AssisT Privacy Policy

Adaptive Accessibility Chrome Extension

Last Updated: 5 October 2026
Effective Date: 5 October 2026
Applies to: AssisT 1.0.0

1. Overview

AssisT is a Chrome extension that adds reading, writing and study supports to the pages a student works on, including Canvas, Moodle and Google Classroom. This policy says exactly what leaves your device, when, and to whom, and what stays on it.

This page is complete on its own. It is also the address Chrome Web Store shows for AssisT's privacy policy.

2. What Fiavaion Collects

Nothing. Fiavaion runs no server that the extension talks to, so there is nothing for us to collect, store or pass on.

3. Consent: Nothing of Yours Leaves Your Device Until You Say Yes

Every request that would send something you selected, typed or said to an outside service is checked against one rule first: has the student said yes to this service? If not, the request is refused and nothing is sent. The only services not asked about are Hugging Face, which serves a Browser AI model when you choose one and receives no text of yours, and online read-aloud voices, which you choose in the voice picker.

3.1 How you are asked

• During setup. The welcome page that opens when you install AssisT asks only about the services your own choices would use, one question per service, with Allow and Don't allow. If you choose nothing that needs an outside service, you are asked nothing.
• The first time you use a feature. If you skip setup, you are asked the same question the first time you use a feature that needs it, and asked once.
• A missing answer is not a yes. A question you skipped, or an answer AssisT cannot read, means "ask again", never "allowed".
• Saying no keeps things working where it can. A dictionary lookup or translation you have not allowed explains why nothing happened, instead of doing nothing.
• Chrome asks too. Each outside service also needs a Chrome permission (see section 5). Chrome's own prompt appears in the same press as your Allow, never in advance and never at install.
• A small AssisT window. Chrome only lets an extension ask for a site permission from its own windows. So when the question comes up on a course page, it opens in a small AssisT window, and a note on the page says it is asking in a separate window. Closing the window is not an answer: nothing is recorded and nothing is sent.

3.2 How you change your mind

In the AssisT popup, open Advanced options (the gear button), then the Your data tab. It lists every service with your answer (allowed, not allowed, or not asked yet), and every AI key saved on this computer. You can change any answer, or remove any key, there. A change takes effect on the very next request, not the next time a page loads. Removing an AI key also records a no for that provider.

3.3 Your answers stay on this device

Your answers are kept on the computer you gave them on. They are never part of a settings file you export, so they cannot travel to another computer by accident.

4. Every Service AssisT Can Reach, and What It Receives

This is the complete list. Each service is contacted only for the reason given, and only once you have said yes or chosen the feature that needs it. Fiavaion is not in the path: your browser talks to the service directly, and each service is covered by its own privacy policy once a request reaches it.

Pages and files you are already viewing

To read the text in an image or PDF on the page you are viewing, AssisT may download that same file again from the site it came from. This is the site you are already using; nothing is sent to anyone else.

5. Chrome Permissions Explained

This is the complete list. Every API permission and every host permission in AssisT's manifest.json at version 1.0.0 appears below, with one line saying why it is there. Chrome shows you the same list at install time; if the two ever disagree, trust Chrome and tell us.

5.1 API permissions

5.2 Host permissions granted at install

These are the only addresses AssisT may reach without asking Chrome again: the learning platforms it runs on, and Hugging Face, which is contacted only when you download a Browser AI model. No other outside service is granted at install.

On the learning platforms above, AssisT reads the page to provide its supports. That reading happens on your device. Page text is sent only to a service you have said yes to, as described in section 4.

5.3 Optional host permissions: asked for when needed, never at install

Each of these is asked for by Chrome in the same press as AssisT's own question, so you see both at once.

Withdrawing a service under Advanced options, Your data, gives its permission back too. You can also withdraw any of these at any time in Chrome: Settings, Extensions, AssisT, Site access. "Enable Everywhere" uses Chrome's own permission prompt, so Chrome, not AssisT, asks you and records your answer.

6. What Is Stored, and Where

Everything AssisT stores is kept in Chrome's own storage for the extension, on the computer you use (chrome.storage.local and IndexedDB). None of it is synced to a Fiavaion server, because there isn't one.

6.1 Settings and choices

• Which supports are on, and their settings (voice, speed, fonts, spacing, colours and so on)
• Keyboard shortcuts and profiles
• Your AI mode and model choices
• Your consent answers (section 3)

6.2 Things you make

• Citations and citation projects, in IndexedDB
• Mind maps, including their notes and anything sent with "Add to mind map", in IndexedDB
• Annotations and sticky notes, organised by the page you made them on
• Flashcards and when each is next due
• Authorship Shield writing history, if that support is on: a record of how your writing developed. It is never uploaded; it leaves your device only if you export it and send it yourself
• Custom dictation vocabulary: words you add for Speech-to-Text
• Downloaded Browser AI models, kept in browser storage until you remove them
• Read from Images language files for languages other than English, kept in AssisT after their one download

6.3 The record of how you work

"Keep a record of how I work" is off until you turn it on. When on, it counts how often you use each tool, which reading speed you choose, how many words were read to you, how many days in a row you have used AssisT, whether you said an answer helped, and which kinds of explanation you take. The counts stay on your device. See what is recorded in the popup shows every count it holds, and Delete this record removes it after asking you to confirm.

"Offer help when reading gets hard" is also off until you turn it on. It watches your scrolling, how long you stay on a paragraph and how often you look words up, so it can offer to read aloud or simplify. It saves nothing.

6.4 For schools: managed storage

An institution that deploys AssisT through managed Chrome policy can give it one setting, an institution key that applies the institution's name and colours. AssisT reads it from Chrome's managed storage (chrome.storage.managed). It is cosmetic only, grants AssisT no extra access, and carries nothing about any student.

6.5 Saved AI keys

If you save a key for a cloud AI provider, it is encrypted on your device (AES-GCM, with a key derived from random values created when you first save a key). It is never sent to Fiavaion, and is sent only to the provider it belongs to, when you use that provider.

To be plain about what this protects: it stops a saved key being read at a glance if the stored value is seen or copied on its own. It does not protect the key from someone who can read the extension's storage on that computer, because what is needed to decrypt it is stored there too. Settings files never contain a key at all. If you use AssisT on a shared or public computer, remove your keys under Your data when you have finished.

6.6 Settings files

Advanced options can save your settings to a file, to move to a new computer or keep as a backup. The file is built from a fixed list of setting names, and never holds an AI key, a consent answer, your citations, notes or highlights.

7. What AssisT Never Does

• Collect or store personal information
• Track your browsing
• Use analytics, crash reporting or tracking services
• Share data with advertisers, or sell or monetise data
• Require an account or login
• Send anything to Fiavaion (we have no server that receives user data)
• Send anything you select, type or say to a service you have not said yes to
• Run on sites outside the learning platforms above unless you press "Enable Everywhere"

8. Educational Privacy Laws

Fiavaion is not certified under any of the laws below and makes no compliance claim on your institution's behalf. What we can state is what the extension does, and what it does not do. If you or your institution need that read against a specific legal requirement, your own data protection officer is best placed to judge, and we are glad to answer their questions.

8.1 FERPA (United States)

AssisT is designed with the principles of the Family Educational Rights and Privacy Act in mind: no student data is collected. Fiavaion is not a school official, is not a FERPA-regulated entity, and makes no certification of compliance. What the extension does:

• No student records collected: Fiavaion never receives or stores education records
• Processing in the browser: student work is processed on the device, and goes to a third-party service only after the student says yes to that service
• No sharing by Fiavaion: we share no data with anyone, because we hold none
• Institutional control: there is no data flow to Fiavaion for a data-sharing agreement to cover. An agreement with a cloud AI provider whose key a student uses is a separate matter between the student, or the institution, and that provider

8.2 COPPA (children under 13)

AssisT is designed with the principles of the Children's Online Privacy Protection Act in mind: no data is collected from any user, including children. Fiavaion is not certified under COPPA and makes no compliance claim. There is no account to create and nothing collected for a parent's consent to cover. Cloud AI needs the user's own API key from a provider.

8.3 HIPAA

We make no HIPAA claim. AssisT is not a healthcare application, has not been assessed against HIPAA, and should not be described as HIPAA compliant. If your institution needs a HIPAA position on a tool used in a clinical or health-records context, treat AssisT as unassessed and evaluate it yourself.

9. GDPR: Our Position (European Users)

For users in the European Economic Area, the United Kingdom and Switzerland:

9.1 Controller status and lawful basis

Fiavaion processes no personal data through AssisT. We operate no server that receives data from the extension, so for AssisT we are neither controller nor processor of your personal data, and no lawful basis arises for us to rely on. What you store stays in your browser on your own device. A service you say yes to in section 4 receives what is described there directly from your browser, under that service's own terms. It is not a sub-processor of ours.

9.2 Your rights

• See and change every consent answer: Advanced options, Your data
• Access: "See what is recorded" shows the record of how you work; your citations, notes and mind maps are in their own panels
• Rectification: edit any setting or anything you made, in the extension
• Erasure: delete items from their own panels, delete the record of how you work, remove AI keys under Your data, or uninstall AssisT, which removes everything Chrome stored for it
• Portability: save your settings to a file, and export citations and mind maps in standard formats
• Objection: turn any support off, say no to any service, or uninstall at any time

9.3 Data retention

• Settings, consent answers and things you make: kept until you delete them or uninstall AssisT
• Temporary working data (for example text read from an image): held only while it is in use

9.4 International transfers

Fiavaion transfers nothing. If you say yes to a service in section 4, your browser sends what is described there to that service directly. We are not in the path. The same list, set out for a data protection officer, is on the third-party services list.

10. Data Security

• Consent before your text leaves: requests that carry what you selected or typed are checked against your answer first. The dictionary, translation, Crossref, Semantic Scholar and Read from Images language requests are built in one place in the extension's background script, which also checks that Chrome holds the permission; cloud AI requests go through their own route, which also checks your answer and Chrome's permission
• The exceptions, named: Hugging Face is contacted when you choose a Browser AI model, and receives no text of yours. Speech recognition for dictation and lecture capture, and online read-aloud voices, are sent by Chrome itself, not by AssisT: AssisT asks before speech recognition starts, and labels online voices in the voice picker
• HTTPS only: every request to a third-party service is encrypted in transit
• Saved AI keys: encrypted on your device, as described in section 6.5
• No Fiavaion database: because there is no Fiavaion server, there is no store of student data to be breached
• Page content handled safely: text taken from a page is cleaned before AssisT shows it, so a page cannot place its own code inside AssisT's panels

11. Your Choices

• Turn supports off: any support can be switched off in the popup
• Change consent answers or remove AI keys: Advanced options, Your data
• Reset settings: "Reset all settings" in the popup's menu
• Delete things you made: from the annotations panel, the citation library and the mind map library
• Withdraw site access: in Chrome, Settings, Extensions, AssisT
• Uninstall: removing the extension deletes everything Chrome stored for it

12. Changes to This Policy

We update this policy when the extension changes. Changes are:

• Posted at fiavaion.com/products/assist/privacy
• Listed in the change log at the end of this page
• Shown by the "Last Updated" date above

A change to what is sent, or to whom, is also noted in the extension's changelog on GitHub.

13. Contact Us

Questions about this privacy policy or AssisT's data practices:

• Email: [email protected]
• Accessibility: [email protected], acknowledged within 5 working days
• GitHub: github.com/Fiavaion/AssisT/issues
• Documentation: fiavaion.com/docs/assist
• Third-party services list: fiavaion.com/docs/assist/sub-processors

14. Complaints

If you believe your data protection rights have been violated:

• Contact us first: [email protected]
• EU/EEA residents: you may lodge a complaint with your local Data Protection Authority (find your Data Protection Authority)
• UK residents: contact the Information Commissioner's Office

Change Log

• 5 October 2026 (AssisT 1.0.0): The Read from Images engine and its English language file now ship inside AssisT, so English needs no download. Another language's file comes from jsDelivr only after you allow it, is downloaded by AssisT's background script with its version, size and contents checked, and is kept in AssisT; it is no longer fetched from the page, so the earlier note about a download made from the page no longer applies. The code that runs a Browser AI model now ships inside AssisT, so raw GitHub file hosting is no longer contacted and is no longer a permission. The Free Dictionary API, MyMemory and Crossref are no longer granted at install: Chrome asks for each in the same press as AssisT's question. Added that a question raised on a course page opens in a small AssisT window.
• 4 October 2026 (AssisT 1.0.0): Rewritten around consent. On a fresh install nothing leaves the browser; AssisT now asks before it sends anything you select, type or say to an outside service, one question per service, during setup or on first use, and every answer can be changed under Your data in the popup. Named every service AssisT can reach, with what is sent to each and when: the Free Dictionary API, MyMemory, Crossref, Semantic Scholar, Google speech recognition for dictation and, separately, for lecture capture, online read-aloud voices, the four cloud AI providers, Hugging Face and GitHub for Browser AI downloads, and jsDelivr for the Read from Images engine. Corrected the earlier statement that dictionary lookups and MyMemory translation were sent without asking. Removed DeepL and Azure Translator, which AssisT no longer offers. Moved Google Gemini, Anthropic, OpenAI, Perplexity and Semantic Scholar to permissions asked for only when you choose them, and listed the dictionary, translation and Crossref hosts that are granted at install. Added the record of how you work, which is off until you turn it on, with "See what is recorded" and delete. Added managed storage for schools, settings files, and a plain account of what the encryption of saved AI keys does and does not protect. Removed AI model names, which change more often than this policy.
• 13 September 2026 (AssisT 1.0.0): Corrected the storage permission description: settings are held in chrome.storage.local and nothing syncs across devices. Replaced the HIPAA considerations section with an explicit statement that no HIPAA claim is made. Restated FERPA as "designed with FERPA principles in mind" rather than a compliance claim, and restated the GDPR position. Added the accessibility contact address and a link to the sub-processor list. Listed every permission in the manifest at that time. Removed the claims that the optional-permissions design "ensures GDPR compliance" and that AssisT "complies with COPPA".
• 15 May 2026 (AssisT 0.9.1): Previous version.