Privacy policy

Effective date: 11 September 2026. Last updated 11 September 2026 (version 1.2.0).

What the extension reads

Only Fan Out watches network responses on chatgpt.com, chat.openai.com, claude.ai and grok.com pages: the streamed response when you send a message, and the JSON response or responses when you open a stored conversation. It reads these to extract the fan-out search queries, sources fetched and cited, product cards, places, X posts and text the assistant already sent to your browser. It does not read any other page, any other network request, or any data outside those four origins.

When you open the side panel on a conversation it has not captured yet, or when you click "Re-read," Only Fan Out re-reads that conversation over a same-origin, cookie-authenticated request to the engine's own conversation endpoint, the same request the engine's own web app makes:

• ChatGPT: reads your ChatGPT session token from ChatGPT's own same-origin session endpoint (/api/auth/session, the same request the ChatGPT web app itself makes) and uses it for one request to chatgpt.com's own conversation endpoint. The token is held in memory only for the length of that one request. It is never written to storage, never logged and never sent anywhere other than that one request to chatgpt.com.
• Claude: reads no session token at all. It resolves the workspace id from a cookie claude.ai already set, or from claude.ai's own organisations endpoint, then makes one cookie-authenticated request to claude.ai's own conversation endpoint. No token or cookie value is stored, logged or sent anywhere other than that request.
• Grok: reads no session token and no cookie value. It makes two or three cookie-authenticated requests to grok.com's own conversation endpoints (a response-node lookup, a load-responses request, and a best-effort title lookup), using the browser's existing session exactly as the Grok web app does. One of these, load-responses, is a POST despite being a read: it sends only the response ids already visible in the conversation, to fetch their content, and writes nothing.

Outside of these re-read requests, the extension makes no requests of its own: it otherwise only observes responses your browser already received because you were using the assistant. Every request the extension makes is to chatgpt.com, chat.openai.com, claude.ai or grok.com itself, using requests each web app already makes in the normal course of you using it. There is no extension server, and no data leaves your browser.

Connector search queries on Grok

Grok can run searches against connected Gmail, Drive or Calendar accounts as part of answering a turn. When it does, Only Fan Out counts that search and records which tool ran it, but never reads, stores, exports or watchlist-matches the query text itself, since that text can reach into private data the extension was never meant to touch.

What the extension stores

Parsed conversations, your watchlist, your settings and, if you turn on "Keep raw captures for debugging" in Settings, the raw unparsed payload of each capture, are stored using chrome.storage.local, a storage area private to the extension and local to your device. All of it stays on your machine: none of it is transmitted anywhere, not to OpenAI, not to Anthropic, not to xAI, not to the extension's developer, and not to any third party.

Data deletion

You can delete stored data at any time:

• Delete a single conversation from the History view.
• Use "Clear all data" in Settings to remove every captured conversation. Settings and your watchlist are kept.
• Removing the extension deletes everything chrome.storage.local was holding for it.

Third parties

Only Fan Out has no third-party integrations, no advertising, no analytics SDKs and no telemetry of any kind. No data about your usage of the extension, or about the conversations it captures, is ever sent off your device.

This website (onlyfanout.com)

This policy also covers the onlyfanout.com website, separate from the extension. The website sets no cookies, runs no analytics, and includes no tracking scripts of any kind. It is a static set of pages with no server-side logic beyond serving files. Loading a page here fetches the Roboto font from Google Fonts and the page's own assets; no other requests are made.

Permissions

Only Fan Out requests sidePanel (its entire interface is a Chrome side panel), storage (so captured conversations, your watchlist and settings survive a browser restart, stored locally only), and host permissions for chatgpt.com, chat.openai.com, claude.ai and grok.com so its content scripts can read the network responses those pages already receive. No other permissions are requested: no tabs, no scripting, no downloads, no broad host pattern, and no remote code execution.

Changes to this policy

If this policy changes, the version and date at the top of this page will be updated, and the change will ship alongside a new version of the extension.

Data controller and contact

Gerald Ho develops and maintains Only Fan Out and this website. Questions about this policy or the extension's data handling can be sent to gerald@axecute.space, or raised through the extension's Chrome Web Store listing. Since no data leaves your browser, there is no user data on file to request or delete on our end: everything you would ask for already lives on your own device.