M
Modular Chunks
Sign inGet Started
Back to home
/ Legal

Privacy Policy

What we collect, why we collect it, and how to delete it. Modular Chunks is in open beta — this policy will be updated as the product matures.

Last updated

2026-05-11 · open beta v0.11.0 (added Chrome extension section)

What we collect

  • Account data. Email and a hashed password (or OAuth identifier) when you sign up. Stored in Supabase.
  • Project data. Brief, architecture, PRD, blueprints, chunk specs, and feedback you create. Stored per-account.
  • Usage data. Anonymised pipeline events (stages run, chunks generated, validation results) to improve the platform.
  • Coding-tool metadata. Which coding agent you selected in pre-flight (Cursor, Claude Code, etc.). We do not see your prompts to those tools.

What we do NOT collect

  • The contents of files generated by your coding agent. Code lives on your machine and in your hosting provider, not ours.
  • Third-party API keys you set in pre-flight (Anthropic, OpenAI, Gemini, Ollama). Those are stored client-side or via the CLI's local config.
  • Tracking pixels, fingerprinting, or behavioural ads.

Where data lives

  • Authentication, project state, and chunk blueprints: Supabase (PostgreSQL, EU/US regions).
  • Generated AI outputs at runtime: Anthropic, Google Gemini — depending on which model the pipeline used.
  • Durable workflow execution: Inngest.
  • Rate limiting + cost guards: Upstash Redis.
  • Telemetry: Sentry (errors), PostHog (product analytics).
  • Transactional email: Resend.
  • Static assets and edge functions: Vercel.

Chrome extension — Ask Chunky

Modular Chunks ships a Chrome extension ("Modular Chunks — Ask Chunky") that puts Chunky in a Chrome side panel beside your work. The extension is a thin client over the same APIs the web platform and CLI use — it has no separate data store.

What the extension stores on your device (in chrome.storage.local, never synced to your Google account):

  • Your CLI token. Pasted via the settings panel. Used as Authorization: Bearer on every request to modularchunks.com. Removable via Settings → Clear conversation history (clears chat) or by removing the value in the token field and Saving.
  • Your preferred base URL. Defaults to https://www.modularchunks.com; developers can override for localhost.
  • Pending right-click selection (transient, chrome.storage.session). When you invoke "Ask Chunky about this" on selected text, the selection is stashed for the side panel to pick up; auto-cleared after the panel reads it. Lives only until the browser session ends.

What the extension sends to modularchunks.com (and nowhere else):

  • Chat messages. What you type to Chunky in the side panel, plus the host + title of your active tab as system context, plus any text you attached via right-click. Sent to POST /api/extension/chunky-chat. Used to generate Chunky's reply via Anthropic's API.
  • Chunk format requests. When you click Copy on a chunk card, the extension asks POST /api/extension/chunks/:id/format for the paste-ready text. The chunk content itself is already yours — we're just formatting it.
  • Anonymous telemetry events. One event per user action: session_open, platform_seen, chat_message_sent, chunk_copied, selection_captured. No message bodies, no clipboard contents, no page contents. Sent to POST /api/extension/telemetry to help us decide which platforms to support better.

What the extension explicitly does NOT do:

  • Read or scrape the contents of the pages you visit.
  • Inject scripts into AI-coding platforms (Bolt, Lovable, v0, Replit, Claude, ChatGPT, etc.). Copy/paste is explicit — nothing leaves your clipboard until you paste it yourself.
  • Track browsing history, cross-site activity, or any other tab while the side panel is closed.
  • Share data with third parties. The only network destination is your own Modular Chunks account at modularchunks.com.

Permissions justified: sidePanel for the side-panel UI · storage for your CLI token + base URL · activeTab to read the URL/title of the tab you're currently looking at (only when the side panel is open) · contextMenus for the "Ask Chunky about this" right-click. Two host_permissions: https://www.modularchunks.com/* and https://modularchunks.com/* — both your own account, both HTTPS.

Payment processing — LemonSqueezy

Payment processing is handled by LemonSqueezy (a Stripe Group company), the merchant of record for your Modular Chunks subscription. When you start a paid plan, your name, email, IP address at checkout, billing address, and payment instrument details are transmitted directly to LemonSqueezy and are not stored on our servers. The full LemonSqueezy privacy policy is at lemonsqueezy.com/privacy.

On our side we retain only the LemonSqueezy subscription identifiers (customer_id, variant_id, subscription_id) plus event metadata required to verify entitlement and enforce per-project spend caps. No card numbers, CVV, or bank account numbers ever touch our infrastructure. Webhook payloads are HMAC-signature verified before any database write.

Your rights

  • Access. Every brief, architecture, PRD, blueprint, and roadmap is downloadable as PDF / HTML / JSON from the relevant page's Download menu.
  • Deletion. Use the Account settings (post-launch) or contact support — we will delete your account and project data within 30 days of request.
  • Correction. Edit any field on any pipeline page; the change is applied immediately.
  • Portability. JSON exports are machine-readable and round-trip-safe.

Cookies

We use first-party cookies for authentication (Supabase session). No third-party tracking cookies. No advertising cookies.

Children

Modular Chunks is not directed at children under 13. If you are under the age of majority in your jurisdiction, do not create an account.

Changes

This policy will change as the product graduates from open beta. The current version is always at this URL with the "Last updated" date above.