Security Guide

Introduction

This Security Guide explains how "dAIly Planner" Chrome Extension ("we", "our", or "the extension") handles your data securely and what security measures are in place to protect your information.

Data Storage and Security

What Data is Stored Locally?

• Schedule Data: Your daily, weekly, monthly, and quarterly schedules
• User Settings: Your name, preferences, and configuration
• Gemini API Key: Stored securely using Chrome's encrypted storage
• Language Preference: Your selected language (Korean/English)

API Key Security

How Your API Key is Protected

• Local Storage Only: Your Gemini API key is stored only on your device
• No Transmission: The API key is never sent to our servers
• Direct API Calls: API calls are made directly from your browser to Google's servers
• Password Field: The API key input uses a password field to prevent shoulder surfing

Data Transmission

When Data Leaves Your Device

Data is only transmitted in the following scenarios:

1. AI Analysis Requests

• What: Schedule descriptions and context
• Where: Directly to Google's Gemini API servers
• When: Only when you explicitly request AI analysis or chat assistance
• Encryption: All transmissions use HTTPS (TLS 1.2+)

2. Chat Messages

• What: Your chat messages and schedule queries
• Where: Directly to Google's Gemini API servers
• Storage: Chat history is stored locally, not sent to Google

Third-Party Services

Google Gemini API

• We use Google's Gemini API for AI-powered schedule analysis and chat
• When you use AI features, data is sent to Google's servers
• Google's privacy policy applies: https://policies.google.com/privacy
• We do not control how Google processes this data
• You can review Google's security practices: https://cloud.google.com/security

Permissions Explained

Required Permissions

• storage: To save your schedules and settings locally
• sidePanel: To display the extension interface
• activeTab: To detect text selection on web pages

Content Scripts

• Content Scripts: Declared in manifest.json to automatically inject content.js into web pages for text selection detection and "Add as Task" button display. No dynamic scripting permission is required.

Host Permissions

• https://generativelanguage.googleapis.com/*: To communicate with Google's Gemini API

Data Deletion

How to Delete Your Data

1. Open the extension side panel
2. Go to Settings
3. Clear your API key (optional)
4. Uninstall the extension from chrome://extensions/

Security Best Practices

For Users

• Keep your Chrome browser updated
• Use a strong, unique API key
• Regularly review your schedule data
• Don't share your device with untrusted users
• Monitor your Google Cloud Console for unusual API usage

For Developers

• Review the source code on GitHub
• Report security vulnerabilities responsibly
• Keep the extension updated

Vulnerability Reporting

If you discover a security vulnerability, please report it responsibly:

• Email: lucestdail@kakao.com
• GitHub: https://github.com/lucestdail

Please include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)