Legal

Privacy policy

Last updated: 1 July 2026

Cashew is a browser extension that displays a clearly labelled sponsored insert during the loading time of the AI assistants you already use (Claude, ChatGPT, Gemini, etc.), and pays you back 50% of the advertising revenue generated by your valid impressions. This policy describes, in full, what data we collect, how we use it, where it is stored and with whom it is shared.

The essentials

Cashew does not read, record or transmit the content of your conversations with AIs. The extension only detects the state of the interface ("generation in progress") to know when to display the insert. We never sell your data.

1. Data we collect

Account data

  • Email address, provided when you create your account (for authentication and managing your earnings).
  • Password, which you choose when creating your account and enter at each login. It is used solely for authentication. It is transmitted in encrypted form (HTTPS) to our authentication provider (Supabase), which stores it in hashed form (never in plain text). Cashew never stores your password and has no access to it in plain text.

Profile data (declarative targeting, optional)

  • If you choose to fill in the optional questionnaire, we keep your country, your age range and up to three general interests (for example: tech, finance, travel).
  • This information is provided voluntarily by you and is used only to display more relevant ads. You can skip the questionnaire: targeting is then disabled.
  • This targeting is declarative: it relies solely on what you state, never on the content of your conversations.

Activity data (linked to your account)

  • Ad impressions: which ad was displayed, timestamp, display duration and validity of the impression.
  • Clicks on the inserts.
  • Earnings and balance calculated from your valid impressions.

Technical data (fraud prevention and proper operation)

  • An anonymous local identifier ("client_id") generated and kept in your browser's local storage, used to deduplicate impressions and enforce per-account caps. Fraud prevention relies on checks linked to your account (impression validity, caps, deduplication), not on your IP address.

Preferences (stored locally on your device)

  • Your display currency and your language, your session (login token) — kept in the browser's local storage (chrome.storage), not on our servers.

2. What we do not collect

  • The content of your messages, prompts or replies exchanged with AI assistants.
  • Cashew never accesses your AI account (no OAuth, no API calls on your behalf): the extension only observes the visual state of the page to overlay the insert.
  • No browsing data beyond detecting the generation state on supported sites.
  • Your payment, identity or banking information (name, address, IBAN, ID document). To pay out your earnings, this data is provided and processed exclusively by Stripe, in its own secure environment, when you set up your payout account. Cashew does not receive it, does not see it and never stores it.

3. How we use your data

  • Create and manage your account and your session.
  • Display sponsored inserts during loading.
  • Calculate and credit you your share of revenue (50%) on your valid impressions.
  • Prevent fraud (detection of invalid impressions/clicks, caps, deduplication).
  • Make your payouts via our payment provider.
  • Provide advertisers with aggregated statistics (see §5).

4. Where your data is stored and secured

  • Your account and activity data are hosted in our database at Supabase (PostgreSQL), with access restricted by row-level security rules (each user only accesses their own data).
  • Exchanges are encrypted in transit (HTTPS). Sensitive keys are kept server-side only.

5. With whom your data is shared

We share your data only with the providers strictly necessary for the operation of the service:

  • Stripe (payments, identity verification/KYC and payout of your earnings). See Stripe's privacy policy.
  • Supabase (hosting of our database and authentication). See Supabase's privacy policy.
  • Advertisers: they receive only aggregated, anonymous statistics (number of impressions, clicks, click-through rate, spend). They never receive your personal data or information that could identify you.

We do not sell your data and do not share it for third-party advertising purposes. Your data may be disclosed if required by law.

6. Retention period

We keep your data as long as your account is active. You can request the deletion of your account and your data at any time (see §8). Some payment-related data may be retained by Stripe for legal and accounting obligations.

7. Local storage and cookies

The extension uses the browser's local storage (chrome.storage) to keep your session and your preferences (currency, language). We do not use third-party tracking cookies.

8. Your rights

In accordance with the GDPR and the Swiss Federal Act on Data Protection (nFADP), you have the right of access, rectification, erasure, objection and portability of your data. To exercise these rights, write to us at the address below.

9. Changes to this policy

We may update this policy. Any significant change will be announced and the "last updated" date at the top of the page will be refreshed.

10. Contact

For any question about your data or to exercise your rights: lpayer2006@icloud.com.

11. Visitors to partner sites (SDK)

Some partner sites display Cashew inserts during their loading times, via our SDK. If you visit one of these sites without having a Cashew account: we do not identify you and do not track your browsing from one site to another. A random technical identifier (cashew_cid) is stored in your browser's localStorage, solely to prevent fraud (display caps). It is not linked to any profile. Your IP address is never stored. No advertising cookie is set.