Effective date: June 1, 2026 · Applies to: the 6to9 Chrome extension and app.6to9.ai
Extension privacy policy
6to9 is a prototyping tool for product managers, designers, and engineers. This policy explains what data the 6to9 Chrome extension collects when you use it, why we collect it, and what we don't do. We are a small team — this is the actual policy, not a sanitized summary.
What we collect
We collect data in three buckets, all triggered by your explicit actions:
Account identity
When you sign in at app.6to9.ai (Google OAuth or email), we receive your email address, a Google account ID (if applicable), and any profile fields you supply. This is stored in our Supabase database.
Editing-session content
When you open the panel on a page and submit an instruction (e.g. “rewrite this CTA”), the extension sends our agent server:
- the URL of the page you have open;
- the part of the page’s DOM around the element you picked;
- a screenshot of the region you picked or dragged;
- your typed instruction text.
When you click Save & share, we additionally capture a full-page screenshot of the page using Chrome’s debugger API and persist the resulting prototype (your edits + screenshots) to a Google Cloud Storage bucket under your account.
Diagnostic events
We log API request metadata (timestamp, request type, error codes) on our agent server. We do not log page contents or DOM payloads in production telemetry. The panel itself does not call analytics.
What we do with it
- Generate edits. Your editing-session content is sent to Anthropic (Claude), OpenAI (GPT), or Google (Gemini) — your choice in the panel settings — to generate the DOM patches that satisfy your instruction. These providers process the data under their own privacy policies and do not retain it for training when accessed via our API keys.
- Render share previews. Saved prototypes are served from Google Cloud Storage when teammates open the share URL you give them.
- Operate the product. Account identity is used to authenticate API calls and to scope your saved prototypes to your account.
What we don’t do
- We do not sell your data, share it with advertisers, or use it for targeted marketing.
- We do not run the extension in the background. The content script does not transmit page data unless you open the panel and submit an instruction.
- We do not collect keystrokes, form-field contents, passwords, or financial data.
- We do not use editing-session content to train our own models.
Third parties
| Vendor | Purpose | Data shared |
|---|---|---|
| Anthropic (Claude) | LLM inference for DOM edits | Editing-session content (when you select Anthropic) |
| OpenAI (GPT) | LLM inference for DOM edits | Editing-session content (when you select OpenAI) |
| Google (Gemini) | LLM inference for DOM edits | Editing-session content (when you select Gemini) |
| Supabase | Account + prototype database | Account identity, prototype metadata |
| Google Cloud (Cloud Run + Cloud Storage) | Agent hosting + screenshot/artifact storage | Editing-session content, screenshots |
| Google (OAuth) | Sign-in | Email + Google account ID, if you sign in via Google |
Retention
We retain your account identity and saved prototypes for the lifetime of your account. The agent server keeps request-level diagnostic logs for 30 days for debugging, then deletes them. You can request deletion of your account and all associated prototypes by emailing support@6to9.ai with the subject line “data deletion”; we action requests within 14 days.
Children
6to9 is not intended for users under 16. We do not knowingly collect data from children.
Changes
We will update this policy as the product evolves. The effective date at the top reflects the current revision. Material changes will be announced via the extension’s update notes.
Contact
Questions about this policy? Email support@6to9.ai.