1. Scope
Space Pilot is a Chrome extension that prepares editable drafts in Chat-Space at the user’s explicit request, assists with letters, translates selected text, and displays local operational analytics. Every send begins only after an explicit user action: the extension does not initiate background or hidden automatic sending. If the user sends an edited Russian layer, Space Pilot may first perform a protected back-translation and then complete that specific command through the native Chat-Space interface.
Not every operation is performed locally. For generation and translation, the minimum required context is sent over HTTPS to the AI providers listed below.
2. Data Used by the Extension
After the disclosure is accepted, and only in the active app.chat-space.ai tab, the extension may process:
- authentication data: the email address and password entered for sign-in, the resulting Chat-Space access token, and the DeepSeek and Venice API keys entered by the user; the password is transmitted only for sign-in and is not stored;
- the text of recent messages and letters, their order, authorship, and exact identifiers for the “your profile–client” pair;
- available fields from your profile and the client profile, private notes, the verified real name, interaction signals, current online presence, and current blacklist state;
- locally derived context: relationship stage, mood, recent emotions, last-conflict status, response history, and profile-analysis results;
- text selected by the user for translation and edits to the draft’s Russian layer;
- settings, the privacy-consent record, cache state, route, and results of local safety and validation checks;
- local operational and quality metrics: requests, tokens, estimated cost, language category, warning count, model choice, hook or emoji category, whether a draft was sent or edited, repair or regeneration events, subsequent client replies, and a broad latency bucket. Prompt, draft, and customer-reply text is not stored in these statistics.
After consent, Space Pilot may read relevant visible DOM content and relevant Chat-Space API, fetch/XHR, and WebSocket traffic in the active app.chat-space.ai tab. Access is limited to the stated purposes of drafting, profile analysis, translation, safety, and local diagnostics.
A technical image, attachment, or post-like signal does not mean the extension can see or analyze the image or file itself. It must not infer appearance, background, voice, or the content of hidden media.
3. Where Data Is Sent
| Service | Purpose | What is transferred |
|---|---|---|
| Chat-Space | Authentication and access to authorized workspace data | Email, sign-in password, and the requests required for the active account. The resulting access token is stored locally in encrypted form; the password is not stored. |
| DeepSeek | Standard Chat and Mail drafts, connection testing, and requested profile analysis | The API key and the compact written context required for the specific request. |
| Venice | Translation and eligible specialized Chat and Mail 18+ routes | The API key, the selected text for translation, or permitted adult written context. Adult Chat uses a separate attested encrypted transport; Mail 18+ is sent over HTTPS and is not represented as E2EE. |
Depending on the adult route, the Venice context may include compact fields from your profile and the client profile, private notes, recent written dialogue, interaction signals, the required current-presence state, the current blacklist state, derived conversation controls, and a candidate draft for an allowed, limited quality pass. Visual media are not used as evidence for this route.
Translation of a selected message receives only that text and the translation instruction, not the full profile, notes, or history. When the Russian layer is edited, the source draft, edited text, and minimal route and language target are sent. Adult translation routes never fall back to DeepSeek.
Transmission to the disclosed services is required for the feature initiated by the user. Each service processes information under its own terms and privacy policy. Space Pilot does not sell data, use it for advertising, or give people access to private conversation content except where required by law.
4. Local Storage and Protection
- AES-GCM. The Chat-Space access token, provider API keys, login email, profiles, notes, history, compact memory, derived context, profile analysis, recent-draft memory, and instructions are stored in authenticated encrypted envelopes.
- Local keys. Encryption keys are created for the current Chrome profile and are never exported as plain text.
- Purpose separation. Credentials, profiles, notes, history, and compact memory are kept separate and never substituted for one another.
- Bounded storage. Inactive local history and memory use a target retention period of up to 90 days and soft size quotas. This is an operational target, not a guarantee of deletion at an exact second.
- Short-lived status caches. A verified exact blacklist pair may be stored in encrypted form for up to 30 minutes; a negative result remains in page memory for up to five minutes. Presence is short-lived evidence and is not retained as a separate long-term log.
- No advertising tracking. The extension contains no third-party advertising or analytics SDK and does not send local analytics to an external analytics service. Content-free operational and quality metrics are measured locally. Data is not sold or used for advertising or credit decisions.
Encryption at rest protects stored data from ordinary inspection or export, but it cannot protect against malicious code already running inside a trusted extension context or a compromised Chrome profile. No security measure can provide an absolute guarantee.
5. Data Collected by spacepilot.work
When a visitor submits an access or support form, the website receives their name, work email, team size for an access request, and comment text. This data is used only to respond and is delivered to the website owner's email through WordPress. To enforce a one-minute submission limit, the website temporarily stores a one-way hash of the IP address; the plain IP address is not stored in the transient.
This theme does not load external analytics, advertising pixels, or web fonts. Retention of submitted messages is determined by the website owner and their email service; deletion can be requested using the address in the footer.
WordPress hosting may maintain standard technical security logs, such as IP address, request time, and user agent. Retention periods for these logs are determined by the selected hosting provider's settings.
6. User Controls
From the extension popup, you can forget an individual API key, clear the dialogue cache, optimize storage, or run Clear All Data. A full clear removes protected content, credentials, and local keys. Uninstalling the extension also removes its Chrome-managed storage.
The website owner is the controller of data voluntarily submitted through spacepilot.work forms and can be contacted at the email address in the footer. Full details of the party providing the product and the applicable jurisdiction are stated in the individual proposal, agreement, or other required disclosure. The same email address may be used to request access to, correction of, or deletion of form data, subject to applicable law.