Loupe — Privacy Policy
Effective 2026-10-11, revised 2026-10-30. Applies to the “Loupe” Chrome extension and to this website (home page of the developer's Chrome Web Store API client).
Loupe is a browser extension that analyses the public comment section of Bilibili (bilibili.com) videos on the user's own machine. This policy states, item by item, what data the extension touches, where that data goes, and how the user stays in control.
1. Summary
| Question | Answer |
|---|
| Does Loupe collect personal data? | No. No accounts, no analytics, no advertising, no tracking pixels, no crash reporting. |
| Does Loupe run a backend? | No. There is no Loupe server. All fetching, parsing and visualisation happen inside the user's browser. |
| Does Loupe sell or share data? | No. Nothing is sold, rented, or shared with third parties. |
| Does this website set cookies? | No. It is a static page with no scripts, no cookies and no third-party resources. |
| What leaves the browser? | Only what the user explicitly requests: a comment excerpt sent to an AI endpoint the user configured. Nothing else. |
2. Data the extension processes
- Public comments. When the user starts an analysis, the extension reads the public comment section of the current video through the user's existing Bilibili session: comment text, author display name and level, timestamps, like counts, emoticons and images. This data is processed locally and cached in the browser's IndexedDB. It does not leave the device unless the user performs the AI step described in section 3.
- Local settings. Preferences (theme, crawl limits, AI endpoint and key) are stored in
chrome.storage.local on the user's machine.
- Write actions initiated by the user. When the user likes a comment, replies, or posts a comment, the extension calls Bilibili's own endpoints from the Bilibili page context, using the session the browser already holds and the page's CSRF token (
bili_jct). The token is read at the moment of the request and used only in that request body: it is never stored, never sent to the extension, never logged, and never written to caches or snapshots. These actions are exactly what the user would otherwise do on the Bilibili website.
3. When data leaves the browser
- The extension calls no external service by default.
- Only if the user enables “AI analysis” and clicks it does the extension send a size-limited excerpt of comments to an OpenAI-compatible endpoint the user enters themselves (base URL and model are user-provided).
- The developer operates no endpoint, does not proxy these requests, and never receives the excerpt. The user is responsible for reviewing the privacy terms of the endpoint they choose.
- The API key the user enters is stored locally in
chrome.storage.local and is not included in snapshots or sent to the developer.
4. Page access and permissions
- The extension runs on Bilibili video pages so it can read the public comment section and, if the user switches the feature on, display a replacement comment area.
- It reads nothing unrelated to comments: no passwords, no mailbox, no direct messages, no browsing history.
- If the extension is reloaded or updated, it stops and asks the user to refresh the page.
5. Retention and deletion
- Cached comments and settings stay on the user's device: they can be removed per snapshot in the extension's “History” panel, by closing/clearing the extension's storage, or by uninstalling the extension (everything is removed with it).
- Nothing is retained anywhere else, because nothing is transmitted elsewhere.
6. The OAuth client used for publishing
- This website is the home page of a Google OAuth client used by the developer to publish Loupe updates through the official Chrome Web Store API.
- That client requests a single scope,
https://www.googleapis.com/auth/chromewebstore. It is used only from the developer's own computer to upload and publish the developer's own store item.
- It does not access any end user's Google account, and it is not part of the extension.
- Its refresh token is stored in a local
.env file on the developer's machine, never in a repository, and never shared.
7. Changes
Material changes to this policy will be reflected in the “revised” date above and noted in the extension's release notes.
Contact: sz7372797@gmail.com · See also the terms of service.