEAST in Gmail to draft a form, BEAST fills a new Google Form for you. It acts only on the form you asked it to build.
• YouTube lecture reader — when a teacher asks BEAST Quiz to check a lecture video, BEAST reads that video’s transcript once (see Section 5F).
• Wellness companion — on Google Search, a gentle wellness companion can show calming phrases. It is off by default and appears only if you switch it on.

What BEAST Does and Does Not Do on a Page

The host_permissions: <all_urls> permission is required so that Select-to-Slides and your reminders can work on whichever site you are on, and so that the chrome.scripting API can restore BEAST into tabs that were already open when you installed or updated it. It is never used to read, collect, or transmit the content of the pages you visit. Every permission BEAST requests is explained in Section 5J.

Gmail Automation — Zero Data Storage, Verified by Code

The Complete Data Journey — Proven by Source Code

We believe transparency earns trust. Below is the actual source code from both the BEAST Chrome Extension (content.js) and the Nextania Cloudflare Worker — the complete chain from the moment you click to the moment your AI response appears. You can verify every line.

① Extension — Reading the Email content.js · checkEmail() + triggerAutoReply()

When you open an email, BEAST reads the subject line, sender, and up to 800 characters of body text from the Gmail DOM — only if auto-reply is enabled or you click an action button. This text lives exclusively in the browser’s memory and is never written to any storage.

// Reads email from Gmail DOM — on user action only.
// Text is held in browser memory. Never written to storage.
function checkEmail() {
  let emailBody = "";
  for (const s of ["div.a3s.aiL", "div[data-message-id] .ii.gt div"]) {
    const el = document.querySelector(s);
    if (el) { emailBody = el.innerText.trim().slice(0, 800); break; }
  }
  // Passed directly to callWorker() — never stored anywhere
  if (autoReply) triggerAutoReply(sender, subject, emailBody);
}

async function triggerAutoReply(sender, subject, body) {
  const sys = `You are an elite email assistant. Tone: ${tone}.
Write a reply. 3-5 sentences. Return ONLY the reply body.`;
  // Email text flows directly into callWorker() — no storage call
  currentDraft = await callWorker(sys,
    `From: ${sender}\nSubject: ${subject}\n\n${body}`);
  // currentDraft holds only the AI reply — displayed in sidebar
  render("draft", { mode: "reply", draft: currentDraft });
}

② Extension — Sending to Worker content.js · callWorker()

The email text is transmitted over HTTPS to our Cloudflare Worker — authenticated by your license key. No third-party service other than our Worker receives this data.

async function callWorker(sys, usr, maxTokens = 1000) {
  // Sent over HTTPS — license key authenticates the request
  const r = await fetch(WORKER_URL, {
    method: "POST",
    headers: {
      "Content-Type":           "application/json",
      "X-Nextania-License-Key": licenseKey,
    },
    body: JSON.stringify({
      agent: "beast_mailer",
      request_payload: { model: "gpt-4.1-mini", input: sys + usr }
    })
  });
  const d = await r.json();
  // Returns only output_text — the AI reply. Nothing else.
  return (d.output_text || "").trim();
}

③ Worker — Processing and Discarding ArchitectX2 Worker · /architect/v1/job

The Worker receives the request, validates your license, passes the text to OpenAI’s API, and immediately returns the AI response. The only data written to storage is the token count deducted from your quota — never the email content.

// ① Validate license — reject if inactive or expired
const status = await env.LICENSE_KV.get(`license:${licenseKey}:status`);
if (status !== "active") return json({ error: "License inactive" }, 403);

// ② Extract text from request — held only in memory
const { model, input, temperature, max_output_tokens }
  = body?.request_payload || {};

// ③ Pass to OpenAI — text leaves our system here
const oa = await fetch("https://api.openai.com/v1/responses", {
  method: "POST",
  body: JSON.stringify({ model, input, temperature, max_output_tokens }),
});

// ④ Extract AI reply text
const output_text = extractOutputText(data);

// ⑤ Only token count is stored — NEVER the email content
const used = Number(data?.usage?.total_tokens || 0);
await env.LICENSE_KV.put(
  `license:${licenseKey}:base_tokens_remaining`,
  String(remaining - used)  // quota deduction only
);

// ⑥ Return AI reply — request object is garbage collected
return json({ ok: true, output_text });

Voice Typing — Zero Audio Storage, Verified by Code

The Complete Audio Journey — Proven by Source Code

As with Gmail, we show you the real path your voice takes — from the moment you speak to the moment text appears in your field. You can verify every line.

① Extension — Capturing & Releasing the Audio field-helper.js · offscreen.js

Audio is recorded into an in-memory blob only while you dictate. The instant you stop, the microphone is released, the audio is sent for transcription, and the blob is dropped — never written to localStorage, chrome.storage, IndexedDB, or disk.

// Mic opens ONLY when you press 🎤 and start dictating.
// Audio lives in memory as a Blob — never written to storage.
async function startDictation() {
  const stream = await navigator.mediaDevices.getUserMedia({ audio: true });
  const rec = new MediaRecorder(stream);
  const chunks = [];
  rec.ondataavailable = e => chunks.push(e.data);

  rec.onstop = async () => {
    // Stop the mic immediately — the capture window is over
    stream.getTracks().forEach(t => t.stop());
    const audio = new Blob(chunks, { type: "audio/webm" });
    // Sent straight to our Worker for transcription — never saved
    const text = await sendToTranscribe(audio);
    insertAtCaret(text);  // text appears in your field; audio is dropped
  };
  rec.start();            // recording begins only on your explicit action
}

② Worker — Transcribing & Discarding ArchitectX2 Worker · /architect/v1/transcribe

The Worker validates your license, passes the audio to OpenAI’s Whisper model, returns the transcript, and writes only the token count to storage. The audio blob is never persisted and is garbage-collected the moment the request ends.

// ① Validate license — reject if inactive or expired
const status = await env.LICENSE_KV.get(`license:${licenseKey}:status`);
if (status !== "active") return json({ error: "License inactive" }, 403);

// ② Receive the audio — held only in memory for this request
const form = await request.formData();
const audio = form.get("file");          // never written to KV or disk

// ③ Transcribe with OpenAI Whisper — audio leaves our system here
const fd = new FormData();
fd.append("model", "whisper-1");
fd.append("file", audio, "speech.webm");
const r = await fetch("https://api.openai.com/v1/audio/transcriptions", {
  method: "POST", body: fd,
});
const { text } = await r.json();         // the transcript only

// ④ Only the token count is stored — NEVER the audio or transcript
await env.LICENSE_KV.put(
  `license:${licenseKey}:base_tokens_remaining`,
  String(remaining - used)  // quota deduction only
);

// ⑤ Return the text — the audio Blob is garbage collected
return json({ ok: true, text });

Sign-in with BEAST Focus — Your Work Email, Verified by Code

The Sign-in Journey — Proven by Source Code

Below is the actual code, from the Extension’s sign-in page (beast-welcome.js) and from the BEAST Focus relay (focus-relay-worker.js). You can verify every line.

① Pre-filling the Box — Read Once, Kept Nowhere beast-welcome.js · identity.email

When the sign-in page opens, BEAST asks Chrome for the profile’s email and writes it into the email box. It goes into no storage and no network request.

// The Chrome profile's email, when Chrome shares it, fills the field.
// It is placed in the input box only: never stored, never sent by itself.
chrome.identity.getProfileUserInfo({ accountStatus: "ANY" }, (info) => {
  void chrome.runtime.lastError;
  const e = String((info && info.email) || "").trim().toLowerCase();
  if (e && validEmail(e) && !emailInput.value) {
    profileEmail = e; emailInput.value = e; show(fromProfile);
  }
});

② Asking for a Code — Only on Your Tap beast-welcome.js · requestCode()

Nothing is sent until you tap Send code. Then the address in the box — and nothing else — is sent over HTTPS to the BEAST Focus relay.

// Runs only when YOU tap "Send code". The address in the box
// (which you may change) is the only thing sent.
sendBtn.addEventListener("click", requestCode);

const resp = await fetch(SEND_URL, {          // the BEAST Focus relay
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ email }),
});

③ The Relay — Verifies, Never Creates focus-relay-worker.js · /v1/ext/login_send

The relay checks that the address is a verified BEAST Focus email. If it is, a six-digit code is emailed to it and kept only as a one-way hash for ten minutes, with five tries. If it is not, the relay answers with a sign-up link and stores nothing.

// An address that is not a verified BEAST Focus email is simply
// asked to sign up at focus.nextania.in. No account is ever made here.
if (!okRec || okRec.e !== e) {
  return json({ ok: false, signup: true, url: "https://focus.nextania.in" }, 404);
}
// The six-digit code is stored only as a one-way hash, and expires.
const code = g1aCode(), now = Date.now();
await g1aPut(env, "extlc:" + eh, JSON.stringify({ id: owner,
  h: await g1aHash(code + "|" + eh),           // hashed, never plain
  exp: now + G1A_CODE_SEC * 1000, n: 0, sent: now }), G1A_CODE_SEC + 300);

const G1A_CODE_SEC = 600;    // a code lives ten minutes
const G1A_TRIES = 5;         // and allows five tries
const G1A_RESEND_MS = 60000; // one new code a minute

④ Signed In — What Stays on Your Device beast-welcome.js · signIn() · popup.js · Sign out

With the right code, the relay returns your account reference, your first name, a masked email, and your plan’s licence key. BEAST keeps exactly these, in your browser’s local storage. Your BEAST ID works only in the background and is never shown. Sign out removes all of it at once.

// After the correct code, BEAST keeps only this, on your own device:
const auth = { id: String(data.id), first: String(data.first || ""),
               email: String(data.email || ""),   // already masked: me•••@company.com
               at: Date.now() };
const payload = { licenseKey: key, isTrial: false, trialSubEndMs: 0, ptAuth: auth };
chrome.storage.local.set(payload, () => { /* … */ });

// Sign out removes the account, the key and every task list.
chrome.storage.local.remove(["licenseKey","isTrial","trialSubEndMs","ptAuth",
  "ptAccepted","ptReceived","ptSent","ptSeen","ptContacts"], () => { /* … */ });

✦ Delegate — From Gmail to BEAST Focus, Verified by Code

The Delegation Journey — Proven by Source Code

This is the one place where BEAST places your words on a server — in your own BEAST Focus account — so we show the exact code, including what is sent and what is not. The Extension code is in priority-tasks.js; the relay code is in focus-relay-worker.js.

① Reading the Email — Only on Your Tap priority-tasks.js · ✦ Delegate · openedSource()

The ✦ Delegate pill does nothing until you click it. Then BEAST reads the subject, the sender’s name, the latest message text, and the addresses on that one email, and opens a small card where you see and edit the task.

// The ✦ Delegate pill sits beside Gmail's Send, Reply and Forward.
// The email is read only inside this click handler — never before.
b.addEventListener("click", (e) => {
  e.preventDefault(); e.stopPropagation();
  openCard(getSource());              // reads THIS email, now, once
});

function openedSource(bar) {          // the message Reply/Forward act on
  return {
    kind: "opened",
    subject: threadSubject(),
    from: sender ? (sender.getAttribute("name") || sender.textContent || "").trim() : "",
    body: last ? last.innerText.trim() : "",
    emails,                           // used on this device only (step ②)
  };
}

② Suggesting the Colleague — Matched on Your Device priority-tasks.js · relay /v1/guests

To pre-select the right person, BEAST compares the email’s addresses with the addresses of your own BEAST Focus contacts. The comparison happens in your browser; the email’s addresses are never sent. The relay returns a contact’s address only to someone who already has that person as a contact.

// Your own contacts' addresses, kept in memory only, to recognise
// the person on an email. They are compared here, on your device.
let contactEmails = {};   // { "melvin@x.com": "BEAST-…" }
return Promise.all(chunks.map((ch) => relay("/v1/guests", "POST", { ids: ch })))

// The fence: only the caller's OWN contacts, nothing beyond.
const raw = await env.TASKS.get("contacts:" + myId);
(JSON.parse(raw || "[]") || []).forEach(function (c) {
  if (c && c.id) mine[String(c.id).toUpperCase()] = 1;
});
for (const id of want) {
  if (!mine[id]) continue;            // not your contact: nothing returned
  const em = await addressOf(env, id);
  if (em) guests[id] = em;
}

③ Delegating — Only the Approved Task Travels priority-tasks.js · Delegate → relay /v1/send

When you tap Delegate, BEAST sends the task text you approved (280 characters at most), your first name, the colleague’s name, and the optional due date and verifier. Nothing else.

// Only when YOU tap "Delegate". Exactly this object travels:
const text = (taskEl.value || "").trim().slice(0, TASK_MAX);   // 280 at most
const task = { t: text, from: myName || "A teammate", workerName: toName };
if (dueAt && dueAt > Date.now()) task.dueAt = dueAt;           // optional
if (vId && vId !== to) { task.verifierId = vId; task.verifierName = vName; }
const res = await relay("/v1/send", "POST", { to, task });
// No email body, no subject, no addresses, no attachments.

④ Rephrasing — Processed, Then Discarded priority-tasks.js · rewriteAsTask() · ArchitectX2 Worker

A long email is condensed into one task by our AI Worker — the same path, with the same no-storage guarantees, as every BEAST writing feature (Section 5A). A short email is used as it is, unless you tap Rephrase.

// Rephrasing: the email's text goes to our AI Worker only when it
// is longer than 280 characters, or when you tap "Rephrase".
const usr = "SUBJECT: " + (src.subject || "") + "\nFROM: " + (src.from || "")
          + "\n\n" + String(src.body || "").slice(0, 6000);
const r = await fetch(WORKER, { method: "POST",
  headers: { "Content-Type": "application/json", "X-Nextania-License-Key": licenseKey },
  body: JSON.stringify({ agent: "beast_mailer", request_payload: { /* … */ } }) });
// Processed and discarded, exactly as in Section 5A.

⑤ Your Task Lists — Read-Only, in Step with BEAST Focus priority-tasks.js · /v1/inbox · Mark as done

The 📥 Tasks panel shows what you received and sent. It only reads your BEAST Focus account, never clears anything there, and reports Mark as done exactly as the BEAST Focus app does.

// Received tasks are only READ from your BEAST Focus account.
relay("/v1/inbox", "GET").then((res) => { /* … */
  // Notices are read, never cleared: BEAST Focus clears its own.
});
// "Mark as done" tells BEAST Focus, as the BEAST Focus app itself does.
p = relay("/v1/respond", "POST", { taskId: t.taskId, action: "accept" })
  .then(() => relay("/v1/respond", "POST",
    { taskId: t.taskId, action: "done", fromId: t.fromId, t: t.t, byName: by }));

Gamify Education — Zero Storage, Verified by Code

For the Random Association game, images of an everyday object and a topic are fetched from Wikimedia / Wikipedia’s public APIs to display side by side. Only the search word travels to Wikipedia; no personal data is involved, and nothing is stored.

// The teacher types a topic. It is sent to the AI Worker to
// generate puzzles. The result is rendered on screen only —
// there is no storage call anywhere in this path.
var prompt = buildPrompt(curGame, topic);
callWorker({ model: "gpt-4.1-mini", input: prompt })
  .then(function(raw) {
    var arr = parseJSONArray(raw);
    startStage(arr);   // shown on screen — never written to storage
  });

YouTube — Lecture Transcript Reader, Zero Storage

The YouTube watch-and-question feature (BEAST Quiz · Watch) lets a teacher turn a lecture video into quiz questions. As with all BEAST AI features, the transcript text is processed on demand to generate questions and is not retained — and any resulting live quiz session follows the same strict deletion rules described in Section 7A (auto-deleted within seventy-five minutes by three independent mechanisms).

// Runs on youtube.com/watch, but does NOTHING on its own. It acts only
// when the BEAST Quiz teacher page asks it to check a lecture video.
chrome.runtime.onMessage.addListener((msg, _sender, sendResponse) => {
  if (msg && msg.type === "ytVerifyTranscript") {
    showAnalyzingToast();            // tells you what is happening
    verify().then((verdict) => { removeAnalyzingToast(); sendResponse(verdict); });
    return true;
  }
});
// The verdict goes back to the Quiz page only — nothing is stored:
// { ok:true, videoId, title, lang, auto, wordCount, text }

Password & OTP Fields — Never Touched, Verified by Code

if (tag === "INPUT") {
  const t = (el.getAttribute("type") || "text").toLowerCase();
  if (t === "password") return false;   // never on passwords

  // Never on one-time-code / OTP / card / PIN fields
  const ac = (el.getAttribute("autocomplete") || "").toLowerCase();
  if (ac === "one-time-code" || ac === "cc-number" ||
      ac === "cc-csc") return false;

  const hint = (name + id + ariaLabel + placeholder).toLowerCase();
  if (/\b(otp|one-time|2fa|mfa|verification code|passcode|
        security code|auth code|cvv|cvc|pin)\b/.test(hint))
    return false;   // sensitive — BEAST stays away
}

Resume Studio — Built On Your Device, Verified by Code

// Your résumé draft is saved ONLY to your own device.
// There is no server call in the save or load path.
function saveDraft() {
  chrome.storage.local.set({ beastResumeDraft: JSON.stringify(model) });
}

// The .docx is assembled in your browser and downloaded to you.
// Your photo is embedded locally — it never leaves the device.
const blob = buildDocxBytes(model);   // built in-page
triggerDownload(blob);              // saved to your computer

// AI enhancement is OPTIONAL and sends only chosen fields,
// returning polished text — nothing is stored on our servers.
const improved = await callWorker(enhancePrompt, chosenText);

Slide Images — Only Free, Legal Sources, Verified by Code

// The ONLY two image endpoints BEAST ever calls.
// A search word travels — never any personal data.
const WIKIMEDIA = "https://commons.wikimedia.org/w/api.php";
const NASA      = "https://images-api.nasa.gov/search";

// Each image is credited on the slide with author + licence,
// captured from the source's own metadata.
return { url, source: author + " / " + license +
                       " · Wikimedia Commons" };

// If no free image is found, the slide stays text-only.
if (!meta) { slide.template = "textOnly"; }

Every Permission, Explained

BEAST requests only the permissions its features need, and uses each one only for the purpose below.

How We Use Your Data

Work Email, Account & License Key

Your BEAST Focus work email is used only to send you a one-time sign-in code. Your Chrome profile’s email is used only to pre-fill the sign-in box, and is never stored. Your license key, received from your BEAST Focus account at sign-in, is used only to validate your plan on each AI request. We do not send marketing emails without your explicit consent.

Career Profile Data

Stored locally on your device. Sent to our AI worker only when you click “Scan Opportunities Now.” Used solely to generate personalised job and opportunity matches. Never used for advertising or shared with third parties.

AI-Submitted Text

Text you type into BEAST’s sidebar is transmitted to our Cloudflare Worker, passed to the AI model, and the result is returned to you. This data is processed in real-time and is not stored, logged, or used for model training.

Voice Typing Audio

When you dictate, your microphone audio is streamed to our Cloudflare Worker, transcribed by OpenAI Whisper, and the audio is discarded the moment transcription completes. Only the resulting text is returned to your field. Audio is never stored, never used for profiling, and never used to train any model. See Section 5B for the source-code proof.

On-Page Text — AI Polish & Select-to-Slides

When you click AI Polish or Select-to-Slides, the specific text you selected or focused is sent to our Worker, processed by the AI model, and returned to you (a rephrased version, or a slide deck). This happens only on your explicit click, is processed in real-time, and is not stored, logged, or used for training. These helpers never attach to password or one-time-code fields (see Section 5G).

Wellness Companion

The wellness companion shows gentle phrases from a built-in local library; only when you type a custom mother tongue does a language name travel to our Worker to fetch fresh phrases, and no personal text is involved.

✦ Delegate — Task Delegation from Gmail

When you tap ✦ Delegate, BEAST reads that one email to draft a task for you. If the email is longer than 280 characters, or you tap Rephrase, its text is sent to our AI Worker to condense it, and is then discarded. When you tap Delegate, only the task you approved — with the colleague’s name, and the optional due date and verifier — is placed in your and your colleague’s BEAST Focus accounts, so you both can follow it. The email’s addresses are compared with your own BEAST Focus contacts on your device, and never sent. Full source-code proof is in Section 5D.

Gamify Education, YouTube & Reminders

The learning-game topic you type is sent to our Worker only to generate puzzles, and is never stored. The YouTube lecture reader acts only when BEAST Quiz asks it to check a video, and the reminder companion shows only reminders you set; neither stores anything on our servers. See Sections 5E and 5F.

Stock Tree — Educational, Historical Analysis Only

The Stock Tree examines the past factors that historically supported or suppressed a stock’s growth, purely for education and understanding. The stock name you enter is processed by our AI Worker to generate this historical analysis and is not stored. The Stock Tree does not predict future performance and is not financial, investment, or trading advice; any decisions you make remain your own.

Plans & Payments

The Extension has no free trial and no payment screens, and it never handles payment information. Your plan comes from your BEAST Focus account, where plans are purchased and managed at focus.nextania.in. Your work email is never sold, shared with data brokers, or used for marketing without your explicit consent.

We Never

• Sell your data to any third party
• Use your data for advertising
• Share your data with data brokers
• Use your data to train AI models

Third-Party Services

BEAST integrates with the following third-party services. Each has its own privacy policy governing their data handling.

BEAST Quiz — Student Data & Privacy

BEAST Quiz is designed with student privacy as a first principle. The session data flow is as follows:

• Data entered: Student name and registration number only — entered voluntarily to join a live session. No email address is collected or stored.
• Storage: Held temporarily in Google Firebase Firestore solely to relay real-time session information between teacher and students.
• Deletion — Mechanism 1: Immediately and permanently deleted the moment the teacher downloads results (Quiz), ends the race (Race), or ends the Engage session — whichever comes first.
• Deletion — Mechanism 2: Automatically deleted after seventy-five minutes via a client-side cleanup timer, regardless of teacher action.
• Deletion — Mechanism 3: Firebase TTL (Time-to-Live) policy auto-deletes every session document server-side at exactly seventy-five minutes from creation — an independent server-enforced guarantee that operates even if the browser is closed.
• No retention: No student data is retained, exported, logged, or used for any purpose beyond the live session.

Verified by Code — Our Deletion Implementation

In the spirit of full transparency, the following is the actual deletion function from BEAST Quiz and the TTL timestamp field — both verifiable in our published extension source:

// Called on: teacher downloads results, ends race,
// ends session, or 75-minute auto-timer fires.
function deleteSessionData(sessionCode, raceCode, engageCode) {
  var ops = [];
  if (sessionCode) ops.push(deleteCollection("sessions", sessionCode));
  if (raceCode)    ops.push(deleteCollection("races",    raceCode));
  if (engageCode)  ops.push(deleteCollection("engage",   engageCode));
  return Promise.all(ops).catch(function() {});
}

// Every session document carries a server-enforced
// TTL timestamp — Firebase auto-deletes at 75 minutes.
expireAt: new FSTimestamp(new Date(Date.now() + 75 * 60 * 1000))

Data Retention

You may request deletion of your email and license data at any time by contacting nextaniatechnologies@gmail.com. We will action deletion requests within 30 days.

Security

We implement industry-standard security measures to protect your data:

• All data in transit is encrypted via HTTPS/TLS
• License keys are validated via HMAC-signed request headers
• No sensitive data is stored in plaintext
• Our worker runs on Cloudflare’s enterprise-grade infrastructure
• Sign-in codes are one-time, stored only as one-way hashes, expire in ten minutes, allow five tries, and are rate-limited per address and per network
• Payment data never touches the Extension or our servers — BEAST Focus payments are handled by Cashfree’s and PayPal’s PCI-DSS compliant systems

If you believe you have discovered a security vulnerability, please contact us immediately at nextaniatechnologies@gmail.com.

Your Rights

Regardless of your location, you have the following rights with respect to your personal data:

Access

You may request a copy of the personal data we hold about you (your work email, license key, and the tasks you delegated).

Correction

You may request correction of inaccurate data at any time.

Deletion

You may request deletion of your account data. Local data (career profile, preferences, your signed-in account and task lists) can be deleted at once with Sign out in the BEAST popup, by uninstalling the Extension, or by clearing Chrome’s extension storage.

Portability

You may request your data in a portable, machine-readable format.

Opt-Out of Communications

You may opt out of non-essential communications at any time by emailing us.

To exercise any of these rights, contact nextaniatechnologies@gmail.com. We respond within 30 days.

Children’s Privacy

BEAST — Making Life Elegant is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at nextaniatechnologies@gmail.com, and we will delete it promptly.

BEAST Quiz is used by teachers in classrooms. Students who join a quiz enter only a name and registration number, need no account, and their session data is deleted within seventy-five minutes, as described in Section 7A.

Changes to This Policy

We may update this Privacy Policy as BEAST evolves. When we do, we will revise the “Last Updated” date and version at the top of this page, and describe what changed — as we have done in What’s New in 2.5.1. If a change would use your data in a materially different way, we will tell you within the Extension before it takes effect, and ask for your consent where the law or the Chrome Web Store requires it.

Continuing to use BEAST after an update means you accept the revised policy. If you do not agree, you may sign out and uninstall the Extension at any time.

Contact Us

For any question about this Privacy Policy, your data, or a deletion request, please write to us. We respond within 30 days.