🐒

Papio Selector

Privacy Policy

Effective Date: December 31, 2025
Last Updated: December 31, 2025
Version: 2.1 (AI-Powered Features with MCP Integration)

1. Introduction

Welcome to Papio Selector. We are committed to protecting your privacy and ensuring complete transparency about how we handle your data. This Privacy Policy explains what data we collect, how we use it, where it goes, and your rights regarding your information.

Key Principle: Papio Selector operates on a "local-first, opt-in-AI" philosophy:

• Basic features work entirely locally in your browser with zero external data transmission
• AI-powered features require explicit action (button clicks) and transmit data to external servers
• You have complete control over which features you use

2. System Architecture & Data Flow

2.1 Component Descriptions

Layer 1: Chrome Extension (Client-Side)

• Location: Runs entirely in your browser
• Function: Element inspection, selector generation, local storage
• Data Storage: Chrome's local storage API (never leaves your device)
• Network Activity: ONLY when you click AI feature buttons

Layer 2: Integration Server (papio-selector-mcp.onrender.com)

• Location: Hosted on Render.com (United States)
• Function: Bridge between Chrome extension and MCP server
• Purpose: Protocol translation, request routing, response formatting
• Data Handling: Temporary in-memory processing only
• Storage: No persistent data storage (data deleted after response)
• Logs: Basic request logs retained for 24 hours for debugging

Layer 3: MCP Server (Model Context Protocol Server)

• Location: May be self-hosted or third-party hosted
• Function: Processes AI requests using MCP protocol
• Purpose: Intelligent selector analysis, test generation, optimization
• Third-Party Services: May connect to AI services (e.g., Anthropic Claude API)
• Data Handling: Transmits element data to AI services for processing

Layer 4: AI Services (Third-Party)

• Example: Anthropic Claude API
• Purpose: Natural language processing, intelligent code generation
• Data Processing: Subject to third-party privacy policies
• Our Control: Limited to what we send; cannot control third-party data handling

3. Data Collection & Usage

3.1 Data Collected Locally (No External Transmission)

The following data is stored locally in your browser and NEVER leaves your device unless you use AI features:

Data Type	Purpose	Storage Location	Retention
Currently inspected element data	Display in extension panel	Chrome local storage	Until new element selected or extension uninstalled
Framework preference (Playwright/Selenium/Cypress)	Remember your choice	Chrome local storage	Until cleared or extension uninstalled
Panel position and settings	Remember UI preferences	Chrome local storage	Until cleared or extension uninstalled
Generated selectors (basic mode)	Display and copy to clipboard	In-memory only	Until page refresh

3.2 Data Transmitted to Integration Server (AI Features Only)

When you explicitly click an AI-powered feature button, the following data is transmitted:

Data Type	Specific Fields	Example	Why Needed
Element Metadata	• tagName • id • className • attributes (data-*, aria-*, role, etc.)	tagName: "button" id: "submit-btn" className: "primary-btn" data-testid: "login-submit"	Generate accurate selectors and understand element purpose
DOM Context	• Parent elements (up to 3 levels) • Sibling elements • Element position in DOM	Parent: <form id="login"> Siblings: 2 other buttons Position: 3rd child	Generate robust, context-aware selectors that won't break
Current Page URL	• Full URL of the page being inspected	https://example.com/login	Understand page context for test case generation
Framework Selection	• Playwright / Selenium / Cypress	"playwright"	Generate framework-specific code syntax
Generated Selector	• The CSS/XPath selector you want to analyze/optimize	button#submit-btn.primary	Analyze quality and suggest improvements

4. How We Use Your Data

4.1 Integration Server Usage

Data received by the Integration Server is used for:

• Protocol Translation: Converting HTTP requests to MCP protocol messages
• Request Routing: Forwarding requests to the appropriate MCP server endpoint
• Response Formatting: Converting MCP responses back to JSON for the extension
• Error Handling: Providing fallback responses if MCP server is unavailable
• Debugging: Logging requests for troubleshooting (retained 24 hours)

4.2 MCP Server Usage

Data forwarded to the MCP Server is used for:

• AI Processing: Analyzing element data using AI models
• Selector Generation: Creating intelligent, robust CSS/XPath selectors
• Code Generation: Producing framework-specific test automation code
• Optimization: Suggesting improvements to existing selectors
• Test Case Creation: Generating comprehensive test scenarios
• Page Object Models: Creating maintainable test architectures

5. Data Retention & Deletion

5.1 Local Data (Your Browser)

• Retention: Indefinitely until you clear it
• Deletion Methods:
  • Uninstall the extension (removes all local data)
  • Chrome Settings → Extensions → Papio Selector → "Remove extension data"
  • Chrome DevTools → Application → Storage → Clear

5.2 Integration Server Data

• In-Memory Processing: Data exists only during request processing (milliseconds)
• Request Logs: Retained for 24 hours for debugging purposes
• No Persistent Storage: No database or long-term data storage
• Automatic Deletion: Logs automatically deleted after 24 hours

5.3 MCP Server Data

• Retention Policy: Depends on MCP server configuration
• Recommended: No persistent storage beyond request processing
• Contact Required: For data deletion, contact MCP server administrator

5.4 Third-Party AI Service Data

• Retention: Subject to third-party privacy policies
• Example (Anthropic): May retain for 30 days for trust & safety monitoring
• Control: We cannot delete data from third-party services on your behalf

6. Data Security Measures

6.1 Transmission Security

• HTTPS/TLS Encryption: All network requests use HTTPS with TLS 1.2+
• Certificate Validation: Extension verifies SSL certificates
• No Plain Text: Sensitive data never transmitted unencrypted

6.2 Server Security

• Render.com Infrastructure: Enterprise-grade security and compliance
• DDoS Protection: Cloudflare protection against denial-of-service attacks
• Access Controls: Restricted administrative access
• Security Updates: Regular dependency updates and patching

6.3 Code Security

• Open Source: Code publicly auditable for security issues
• No Obfuscation: Transparent implementation for review
• Dependency Scanning: Regular vulnerability scans of dependencies
• Input Validation: Sanitization of all user inputs

6.4 Limitations & Risks

Despite our security measures, please be aware:

• No system is 100% secure against all attacks
• URL transmission could expose internal infrastructure
• Third-party services may have different security standards
• Network interception is possible (though encrypted)
• Browser extensions have inherent security limitations

7. Chrome Extension Permissions Explained

7.1 Manifest V3 Permissions

Permission	Why Required	What It Allows	What We DON'T Do
activeTab	Inspect elements on the current tab	Access the DOM when DevTools is open	Monitor activity when not actively inspecting
scripting	Inject content script for highlighting	Add overlay and highlight selected elements	Inject ads, trackers, or malicious code
storage	Save preferences locally	Store framework choice, panel position, settings	Store personal information or browsing history
<all_urls> (content script)	Work on any website	Enable element inspection on any webpage	Monitor browsing, collect data passively

7.2 Network Requests

Network requests are made ONLY when you use AI-powered features:

• Destination: https://papio-selector-mcp.onrender.com only
• Method: HTTPS POST requests
• Frequency: Only when you click AI feature buttons (🤖, 📊, ⚡, 🧠)
• No background requests: No automatic or periodic connections
• No third-party domains: Extension never contacts other domains directly

8. Your Rights and Choices

8.1 Data Access Rights

You have the right to:

• View Local Data: Chrome DevTools → Application → Storage → Local Storage
• Request Server Logs: Contact us via GitHub/GitLab issues
• Export Generated Code: Copy any generated selectors or test cases
• Audit Source Code: Review our open-source code for data handling

8.2 Data Deletion Rights

You can delete your data by:

• Local Data: Uninstall extension or clear Chrome storage
• Integration Server Logs: Wait 24 hours (automatic deletion) or contact us
• MCP Server Data: Contact MCP server administrator
• Third-Party AI Data: Contact the AI service provider directly

8.3 Opt-Out Options

• Complete Opt-Out: Don't install the extension
• Partial Opt-Out: Use only local features (basic selector generation)
• Avoid AI Features: Don't click on AI features
• Block Network: Use firewall to block papio-selector-mcp.onrender.com
• Use Mock Mode: Configure Integration Server to use mock responses

8.4 Consent Withdrawal

To withdraw consent for data processing:

• Stop using AI-powered features (use local-only mode)
• Uninstall the extension to revoke all permissions
• Contact us to request deletion of server-side logs

9. Children's Privacy (COPPA Compliance)

Papio Selector is not intended for children under 13 years of age.

• We do not knowingly collect information from children under 13
• This extension is designed for professional QA engineers and developers (typically 18+)
• If you believe a child has used this extension, please contact us immediately
• We will delete any data collected from children upon notification
• Parents/guardians can request data deletion by contacting us

10. International Data Transfers

If you use this extension outside the United States:

10.1 Data Transfer Locations

• Integration Server: United States (Render.com)
• MCP Server: May be located anywhere (varies by configuration)
• AI Services: May process data in multiple regions

10.2 Legal Basis

• Standard Contractual Clauses: We rely on SCCs for EU data transfers
• Render.com Compliance: SOC 2 Type II, GDPR, HIPAA compliance
• Explicit Consent: By using AI features, you consent to international transfer

10.3 Your Protections

• HTTPS/TLS encryption in transit
• No persistent storage minimizes risk
• 24-hour maximum retention period
• Right to object to international transfers (opt-out options available)

12. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• Changes in our data practices or architecture
• New features or services
• Legal or regulatory requirements
• User feedback and concerns
• Security enhancements or changes

12.1 Notification of Changes

• Minor Changes: Updated "Last Updated" date at the top
• Material Changes: Prominent notification in extension and repository announcement

12.2 Your Acceptance

Continued use after changes constitutes acceptance of the updated policy. If you do not agree with changes, you should discontinue use and uninstall the extension.

13. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA) and United Kingdom:

13.1 Local Data Processing

• Legal Basis: Legitimate Interest
• Purpose: Providing core extension functionality
• Balancing Test: Essential for extension to function, no alternative means

13.2 AI Feature Data Processing

• Legal Basis: Consent (explicit action required)
• Purpose: Providing AI-powered enhancements
• Consent Mechanism: Clicking AI feature buttons constitutes consent
• Withdrawal: Stop using AI features or uninstall extension

13.3 Your GDPR Rights

• Right to Access: Request copy of data we have about you
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive data in machine-readable format
• Right to Object: Object to data processing based on legitimate interest
• Right to Withdraw Consent: Revoke consent for AI features

15. Open Source and Transparency

Papio Selector is committed to full transparency through open source:

15.1 Source Code Availability

• GitHub: https://gitlab.com/srkanpu/papio-selector
• GitLab: https://gitlab.com/srkanpu/papio-selector
• License: MIT License (free and open source)
• Contribution: Community contributions welcome

15.2 Auditing & Verification

15.3 Issue Reporting

Report privacy concerns or bugs:

• GitLab Issues: Report Privacy Concern
• Response Time: We aim to respond within 20 business days

15.4 Release Transparency

• Changelog: Every release includes detailed changelog
• Privacy Impact: Material changes to data handling noted in release notes
• Diff Visibility: All code changes visible via Git history
• Community Review: Pull requests reviewed publicly before merge

16. Contact Information

For privacy questions, concerns, or data subject requests:

16.1 Primary Contacts

• GitLab Issues: gitlab.com/yourusername/papio-selector/-/issues
• Email: privacy@papio-selector.example.com (if applicable)

17. Consent and Acknowledgment

By installing and using Papio Selector, you acknowledge that:

• ✅ You have read, understood, and agree to this Privacy Policy
• ✅ You consent to local data storage for core functionality
• ✅ You understand AI features transmit data through multiple servers
• ✅ You acknowledge page URLs are transmitted when using AI features
• ✅ You understand data may be processed by third-party AI services
• ✅ You consent to international data transfers (if outside US)
• ✅ You can choose to use only local features to avoid external data transmission
• ✅ You understand the three-tier architecture (Extension → Integration Server → MCP Server)
• ✅ You acknowledge we have limited control over third-party data handling

20. Third-Party Service Dependencies

Papio Selector relies on the following third-party services:

21. Definitions

For clarity, the following terms are defined:

• Extension: The Papio Selector Chrome browser extension
• Integration Server: The bridge server at papio-selector-mcp.onrender.com
• MCP Server: Model Context Protocol server that processes AI requests
• MCP: Model Context Protocol, a standard for AI tool integration
• Element Data: Information about a DOM element (tag, id, class, attributes, etc.)
• DOM Context: Information about an element's position and relationships in the DOM tree
• Local Features: Features that work entirely within your browser
• Personal Information: Information that identifies or relates to an individual
• Data Subject: An individual whose personal data is processed
• Processing: Any operation performed on personal data
• Third Party: Any entity other than you and Papio Selector

22. Effective Date and Updates

This Privacy Policy is effective as of December 31, 2025, and will remain in effect except with respect to any changes in its provisions in the future, which will be in effect immediately after being posted on this page and announced via GitHub/GitLab.

We reserve the right to update or change our Privacy Policy at any time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

Your continued use of the extension after we post any modifications to the Privacy Policy will constitute your acknowledgment of the modifications and your consent to abide and be bound by the modified Privacy Policy.