Privacy policy

What the extension does not do

• It does not read, change or track the websites you visit. It installs no content script, and the only site it has permission to contact is GemCommunity's own server, community.gemboss.ai.
• It does not collect your browsing history, location, contacts or the content of pages you visit.
• It has no ad code and no third-party analytics, and we do not sell data.

What it keeps on your device

In Chrome's extension storage (chrome.storage.local), on this device only:

• Latest briefing: A copy of the last feed, so a new tab shows text straight away.
• Session token: Only if you connect your account yourself. It tells the server which account is asking.
• Display choices: Light or dark, language, and the server address (community.gemboss.ai).
• Saved items: Items you star, up to 200. Each is a copy of the card: title, link, cover image address, date. The full text is kept only for pieces that are free for everyone.
• Rating prompt counters: How many new tabs you have opened, on how many days, the last day, and whether you answered or dismissed the prompt. These never leave your device. The prompt's button opens the extension's reviews page on the Chrome Web Store.
• Saved items sync: Connected accounts only, version 1.0.5 and later: which saved items are still waiting to be added to or removed from your account, and when they last synced.
• Welcome note: When you closed the short note shown after install, so it does not come back.
• Feedback form: Version 1.2.6 and later, in the new tab page's own storage (localStorage) rather than chrome.storage: a random ID made for this browser, so several answers from you count as one person; a note you started but did not send; and the score you gave last time.
• Install ID: Version 1.4.0 and later: a random ID made for this install, and the last day each daily signal below was sent. It is not linked to your account.
• Your interests: Version 1.6.4 and later: your answers to the four optional questions shown once after install, or after updating from a version before 1.6.4 (where you sell, how long you have been selling, monthly sales if you chose to say, the topics you want to follow, what you want most right now, and an optional one-line note), and whether you answered, skipped or have not seen them yet. They choose what the For you tab shows. Version 1.6.5 and later: with a connected account, answers saved on that account can be copied here.
• Install channel: Version 1.4.6 and later: a short label the news.gemboss.ai website hands over the first time it sees the extension: the share code on the link, the referrer group, or the utm parameters of the link that brought you to the website (for example "ref:google" or "utm:facebook/paid/vn"). Accepted once; no address, no identifier.
• Telegram follow: Version 1.6.7 and later: the follow code and Telegram link the Telegram card shows (kept up to 25 days), the language it was made for (once you follow, from version 1.6.9: the language the bot was last told, and when telling it last failed), whether you follow or sent /stop, until when the card is hidden after you press ×, the first day this version ran, and the last time the server said the feature is off.
• New since your last visit: Version 1.6.8 and later: when you last opened GemNews, the last time a new tab was open, and the IDs of the new items you opened during this visit, so the home page can say what is new since your last visit. It never leaves your device.

What it sends, and where

Every request goes to https://community.gemboss.ai, except the Feedback form, which goes to https://feedback.gemboss.ai (the last item):

• /api/ext/feed: Gets the briefing: every 30 minutes in the background, and when you open a new tab and the stored copy is more than 5 minutes old. The request can include your display language and, if you connected an account, your session token.
• /api/ext/search?q=…: When you type two or more characters in the search box, the text you typed is sent so the server can search the whole community. This happens for guests and for connected accounts. The server does not save your search text in its database. The text is part of the web address, so it can appear in the request logs of our hosting provider.
• /api/ext/saved: Version 1.0.5 and later, connected accounts only. Your saved items are stored on your account so they show up on your other computers. For each item the server keeps its ID, the card copy (title, subtitle, link, cover image address, label, dates) and when you saved it. It does not keep the article text. Guests' saved items stay on the device.
• /api/ext/cover/…, /api/ext/me/avatar: Cover images for free Hot News pieces, and your own profile picture when you are connected.
• /api/ext/views, /api/ext/views/read: Version 1.2.0 and later. When you open a piece in the extension's reader, the extension sends that piece's ID. If you scroll to the end and have been reading for at least 10 seconds, it sends that too. From version 1.2.5 it also sends the language the reader is showing (Vietnamese, English or Chinese). This is how the community counts how many people read each piece. If you connected an account, the read is linked to it through your session token. If not, the server makes a code from your IP address, browser and the date, using a secret key. The code changes every day and cannot be turned back into your IP address. If gems are on and you are signed in, a read of 45 seconds or more can also add a gem to your account; the extension sends nothing extra for this.
• /api/ext/ping: Version 1.4.0 and later. At most once a day while Chrome is running with the extension on, and at most once a day when you open a new tab, the extension sends the random install ID above, which of those two signals it is (or "installed" / "updated" right after an install or update), the extension version, its interface language, and your browser's first language. From version 1.4.1 it also sends up to three of your browser's preferred languages. From version 1.4.6 it also sends the install channel above, if the website handed one over, so installs can be counted per channel; the signal that receives a channel is sent right away even if one was already sent that day. The server also reads the browser name, its main version and the operating system from the request's user agent (for example Chrome 156 on Mac). This is how we count how many installs are in use and which languages they read in. It is the same whether or not you connected an account, and it is never linked to your account.
• /api/ext/survey: Version 1.6.4 and later. Right after install (for installs from before version 1.6.4: the first time you open a new tab after updating), the extension asks four optional questions, once, and once more a few days later if you skip them. When the questions open, after each question you answer, when you finish and when you skip, it sends the random install ID above, the extension version, its interface language, the state (shown, partly answered, finished or skipped), how many questions you answered, and your answers so far: the choices above and the optional note (up to 280 characters). No email, no name, no location, no cookie. Version 1.6.5 and later: if you connected a GemCommunity account, the request also carries your session token (as saved items do), so the answers are linked to that account; right after you connect, the extension sends one request so that the answers this browser sent before are linked too. While this browser has no finished answers, the extension asks the server for the answers saved on your account (right after you connect, then at most once a day); if there are some, it uses them and does not ask you again. Change your answers any time from the menu: Your interests.
• /api/ext/bye: Version 1.4.0 and later. When you uninstall the extension, Chrome opens this address in a tab, with the install ID and the interface language. The server marks that install as uninstalled and shows a short page whose address does not contain the ID. For 30 minutes a cookie on that page holds the install ID, so the page can ask once why you removed it. If you answer, the server keeps your choice and anything you write (up to 500 characters) with that install.
• /api/ext/feedback-identity: Version 1.2.9 and later, connected accounts only, and only when you send the Feedback form. The extension asks for a short code that names your account to GemBoss's feedback service. The code works once and expires after two minutes. Your session token is never sent to the feedback service.
• /api/news/gifts: Version 1.6.0 and later. When you open a new tab, the extension asks whether a gift card is running today, sending only the display language. It sends no install ID, no token and nothing about you. If you hide the card, the date it hides until stays in your browser. The gift wheel itself runs on news.gemboss.ai, not in the extension.
• /api/news/tg/code, /api/news/tg/status, /api/news/tg/lang: Version 1.6.7 and later. From the second day after install, a small card offers to follow GemNews on Telegram (Follow on Telegram in the menu opens it any time). The first time the card is about to show, the extension asks for a follow code, sending the display language and the random install ID above (no time zone); if you connected an account, also your session token (as saved items do), so the follow is linked to that account. The code is reused for up to 25 days, and a new one is asked for when you change the language before you follow. From version 1.6.9, once you follow, changing the language keeps the code and sends only the code and the new language (/api/news/tg/lang), so the bot writes in the language you chose; if that fails, it is sent again the next time a new tab opens. While the card is open, every 6 seconds for at most 3 minutes each time it shows, the extension asks whether that code has been used to follow; that request carries only the code. The QR code is drawn on your device; the link is not sent to any QR service. Nothing is sent to Telegram until you scan the code or open the link yourself.
• feedback.gemboss.ai: Version 1.2.6 and later. Each time you open a new tab, the extension loads the Feedback form's steps from here; that request carries nothing of yours beyond what any web request does (your IP address and browser), and nothing is stored for it. Your answer goes only when you press Send. It sends your answers (the score and what you wrote), the random browser ID above, the page and language, whether you were in the extension or on the website, and the short web name (slug) of the piece you had open. From version 1.2.9 it also sends the version, the tab, more about that piece (its ID, kind, title and link, and the ID of that read), and what the browser says about itself: its brand and platform, whether it is a phone, touch points, window and screen size, pixel ratio and time zone. With every request comes your browser's user agent (the browser and system name and version); from 2026-10-09 the feedback service stores it with the answer, so the team can reproduce a problem you report. From version 1.2.9, if you connected an account, the short code above goes with it, so the team sees your name, email, account ID and membership status next to your answer. Without a connected account the answer has no name.

Images. Cover images are stored on Cloudflare R2 and load from addresses ending in r2.dev. An article or a profile picture can also point to an image on another website; your browser then loads it from there. As with any image on the web, the site serving it sees your IP address. On 2026-09-27 every cover in the feed was on r2.dev and no article in the feed contained other images.

Links. When you click a source (for example a post on X) it opens in a normal tab, and that website's own privacy policy applies. Links into the community carry your chosen language. Version 1.2.4 and later: links the extension makes to the news.gemboss.ai website carry a short channel tag. That is a piece you share (for example ?via=wa for WhatsApp), the "Open web version" link (?via=ext) and the "Open on phone" QR code (?via=qr). The website uses the tag to count, anonymously, how many of those links are opened per channel. A shared members-only piece links to the community site and carries no tag. Apart from the daily install signal and the survey answers described above, the extension sends no counting data; the code that sends the website counts exists only on the website.

What the server keeps

• For a connected install: A SHA-256 hash of the session token (never the token itself), the extension ID, when it was connected and when it was last used.
• Saved items: As described above, for connected accounts on 1.0.5 and later.
• Reads: Version 1.2.0 and later. For each read in the extension: which piece, when, whether you reached the end, the reader language (from 1.2.5), and either your account (if connected) or the one-day code described above. Community admins see totals per piece, not who read what.
• Installs: Version 1.4.0 and later. For each install ID: when it was first and last seen, the last day a new tab was opened, which days it sent a signal, the version, the interface and browser languages, the browser name, main version and operating system, the install channel if the website handed one over (version 1.4.6 and later), the day Chrome reported it uninstalled, and why, if you answered. No account or IP address is stored with it. If a GemBoss team member marks their own browser as a team install, the server stores that mark too. Admins see totals only.
• Survey answers: Version 1.6.4 and later. For each install ID that saw the questions: the latest answers, how far you got and when, linked to the install. Version 1.6.5 and later: if you connected an account, they are also linked to that account, and admins see your account name and email next to the answers. Without an account, admins see the answers with no name or email. Team installs are left out of the totals.
• Telegram follow: Version 1.6.7 and later. For each follow code: the language, install ID and account (if connected) it was made with, and, once you start the GemCommunity bot in Telegram with it, your Telegram chat so the bot can send each new article as 3 insights and a link. Send /stop in Telegram and the bot sends nothing more. The bot writes in the language of your follow: from version 1.6.9 it changes when you change the language in GemNews, or in your GemCommunity account if the follow is linked to that account; the latest change wins.
• IP addresses: Used to count requests for rate limiting (kept in memory for a few minutes, not written to our database) and, for reads without a connected account, to make the one-day code above. The IP address itself is not stored. Our hosting provider may log IP addresses as part of normal request logs.
• Feedback (feedback.gemboss.ai): Each answer with the details listed above. Your IP address is kept only as a code made with a secret key, used to limit how many answers one address can send in an hour and cleared after that hour. If the same GemCommunity account has also signed in to GemFeedback, the answer is linked to that GemFeedback account. Only the GemBoss team can read answers; the team may ask an AI assistant to read and sum them up (Anthropic's Claude, or OpenAI's GPT when Claude is unavailable), which sees the answers and the account name, not the email. The short account code is not stored on community.gemboss.ai; the feedback service keeps its ID so it cannot be used twice. To have your answers deleted, email the address below.

What websites can send to the extension

Chrome blocks every site except three. community.gemboss.ai sends two things: the session token, when you click "Connect account" on the connect page, and the language you picked on the site, so the extension matches it. From version 1.2.1, the news.gemboss.ai website (also at gemnews.ops.gemboss.ai) can only ask whether the extension is installed; the extension answers yes and its version number, and refuses anything else from those two addresses. The website counts that answer anonymously, once per browser. From version 1.4.6, those two addresses can also hand over the install channel (the short label described above); the extension accepts it only once, when it has none yet, and still refuses anything else. From version 1.4.1, community.gemboss.ai can also ask for the install ID described above. Only a page for the GemBoss team asks, so team members can mark their own browsers and keep them out of the counts.

How to stop it and delete your data

• Disconnect: In the extension's options page, click Disconnect. The token is deleted from your device. Saved items on your account stay until you remove them.
• Revoke from the server: Open the list of connected installs and revoke them one by one.
• Remove saved items from your account: While connected, remove the star from an item and the removal syncs to your account. To delete all of it at once, email chris.chimen@gmail.com.
• Uninstall: Chrome deletes everything the extension stored on your device, and opens a short page that marks the install as uninstalled. Anything on the server (token record, saved items, install record, survey answers) stays until you revoke it, remove it, or ask us to delete it.

About the content

Hot News is written by AI from public posts and news sources and reviewed by an editor. If a piece quotes you, uses your image or names you and you want it removed or corrected, see content removal and corrections.

Contact

Questions about this policy or your data: email chris.chimen@gmail.com.