ISpyMyAI — Privacy Policy
Effective 16 June 2026
ISpyMyAI ("ISpyMyAI", "we", "us") helps you see your own AI usage across the AI tools you use — ChatGPT, Claude, Gemini and similar services — classified, costed, and synced to your account. This policy explains exactly what the ISpyMyAI Chrome extension and web app collect, why, where it goes, and how you control it. We collect only what's needed to show you your own activity, we do not sell your data, and we do not use it for advertising.
The short version
- What it's for (single purpose): to show you a record of your own AI usage and its estimated cost.
- Whose data: only your own AI activity, captured on the AI sites you visit while signed in to ISpyMyAI.
- We do not sell or rent your data, share it with advertisers, use it to determine creditworthiness or for lending, or use it for any purpose unrelated to the single purpose above.
- You control it: you can delete your data and uninstall at any time (see Your choices).
What we collect
We collect the following categories of data, all tied to your own ISpyMyAI account:
| Category | What it is and why |
|---|---|
| Identity | Your email address (and optional display name) — to create your account, sign you in, and attribute your activity to you. If you join a team, your team administrator can see your name/email and your usage within that team. |
| AI conversations | The prompts you send and the responses you receive on supported AI sites, plus derived summaries, classifications, and token/cost estimates — this is the core record ISpyMyAI exists to show you. |
| AI-site web history | Which supported AI tools you used and when — page URL, title, and timestamp for those visits. If you choose to run the optional "scan my AI history" action, we read your browser history solely to detect which AI tools you've used; we do not collect your general (non-AI) browsing history. |
| Page content | Text content read from the AI tool's page (your conversation and related metadata) needed to build the usage record above. |
| Usage signals | On supported AI sites the extension observes the site's own network requests (e.g. usage / completion API calls) to read token counts and usage-limit status, so it can show your remaining capacity and estimated cost. It does not log your keystrokes, mouse, or clicks, and it does not monitor your activity on non-AI sites. |
What we do not collect
No health data No financial / payment data No precise location
We do not collect health information, financial or payment information (card numbers, bank details, transactions), or your precise/GPS location. The "cost" figures ISpyMyAI shows are estimates derived from your token usage and public model price lists — they are not your financial records. We do not ask for or store the passwords you use on third-party AI sites; the extension reads only the content of the pages you are already signed in to.
Our website analytics
The section above describes the ISpyMyAI extension and app. Separately, on our
public marketing website (ispymy.ai) we use first-party,
privacy-preserving analytics to understand which content interests visitors — so we can
improve the site. This is ordinary website analytics and is distinct from the product's AI-usage
capture.
- What we record: anonymous events such as pages and sections viewed, which buttons and links are clicked, and how far you get in the Beta-Invite request form, along with the referring site or campaign parameters in the link you arrived from.
- How it's identified: these events are tied to a random identifier stored in your browser — not to your name or email. We do not use this to build an advertising profile.
- No ad tracking: engagement data is stored in our own backend (Supabase); the company-level signal described below is processed by our analytics provider (HubSpot). We do not use third-party advertising trackers or cross-site advertising cookies, and we do not sell or share this data with advertisers.
- Company-level identification: we estimate the organisation a visit may be
associated with from the public business network (IP address) it originates from — via HubSpot and an
IP-intelligence provider (IPLocate). This identifies companies, not individuals, draws on
publicly available business information, and may be used to pre-fill the company field on our invite
form. We store the derived company and approximate location, not your raw IP address.
HubSpot sets first-party cookies on
ispymy.ai; you can decline those via our cookie-consent banner. - When we learn who you are: the only place the website collects identifying information is the Beta-Invite request form, which you fill in deliberately. The details you submit (name, work email, company, and any message) are stored in our backend and in our CRM (HubSpot) so we can manage and follow up on your invite request.
How we use it
- To build and display your personal AI-usage record, classifications, and estimated cost.
- To show usage-limit and remaining-capacity indicators for the AI tools you use.
- If you join a team, to provide your team's administrator an aggregated and per-member view of usage within that team.
- To operate, secure, and improve the service.
We do not use your data for advertising, profiling unrelated to the service, creditworthiness or lending decisions, or any purpose unrelated to ISpyMyAI's single purpose.
Where your data is stored
Some data is kept locally in your browser's extension storage (e.g. your session and recent activity). To sync across the extension and the web app and to power your account, data is sent to and stored in our backend, hosted on Supabase (PostgreSQL) and Google Cloud. Access is protected by per-user authentication and row-level security so you see your own data (and, for teams, the data shared within your team). By default ISpyMyAI stores metadata and derived summaries; capture of full raw prompt/response text is an explicit, consent-gated option.
Who we share it with
We do not sell, rent, or trade your personal data, and we do not transfer it to third parties except: (a) infrastructure providers who host the service on our behalf (such as Supabase and Google Cloud) under their own data-protection terms; (b) within your team, to your team's administrator as described above; or (c) where required by law. Any such transfer is consistent with ISpyMyAI's single purpose.
Your choices and control
- Stop capturing: sign out, or disable/uninstall the extension at any time. Uninstalling removes its local data from your browser.
- Delete your data: email us (below) to request deletion of your account and the data associated with it.
- Optional features: history scanning and full-text capture are opt-in; you don't have to enable them.
Data retention
We retain your usage data for as long as your account is active or as needed to provide the service, and we delete it on request or within a reasonable period after your account is closed, except where we must retain it to comply with legal obligations.
Children
ISpyMyAI is not directed to children under 13 (or the minimum age in your jurisdiction) and we do not knowingly collect their data.
Changes to this policy
We may update this policy as the product evolves. We'll change the effective date above and, for material changes, provide notice within the app.
Contact
Questions, or to request deletion of your data: privacy@ispymy.ai.