Fibonax
Privacy Policy
This policy describes how Fibonax collects, uses, and protects information when you use our Chrome Extension and web application at fibonax.com.
01 Overview
Fibonax keeps your snippets, prompts and Brains in your Fibonax account, so they are the same in the extension, on the dashboard and on your phone. The extension also keeps a copy on your device, so your shortcuts work instantly. We collect only what the service needs to work and to keep your account safe.
Key principle: Fibonax does not monitor your browsing activity, does not read page content passively, and does not sell or share your personal data with any third party for advertising or commercial purposes.
02 Data Controller
Product name: Fibonax
Data controller: Alessandro Verdicchio
Operating as: Self-employed individual (libero professionista), Italy
Registered address: Via San Francesco d'Assisi, 154, Maddaloni (CE), 81024, Italy
Contact: fibonaxai@gmail.com
As the data controller, Alessandro Verdicchio is responsible for the lawful processing of your personal data in compliance with Regulation (EU) 2016/679 (GDPR) and the Italian Legislative Decree 196/2003 (Codice Privacy) as amended by D.Lgs. 101/2018.
03 Extension Permissions
The Fibonax Chrome Extension declares the following manifest permissions. Each is used exclusively for the stated purpose — no permission is used beyond its declared scope.
| Permission | Purpose | Data accessed |
|---|---|---|
| storage | Persist your snippet library and settings between browser sessions | A copy of your library and settings, kept on this device in chrome.storage.local. The original is in your Fibonax account |
| alarms | Refresh the copy of your library from your account every 5 minutes | Your own library, read from your Fibonax account |
| activeTab | Inject the snippet expansion script into the active tab when you invoke a shortcut | Current tab context at the moment of invocation; no page content is read passively |
| contextMenus | Add a right-click menu entry to insert snippets into editable fields | Selected text, only when you right-click and choose a Fibonax action |
| Site access | On every site: recognize your shortcuts as you type, insert snippets, and offer Brains in the AI chats you use | The text field you are typing in, checked on your device for a shortcut. A page's text is read only when you choose to save it to a Brain |
04 Data Collected
A. Data you provide directly
- Your content: snippets, prompts, Brains (including files you upload), folders, labels, and earlier versions you can restore.
- Account details: your email address, the name and profile photo you add, and your password if you set one. Passwords are stored only as a hash, never in plain text. If you sign in with Google, Google shares your name, email address and profile photo with us.
- Teams: your team's name, cover and logo, its members, and the email addresses of people you invite.
- Text you choose to save: a selection or an AI chat you save to a Brain from a web page.
B. Data collected automatically
- Sign-in records: for each sign-in, the time, the method, your IP address, the country it came from, and your browser and device type. You can see your own in Settings, under Security.
- Snippet and prompt use: each time you insert, copy or share a snippet, or use or copy a saved prompt, which one it was, when, and whether it happened on a computer or a phone. For a snippet, also its shortcut and language and how many fields you filled. Not the text you filled in, and not the page or site.
- Review request: how many times you've signed in and how often we've asked you to review Fibonax on the Chrome Web Store.
- Error logs: technical error messages kept in the extension on your device, for troubleshooting. They contain no browsing history.
C. Data we do NOT collect
- Your browsing history or visited URLs.
- Content of web pages you visit, unless you choose to save it or paste a link to it.
- What you type. The extension checks it on your device for a Fibonax shortcut and sends nothing.
- Your precise location. Sign-in records keep only the country.
- Any data transmitted to AI or machine learning systems (no AI integration is currently active).
05 Processing Purpose
Fibonax uses your data only to run the service. The extension refreshes its copy of your library from your account every 5 minutes. Everything else starts with something you do: typing a shortcut, choosing a menu item, clicking a button, or opening the dashboard or the phone page.
Specific processing purposes:
- Snippet expansion: matching the shortcut you type against the copy of your library on your device, and inserting the result into the field.
- Your account: keeping your content safe in your account and the same on every device where you sign in.
- Sign-in and security: confirming who you are over HTTPS, and keeping sign-in records so you can spot a sign-in that wasn't you.
- Teams: showing shared folders to the teammates you share them with, and emailing your invitations.
- Snippet and prompt use: showing when each snippet and prompt was last used and how often. In a team folder, teammates who can open it see who used it last and when, and the team's Analytics shows each member's total uses of shared items, never single uses.
- Fill from link: when you paste a link into a fill form, our server opens that public page once and reads its text to fill the form. Nothing from the page is stored.
- Brains in AI chats: when you click Context, Fibonax puts the Brain you pick into the AI chat you are using. From there, that AI service's own terms apply.
- Review request: asking free accounts, at most 5 times, to review Fibonax on the Chrome Web Store.
The legal basis for processing under GDPR is performance of a contract (Art. 6(1)(b)) for providing the service, and legitimate interests (Art. 6(1)(f)) for sign-in records, error logs, snippet use and the review request.
06 Data Storage Architecture
In the extension, Fibonax uses chrome.storage.local only, never chrome.storage.sync, for its copy of your library, your settings and your sign-in session. That copy stays in your Chrome profile and is never sent to Google's sync servers.
Your account and everything in it (your content, the files you upload and your sign-in records) are stored by Supabase in the European Union, in its Ireland region. Supabase encrypts data at rest and in transit.
Alessandro Verdicchio does not run servers of his own for this product. Supabase hosts the database, the files and the server functions, and Netlify hosts the website.
07 Third-Party Services
Fibonax uses the following third-party services. Each one receives only what it needs for its task.
Supabase stores your account and your content, runs the server functions behind features such as Fill from link, and sends sign-in and invitation emails. Supabase is GDPR-compliant, operates under a Data Processing Agreement, and hosts Fibonax's data in its eu-west-1 (Ireland) region. Privacy policy: supabase.com/privacy.
Netlify serves fibonax.com, the dashboard and the phone page. Like any web host, it receives standard request data such as your IP address and browser type. Privacy policy: netlify.com/privacy.
Only if you choose Continue with Google: Google confirms who you are and shares your name, email address and profile photo with Fibonax. Privacy policy: policies.google.com/privacy.
Planned future integration: Fibonax may in the future integrate AI-powered text generation via the Anthropic Claude API. If and when this feature is activated, this Privacy Policy will be updated accordingly and users will be notified before the integration goes live.
08 Data Retention
Local extension data stored in chrome.storage.local is retained on your device until you uninstall the extension or manually clear extension storage via your Chrome settings.
Your account and its content are kept while your account is open. You can delete your account at any time in Settings, under Account: this deletes your account, your content and your files straight away. Items you created in a team are handed to another admin of that team, if it has one. Sign-in records are kept for security and are no longer linked to your account once it is deleted. You can also ask us to delete your data (see Your Rights below).
09 Your Rights
Under GDPR (EU/EEA residents) and CCPA (California residents), you have the following rights regarding your personal data:
Request a copy of all personal data we hold about you.
Correct inaccurate or incomplete personal data.
Request deletion of your personal data ("right to be forgotten").
Receive your data in a structured, machine-readable format.
Object to processing activities based on legitimate interests.
Request that we limit how we process your data in specific circumstances.
To exercise any of these rights, contact Alessandro Verdicchio at fibonaxai@gmail.com. We will respond within 30 days. California residents: we do not sell personal data. EU residents have the right to lodge a complaint with the Italian data protection authority: Garante per la protezione dei dati personali.
10 Children's Privacy
Fibonax is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us immediately at fibonaxai@gmail.com and we will delete it without delay.
11 Policy Changes
We may update this Privacy Policy to reflect changes in our data practices, new integrations (such as future AI features), or legal requirements. When we make material changes, we will update the "Last Updated" date at the top of this page and notify registered users by email at least 14 days before the changes take effect.
12 Contact
Alessandro Verdicchio — Data Controller, Fibonax
Email: fibonaxai@gmail.com
Address: Via San Francesco d'Assisi, 154, Maddaloni (CE), 81024, Italy