Privacy Policy

WhipWhip is a browser extension that overlays a control panel on the web chat UIs of ChatGPT, Claude, Gemini, Grok, and Perplexity, letting you assemble and run reusable "Whip" automations across those chat tabs.

What we collect

Nothing. WhipWhip has no backend server and requires no account. Your conversations never leave your browser — the extension does not transmit prompts, replies, or page content anywhere.

The extension makes exactly one kind of outbound request, and only to our own share board: it reads a published post from that board when you import a set by address, when you check whether a set you took has an update, or right after you publish one. That request carries a post id, no credentials, and none of your conversation data. We — the developers — never receive, see, or store any of your data.

What the extension stores, and where

All extension state is kept locally in your own browser (a few values are discarded when the browser closes):

• Your WhipSets and Whips (the automations you build), including any prompt text and variable definitions they contain.
• Workspace state: tab groupings, conversation tags, and the runtime values of variables you capture during a run.
• Extension settings (e.g. Always-Open mode, Auto-track Workspaces).

This data never leaves your browser. It is not synced to any server, not shared with the developers, and not transmitted to third parties. Uninstalling the extension removes it.

What the extension accesses

To do its job, WhipWhip reads from and writes to the page (DOM) of the five supported chat sites only:

• Reading text you and the AI have typed in the chat (to relay, compare, or store it as a variable when a Whip asks for it).
• Writing text into the chat composer and clicking send (to run a Whip).
• Opening, switching, and grouping tabs among the supported sites (cross-tab orchestration).

On our own site, whipwhip.center, a second, smaller content script adds WhipWhip's own controls to the page: a launcher for your saved WhipSets, an Import button on a shared WhipSet post (it fetches that one post — the request described above), and, on the new-post form, a picker that fills the form's share field with a WhipSet you choose. It never submits the form — you do — and it does not read anything else on the site.

WhipWhip does not read pages on any other website. Its content scripts are injected only on the host domains listed below, and nowhere else.

Permissions and why they are needed

Permission	Purpose
storage	Save your WhipSets, workspaces, and settings in local browser storage.
unlimitedStorage	Lift the default local-storage size cap so long conversation captures and large WhipSets are not truncated.
tabGroups	Group the tabs belonging to one workspace so they stay visually together.
Host access to chatgpt.com, gemini.google.com, grok.com, www.perplexity.ai, claude.ai	Operate the chat UI (read replies, write prompts, send) on each supported service. No social or general-purpose domain is requested.
Host access to whipwhip.center	Read a published post from our own share board — the one outbound request described above — and show WhipWhip's import and share controls on that site.

The panel UI is mounted on every page of the five chat domains above — it is a general launcher, not a per-page feature. Reading and writing chat content only ever happens against the chat interface of a supported service.

WhipWhip requests no activeTab and no scripting permission: its content scripts are declared statically in the manifest for those six hosts (the five chat sites and whipwhip.center), so there is no mechanism by which they could be injected into any other site.

WhipWhip requests no broad host access (<all_urls>), runs no remote code, and calls no third-party service. Its only outbound request is the share-board read described above.

Sharing a WhipSet

Sharing a WhipSet produces a portable encoded string that you copy and hand to someone yourself (e.g. by message or file). Exporting it uploads nothing anywhere. Posting that string to our share board is a separate step you choose to take, and the next section covers it. Either way your chat content is never part of a share — only the automation definition you export.

The WhipWhip site (separate from the extension)

Everything above describes the extension, and none of it changes: the extension still has no backend, no account, and sends nothing about your conversations anywhere — beyond the single request described above, which carries a post id and nothing else. The WhipWhip product site is a separate service, and this section covers it — it is also the only host the extension ever reads from, as described above.

• Reading is anonymous. Browsing the site — landing page, guide, FAQ, legal notices, and the boards — requires no account and no sign-in.
• Signing in is only required to write. Sign-in is Google only. When you sign in we receive your Google account identifier, name, and email address; our authentication provider stores them with your sign-in record. In our own table we keep the account identifier, a nickname, and a role ('user' or 'moderator'). The nickname starts as an automatic handle (user-…) and you can change it; it is shown publicly next to what you write. We never show or store your Google name as your nickname, and we do not build it from your email address.
• What you post is public. A post's title, description, and the WhipSet share string you paste are readable by anyone, signed in or not.
• Where it is stored. The site runs on Vercel and the database is Supabase, hosted in Seoul, South Korea.
• We count views and imports. When a post is opened, or fetched by the extension to be imported, we record that it happened so the board can later show popular sets. Each record holds four things: which post, which of the two events, the time, and a one-way hash derived from your IP address together with the post and the date. We never store your IP address, and the hash cannot be turned back into it. It exists only so that one visitor counts once per post per day, and it changes every day. Nothing in these records identifies you or is shown next to your name.
• We count site pageviews. The site uses Vercel Web Analytics to count how many times its pages are viewed. It sets no cookies, does not store your IP address, and does not identify or follow individual visitors — we see aggregate page counts, nothing else. This is about the site only: the extension sends no analytics, and none of the statements above about the extension change.
• The uninstall page has an optional survey. If you remove the extension, your browser may open our page /bye. You can pick one reason and, if you like, write one line (up to 200 characters) — no sign-in needed. We store the reason, the line, the language, the time, and a one-way hash derived from your IP address and the date (so one visitor sends at most once a day). We never store your IP address, and the hash cannot be turned back into it. Nothing here identifies you or is shown publicly; please do not write personal information in the line. The extension itself sends nothing — the page is simply opened by your browser.
• Deleting your account does not delete your posts. The posts remain and the author label becomes "Deleted user". This is irreversible — once the account is gone, nothing in the database connects those posts back to it. Deleting your own posts is a separate action you can take at any time while signed in.
• Moderation. A moderator can hide a post. Hidden posts are not readable by anyone, including their author, and the row is kept so a mistake can be undone.

Your AI chat provider

WhipWhip operates on top of ChatGPT, Claude, Gemini, Grok, and Perplexity, but is not affiliated with them. Anything you send into those chats is governed by that provider's own privacy policy and terms, exactly as if you had typed it yourself.

Children

WhipWhip is a general-purpose productivity tool and is not directed at children under 13.

Changes

If this policy changes, the effective date above is updated (the version tracks the extension release, not this document). Material changes will be reflected in the extension's store listing.

Contact

Questions about this policy: lastdeathdragon@gmail.com