Privacy Policy
Effective 2026-07-17
route-reveal ("the app") turns a live browsing session into a working API client. This page covers what the web app, backend, and browser extension collect, why, and how to get it deleted. It applies to the extension listed on the Chrome Web Store as well as the hosted web app.
What we collect
- Account info. When you sign in with Google, we receive your email address and Google's stable account identifier (used only to recognize repeat logins). We don't request or access any other Google data (contacts, files, calendar, etc.) — the sign-in scope is limited to
openid email. - Captured traffic, only when you start a capture. The extension does nothing until you click "Start capture" in its popup, and only inspects the one tab you're on. From that point until you click "Done," it records that tab's network requests — URLs, headers, request/response bodies — via Chrome's debugger API (Chrome shows its own "this extension is debugging your browser" banner the entire time it's active, so it's never silent). This can include whatever the site itself sends, including session cookies, auth tokens, or other data the site includes in its own traffic — that data is what the app needs to reverse-engineer the site's API and is submitted to our backend as part of that job.
- Job results. The generated API client code, OpenAPI spec, and cost/usage metadata for each job you run.
The extension does not run in the background, does not monitor tabs passively, and does not collect anything before you explicitly start a capture or after you stop one.
Why we collect it
Account info is used to authenticate requests and enforce a per-user usage budget (this is currently an invite-only test deployment). Captured traffic is sent to our backend and, from there, to Anthropic's Claude API to analyze the traffic and generate the API client you asked for — that is the entire product. Job results are stored so you can retrieve them.
Who we share it with
- Anthropic (Claude API) — processes captured traffic to generate the API client. Subject to Anthropic's own privacy policy.
- Google — used only for sign-in (OAuth). We don't send captured traffic or job data to Google.
We don't sell data, and we don't use it for advertising.
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Storage and retention
Captured traffic, generated results, and account records are stored on our backend server until deleted. This is a small, invite-only test deployment without a self-service deletion flow yet — email routerevealai@gmail.com to request deletion of your account or any job's data, and we'll remove it.
Security
Requests to the backend require a per-user bearer token issued at sign-in; the hosted deployment serves everything over HTTPS.
Children's privacy
This app is not directed at, and is not knowingly used by, children under 13.
Changes to this policy
If this policy changes, the date at the top of this page will be updated.
Contact
Questions or deletion requests: routerevealai@gmail.com