Your code and keys stay yours.
This Chrome extension works fully without an account and then collects nothing (except a message you choose to send us through Contact us): everything runs in your browser. If you choose to create an optional account, your settings, progress and history are also backed up to our server, and simple usage numbers help us improve the extension (you can switch that off) — never your code or your API keys. Your code only leaves your browser when you ask for an AI answer: with your own provider key it goes straight from your browser to that provider; if you have no key and you allow the free shared AI (signed-in accounts only), it goes to our server and on to the AI provider, to be analysed, and is not stored or logged.
1What the extension handles
Everything below is stored on your device. Without an account, nothing is sent to us. If you create an account, the settings, progress and history are also stored on our server (see Accounts and cloud sync).
| Data | Why | Where it goes |
|---|---|---|
| Your code (LeetCode editor, or the Playground) | To analyze time and space complexity and, in the Playground, to run it. | Stays in your browser unless you use AI analysis — see section 2. |
| Problem title and statement | Context for AI analysis (the statement is sent only if that option is on). | Local by default; with AI, sent only to your chosen provider. |
| AI provider API keys | To authenticate to the provider you chose. | Local (chrome.storage.local, never synced). Each key is sent only to its own provider, as an HTTP header, when you analyze with AI. |
| Settings | Provider and model, theme, popup position, the settings site's own light / dark choice, editor preferences (theme, font, size, tab width, word wrap, layout), shortcuts behaviour. | Local only. |
| Analysis history | Your recent analyses, plus statistics computed from them: streaks, activity heatmap, weekly efficiency trend and breakdowns. | Local only. Stores the problem title, number and link, language, resulting complexities, date and whether AI was used — never your code. Capped at 100 entries. |
| Road map progress | So the road map and the DSA patterns pages can show how far along you are. | Local only: which practice problems you ticked as solved (their LeetCode names, such as two-sum), which patterns are complete, and whether sounds are on. Nothing else about your study is recorded. |
| LeetCode problem examples (only when you press Solve here) | So the Playground can test your code on the examples LeetCode shows for that problem. | Local only: the problem's public examples, the name of the method it asks for and LeetCode's own starting code for it in the languages the extension offers, for the problems you opened (at most 80, newest kept). They are read from leetcode.com the way the problem page itself reads them: no account data, code, cookies or passwords are read or sent anywhere. |
| LeetCode connection (only if you press Connect LeetCode) | To check which of the road map's practice problems you have really solved. | Local only: your LeetCode user name and which of the listed problems are accepted. The check runs on leetcode.com in your own signed-in browser session, exactly as the site's own pages ask LeetCode; your password, cookies, submissions and code are never read, stored or sent anywhere. Disconnect deletes it. |
| Preferences | Your default language and the optional daily practice reminder (on or off, and the time). | Local only. The reminder is made on your computer with Chrome's own alarms and notifications; no account is involved and nothing is sent anywhere. |
| Requests from the API explorer (only when you press Send) | The Dev tools page can send an HTTP request that you build yourself (one of the example public APIs, or your own URL, headers and body). | Sent by you The request goes straight from your browser to the address you chose, with exactly what you typed, and nowhere else: no proxy, nothing is logged or stored by the extension beyond the open page. If the server does not allow browsers to call it, Chrome asks you for permission for that one address first. |
| Debug log (for bug reports) | A short, structured log of what the extension did (timings, counts, status codes, short error names), so a problem can be reported with facts. Warnings and errors are always kept; detail only while you switch Debug logging on under Privacy & data. | Local only, never synced or sent. Kept in memory and in chrome.storage.session, which Chrome clears when the browser closes. It never contains your code, API keys, tokens, passwords, e-mail addresses or message bodies. You can view, copy, download or clear it; nothing leaves your device unless you attach it to a report yourself. |
| Short-lived cache | To make repeat analyses instant. | In memory; discarded when the browser stops the extension's background process. |
2AI providers (optional)
AI analysis is off until you add a key. You pick one provider at a time.
- When you press Analyze with a key configured, your code (and, if enabled, the problem statement) is sent directly from your browser to the selected provider using your own key. It does not pass through any server of ours.
- That provider processes the request under your agreement with them and under their own terms and privacy policy.
- A custom server is any OpenAI-compatible address you enter — for example Ollama on your own computer, in which case nothing leaves your machine. Chrome asks your permission for that one address at the moment you set it up.
- Offline only blocks all network use for analysis, even if keys are saved.
The free shared AI (optional, no key of your own)
If the person who runs the service has provided an AI key on the server, signed-in users with a confirmed e-mail address and no AI key of their own can get AI answers through it, for free, up to a daily limit. It is used only if you agree once (a question appears the first time) and never when you use Offline only.
- What is sent: your code and its context (language, the problem title, and the problem statement only if that setting is on) are sent over HTTPS to our server, which builds the prompt itself and sends it to the AI provider the owner selected, with the owner’s key. The provider’s answer comes back through our server to your browser.
- What is kept: your code and the answer are not stored and not logged by our server. Only counters are kept: how many requests you made today (to apply the daily limit), the day’s totals, durations, token counts, which provider and model answered, and error categories. The time you agreed to the shared AI is stored on your account.
- The AI provider processes the request under its own terms. Our server never sends it your e-mail address or account identifiers.
- Your own key always wins: if you add a key of your own, your code goes straight from your browser to your provider and never through our server, and the shared AI is not used for you. The owner’s key is never visible to you or to the extension.
- The owner can switch the shared AI off, set limits, or turn it off for a single account.
3Accounts and cloud sync (optional)
The settings page asks you to choose: use the extension without an account (nothing ever leaves your browser) or with an account. It keeps asking on each page until you are signed in, unless you tick “Don’t ask me again”. You can change your mind at any time on the Account page.
| Stored on our server — only with an account | Why |
|---|---|
| Your email address and, if you give one, a display name | To sign you in, and to send you a 6-digit code that proves the address is yours, and password-reset codes. Nothing is synced until you have entered the code. |
| Short-lived confirmation and reset codes, stored only as hashes, with when they were issued and how many wrong attempts were made | To check the code you type, to limit guessing and to stop repeated e-mails. They expire after 15 minutes and work once. |
| A salted, deliberately slow hash of your password (never the password itself) | To check it when you sign in. |
| Usage numbers (only with an account, switchable off under Account → Your choices): seconds the settings site was in use per day and at which hour of the day, how often each feature was used, which programming languages were analysed, how the extension itself performed (how many analyses worked or failed, how long they took, which AI provider was used, the kind of error such as “rate limited”, how long Playground runs took), the extension version, and a “still here” signal while the settings site is open | To see which parts of the extension are used, whether it works well, who is using it right now, and where to improve it. Numbers only: never your code, problem names, links, error messages or anything you type. |
| Shared-AI usage (only if you use the shared AI): the time you agreed, a count of requests per day, and the day’s totals, durations and error categories | To apply the daily limit and protect the owner’s budget, to see whether the shared AI works, and to show you how many requests are left. Never your code or the answers. |
| Contact messages you send through Contact us (works with or without an account): the topic, subject and message, your e-mail address (the address of your confirmed account when you are signed in, otherwise the one you type), an optional name, the technical details if you leave “Include technical details” on (extension version, browser and operating-system name, language, whether you are signed in yes or no, and whether AI runs on your own key, the shared AI or offline — never your code, keys, tokens, history or the debug log), a salted hash of your IP address (never the address itself) to limit abuse, and our replies | To answer you. Nothing else: your e-mail address is used only to reply, and one acknowledgement e-mail with the reference is sent. Messages are kept for 2 years after the last activity and then deleted; they are deleted with your account; and on request earlier (see Your controls). Signed-in users with a confirmed e-mail can read their conversations under Contact us → Your messages; replies also arrive in the messages bell. |
| Feedback you choose to send (category, optional star rating, your message, the extension version) and our replies | To read it, act on it and answer you. It is tied to your account so we can reply. |
| Messages we send you, and whether you agreed to news by e-mail (off unless you turn it on) | To show announcements in the extension’s message bell and to respect your choice. News e-mails always contain an unsubscribe link. |
| Your settings, the problems you ticked, the patterns you completed and your analysis history (problem, language, complexity) | So they are backed up and come back on any device after you sign in. |
| Your sign-in sessions: a hashed refresh token with its creation, last-use and expiry time, and a short device name such as “Chrome on Windows” | To keep you signed in, to show you where you are signed in (Account → Signed-in devices) so you can sign a device out, and to end sessions when you sign out or change your password. |
- Never uploaded to your account or synced: your code, your AI provider API keys, a custom server address, your saved LeetCode connection and examples, and whether the daily reminder is on. (Your code is sent to our server only for a single analysis you ask for with the shared AI, as described in section 2, and is not stored.)
- This device keeps its own copy and works offline. The server is contacted only after you sign in, a few seconds after you change something and when the settings page opens; if it cannot be reached, nothing is lost and the changes are sent later.
- Download or delete: Account → Download my data gives you everything we hold. Account → Delete my account removes your account and all of it from our server (you confirm with your password). Backups of the database can keep deleted data for up to 35 days before they expire.
- Data is stored in Amazon Web Services in [ADD THE AWS REGION YOU DEPLOY TO], encrypted at rest and in transit (HTTPS). Passwords are never logged or stored; tokens are stored only as hashes.
- We use this data to provide sync and sign-in, to understand overall use of the extension (usage numbers, which you can switch off), to answer your feedback and, only if you agreed, to send news by e-mail. We do not use it for advertising and we never sell or share it. The person who runs the service can see account e-mail addresses, whether an account is blocked, and the numbers above, to run and support the service.
4Running code in the Playground
The Playground can run Python, JavaScript and TypeScript. This happens entirely inside your browser: Python runs on an interpreter (Pyodide) that is bundled inside the extension, and JavaScript runs in an isolated sandbox page that cannot access the extension or your accounts. Your code is never uploaded in order to be run, the interpreter downloads nothing, and program input and output are not stored.
The Playground can hold several files so you can split code into pieces and import one from another. These files exist only in the open settings page: they are kept in memory, never written to extension storage, never uploaded, and discarded when you close the tab. If you choose Open file, the extension reads only the files you pick in the browser's file dialog, and only to show them in the editor. Download saves the open file through your browser's normal download, and nothing else leaves the page.
The Playground's Toolkit (test cases, the complexity calculator, the visualizer, algorithm templates and developer tools such as the JSON formatter, regex tester, Base64 and hash tools) also works entirely in your browser. What you type into it is kept in memory only while the page is open: it is not stored, not uploaded and not sent to any AI provider. Test cases run your code in the same local engine as the Run button. The one exception is the API explorer in the Dev tools: it sends a request only when you press Send, straight to the address you chose.
5What we never do
- We never receive your AI API keys. We receive your code only when you use the free shared AI (signed in, after you agreed), for that single analysis, and we do not store or log it. The only server we operate stores an account, settings, progress and history and handles shared-AI requests; nothing at all is sent to it unless you create an account and sign in.
- We do not use third-party analytics, cookies, fingerprinting or advertising. Without an account there is no telemetry at all; with an account only the usage numbers described in section 3 are sent, and you can switch them off.
- We do not sell or transfer user data to third parties — apart from sending your own request to the AI provider you selected, or, with the shared AI, to the AI provider the owner selected, as described above.
- We do not use or transfer user data for purposes unrelated to the extension's single purpose, or to determine creditworthiness or for lending.
- We do not load or run remote code. All code ships inside the extension package.
- We do not read your browsing history, other tabs, or any site other than LeetCode problem pages.
6Permissions, explained
| Permission | What it is used for |
|---|---|
storage | Saving your settings, keys and history on your device. |
Access to leetcode.com/* (a small helper script, active only after you press Connect LeetCode on the road map or Solve here on a problem) | Asking LeetCode, from your own page, whether the road map's practice problems are accepted for you, and for the public examples of a problem you chose to solve here. It does nothing until you ask. |
Access to leetcode.com/problems/* | Reading the code in the editor and showing the analysis on the problem page. |
| AI provider hosts | generativelanguage.googleapis.com, api.anthropic.com, api.openai.com, openrouter.ai, api.groq.com, api.deepseek.com, api.mistral.ai — contacted only for the provider you selected, and only if you added a key. |
| Requests to our account server (only with an account) | Signing in, backing up and restoring your settings, progress and history, and, if you allow it and have no key of your own, the free shared AI (your code for one analysis), all over HTTPS. Nothing is sent before you sign in, except a message you choose to send through Contact us, which works without an account. |
Optional notifications and alarms | Only if you turn on the daily practice reminder: Chrome asks once, and the permissions are handed back when you turn it off. |
| Optional access to one address you type | For a custom or local server, or an address you call from the API explorer when its server does not allow browsers. Never requested at install; Chrome asks you each time. |
| Sandboxed page and WebAssembly | Running your own code locally in the Playground (section 3). |
7Your controls
Everything is in the extension's settings page.
Without an account we keep no copy of anything, so there is nothing for us to delete on request — removing it from your browser removes it everywhere. With an account, Account → Download my data and Account → Delete my account do the same for what is stored on our server.
8Children, changes and security
Children. This is a developer tool and is not directed at children under 13.
Security. Keys are sent over HTTPS to the provider's own API host and are never placed in URLs. Output from AI models is treated as untrusted and rendered as plain text. User code runs in an isolated sandbox. Account passwords are hashed with scrypt, sessions use short-lived access tokens and single-use refresh tokens that are stored only as hashes, and every request to the account server uses HTTPS.
Changes. If this policy changes, the new version will be published at this address with a new “Last updated” date.
9Contact
Questions about this policy, or a request about your data (a copy of it, or deleting it): use Contact us in the extension’s settings (menu “Account & help”), topic “Privacy or data request”, or write to [skashadulrahaman7@gmail.com].