Privacy Settings Guide

TLD2 is built on a privacy-first architecture that keeps your reading habits completely private. This guide explains how TLD2 protects your data, what information is stored locally, and how to verify zero data transmission.

Understanding Local-First Architecture

What "Local-First" Means

TLD2 processes everything on your device—in your browser—using cutting-edge client-side AI technologies:

• Content Extraction: Readability.js runs locally to isolate article content
• AI Summarization: Chrome's built-in AI (or algorithmic fallback) generates summaries without internet
• Text-to-Speech: StreamingKokoroJS neural voices synthesize audio locally using your GPU/CPU
• Model Storage: All AI models download once and cache permanently in your browser

This means no cloud dependency, no API calls, no data transmission in default mode.

Data Flow Diagram: Local AI Mode

Local AI vs. Cloud AI Comparison

Feature	Local AI Mode (Default)	Cloud AI Mode (Optional)
Data Transmission	check_circle Zero - Everything local	cancel Article text sent to Google
Internet Required	check_circle No (works offline)	cancel Yes (API calls)
Privacy Level	check_circle Absolute (no tracking possible)	report Subject to Google's privacy policy
Cost	check_circle Free forever	paid Free tier, then pay-per-use
Speed	Fast (GPU) or moderate (CPU)	Fast (depends on internet)
Quality	Good (Chrome AI)	Excellent (Gemini 2.5 Flash)
Usage Limits	check_circle Unlimited	API rate limits apply
Best For	Privacy-conscious users, offline use, unlimited reading	Complex technical articles, when highest quality needed

What Data TLD2 Stores Locally

TLD2 uses Chrome's chrome.storage.local and chrome.storage.sync APIs to store only your settings:

Stored Settings

• Voice Preference: Your selected Kokoro voice (e.g., af_sky)
• Playback Settings: Speed (e.g., 1.2x), pitch, pitch correction toggle
• Auto-play Preference: Boolean (enabled/disabled)
• Summary Length: Short, medium, or long
• API Key (if provided): Your Gemini API key for cloud mode
• Theme Preference: Dark/light mode selection
• Info Printout Toggle: Status text visibility

NOT Stored

• ❌ Article content or URLs
• ❌ Generated summaries
• ❌ Browsing history
• ❌ Usage analytics or telemetry
• ❌ Personal information
• ❌ Audio recordings

How to Verify Privacy

Method 1: Network Tab Inspection

1. Open Chrome DevTools (F12 or Cmd+Option+I)
2. Go to the Network tab
3. Clear all existing requests (trash icon)
4. Navigate to an article and click the TLD2 extension icon
5. Watch the Network tab as the summary generates

Expected Result in Local AI Mode: Zero outbound network requests to external domains (except the original article page load). No requests to:

• ❌ *.anthropic.com
• ❌ *.openai.com
• ❌ *.google.com
• ❌ analytics.google.com
• ❌ Any third-party tracking domains

Method 2: Extension Permissions Audit

1. Go to chrome://extensions
2. Find TLD2 and click Details
3. Review Permissions

TLD2's Minimal Permissions:

• activeTab - Read current tab content for extraction
• scripting - Inject Readability.js content script
• storage - Save your settings locally
• sidePanel - Display sidebar UI
• contextMenus - Right-click "Summarize Article" option

Notably absent:

• ❌ webRequest - Can't intercept network traffic
• ❌ history - Can't access browsing history
• ❌ tabs - Can't read URLs of other tabs
• ❌ <all_urls> - No broad access

Method 3: Code Inspection

TLD2's source code is available for review. You can inspect the extension's files directly:

1. Go to chrome://extensions
2. Enable Developer mode
3. Click Details on TLD2
4. Note the extension's installation path
5. Browse the files to verify no analytics or tracking code

Enabling Cloud AI Mode (Optional)

If you want enhanced summarization quality for complex content, you can optionally enable Cloud AI mode using Google's Gemini API.

What Happens in Cloud Mode

• Data Sent: Extracted article text (only the main content, not ads/navigation)
• Destination: Google's Gemini API servers
• Purpose: AI summarization using Gemini 2.5 Flash model
• Return: Summary text (sent back to your browser)
• Privacy Policy: Subject to Google's terms

How to Enable Cloud Mode

1. Obtain a Gemini API key from Google AI Studio
2. Open TLD2 settings
3. Find "Developer Options" section
4. Enter your API key in the "Gemini API Key" field
5. Click Save

TLD2 will now use Gemini for summarization while continuing to use local TTS for audio.

Chrome Extension Manifest V3 Security

TLD2 uses Manifest V3, Chrome's latest and most secure extension architecture:

Security Benefits

• Content Security Policy (CSP): Blocks remote code execution. All code bundled statically.
• No Eval: No eval() or dynamic code execution.
• Service Workers: Background script runs in isolated context.
• Permissions API: Granular, user-controlled permissions.
• Host Permissions: Only accesses pages you explicitly activate TLD2 on.

CSP Compliance

TLD2's Content Security Policy:

This allows:

• ✅ 'self' - Only bundled local scripts
• ✅ 'wasm-unsafe-eval' - WebAssembly for ONNX Runtime (required for TTS)

This blocks:

• ❌ Remote scripts from CDNs
• ❌ Inline scripts (prevents XSS attacks)
• ❌ eval() and dynamic code execution