Skip to content
Legal

Privacy

Spinwait shows ads next to AI conversations. It does not read them.

This page lists everything that leaves your browser, and everything that does not. It describes the extension source, which is public and which you can read.

What leaves your browser

The extension talks to exactly one host: the Spinwait API, by default https://spinwait.net. There is no analytics service, no error reporting service, and no third-party endpoint of any kind.

Five requests exist. This is all of them.

1. Registering, once, if you press the button

POST /api/v1/publishers

Sends an email address, only if you typed one into the popup. The field is optional and registration works when it is left blank. Receives your publisher key, which is stored locally and shown only as a masked preview.

2. Fetching ads

GET /api/v1/ads?session=<id>&n=8, with your publisher key as a bearer token. It sends three things:

  • Your publisher key. This is how you get paid.
  • A session id. A random UUID generated per browser tab, not derived from anything about you, the site or the page. In your browser it is held in memory only and discarded when you close the browser. On the server it is never stored as you sent it: it is hashed with SHA-256 and only the first 32 hex characters are kept, on the impression rows that record what you earned. Those rows are your earnings record, so they persist.
  • How many ads to send back.

Note what is not in it. The server that picks the ad is never told which site the ad will appear on. It cannot distinguish a ChatGPT tab from a Bolt tab.

3. Reporting impressions

POST /api/v1/events, with your publisher key as a bearer token. Per impression it sends the single-use ad token the server issued in step 2, which already carries the campaign and the sealed price; the literal string impression; and one number, how many milliseconds this tab has spent watching a model generate in a visible tab. That number measures elapsed time, nothing about content.

4. Your balance, while the popup is open

GET /api/v1/publishers/me, with your publisher key as a bearer token. Sends nothing else.

5. Starting payout setup, if you press the button

POST /api/v1/publishers/onboard, with your publisher key and an empty body. Returns a Stripe Connect onboarding link, which opens in a new tab. Stripe, not Spinwait, collects the identity and bank details on that page, and the extension is not involved in it.

Clicks

A click is an ordinary link to the Spinwait redirect endpoint, which records the click server-side and forwards you to the advertiser. The extension sends no click event of its own. The link carries referrerpolicy="no-referrer", so the Spinwait server is not told which page you clicked from. Given the URLs of AI products often contain a conversation id, that matters.

What never leaves your browser

None of the following is read, stored, buffered or transmitted by this extension, ever:

  • Prompt text. Anything you type into an AI product.
  • Response text. Anything a model writes back.
  • Conversation content. The one place the extension observes the conversation area is a MutationObserver that counts how often the DOM changes, so it can tell that text is arriving. Its callback never reads textContent, never inspects a node value, and keeps only timestamps.
  • Cookies, credentials, form data, clipboard, or anything else from a page.
  • Browsing history. No history API is used and no page URL is sent anywhere.
  • Which AI product you use. As above, the API is never told.
  • Any identifier that follows you between sites, because nothing is sent that distinguishes one site from another.

Two things that are read locally and still never leave

Both stay inside your browser. Neither is stored and neither is sent anywhere, but the list above says "read", so they belong here rather than buried in the source.

  • The visible label of buttons inside the composer. To find the stop button, the detector reads button text, capped at 80 characters per button, and compares it against a fixed list of words like "stop" and "cancel". It never reads the prompt field and never reads the conversation.
  • The hostname of the page. The content script tells the background worker its hostname so the worker can check your per-site switch, and the popup reads the current tab hostname to draw that switch. Neither hostname reaches the API, and the only thing written to disk is a switch you set yourself.

What is stored locally

In chrome.storage.local, on your machine, readable at chrome://extensions under the extension storage:

  • Your publisher key and publisher id.
  • Whether the extension is on, and any per-site switches you set.
  • The API base URL, if you changed it.
  • Any extra origins you opted into.
  • Queued impressions waiting to be sent, dropped automatically once their token expires after 15 minutes.
  • Counts of impressions billed, capped and rejected, and total earnings, for the popup.
  • Timestamps of the impressions billed in the last hour, which is how the client stops itself before it hits the hourly cap.
  • A single flag recording that the API last rejected your key, so the popup can ask for a new one instead of failing silently.

In chrome.storage.session, which is memory only, never written to disk, and cleared when you close the browser: per-tab session ids, activity counters and the cached ad batch.

Nothing here is synced to a Google account. The extension does not use chrome.storage.sync.

Third parties

There are none. Advertisers receive nothing until you click an ad, and what they receive then is an ordinary visit to their own website, without a referrer.

There is no tracking pixel, no fingerprinting, no ad-network SDK and no remote code. Everything the extension runs ships inside it, so an update is the only way its behaviour can change, and you can read the diff.

Limited use

Spinwait's use of data received from this extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide the extension's single purpose, which is showing a sponsored card while a web AI is generating and paying the publisher for it. It is not sold, not shared with data brokers or advertising platforms, not used to build a profile of you, and not used to target ads. Ad selection happens server-side without being told which site you are on. The extension does not use any Google API.

Removing your data

Uninstalling the extension deletes everything listed above from your machine. Impressions already reported are part of your Spinwait earnings record, which is the account the publisher key identifies. To delete that, contact Spinwait.