Effective: July 17, 2026
Ampira’s single purpose is to turn Inspiration preset (Ampira), user-selected browser bookmarks, and news sources into a searchable New Tab information dashboard. Ampira has no developer-operated server, account system, advertising, or analytics.
Ampira uses chrome.storage.sync for some non-credential settings. Reading queue, to-dos, and selected weather city stay in extension IndexedDB by default; users can separately opt each category into sync under Settings → Browser → Cross-device content. News, summaries, search caches, full reading state, utility-card mode, and forecast caches always remain local. A user-selected local cover is re-encoded as WebP in the browser to remove original-file metadata and is stored only in chrome.storage.local for the current browser profile; it is not included in browser account sync or settings exports, and replacing, removing, or uninstalling clears the corresponding local copy. API keys and AI service configuration also remain only in the current browser profile's chrome.storage.local; they are not included in browser account sync, and full keys are not shown again after saving.
Reading-queue sync stores at most the 40 most recent titles, URLs, sources, and added times. To-do sync stores text, completion state, and timestamps. Weather-city sync stores the display name, administrative hierarchy, provider marker, and coordinates, but never forecast responses. All three switches default off. Turning one off removes that category’s browser account sync copy while preserving local content. Ampira merges device changes with per-record versions and deletion markers retained for at most 30 days. The developer cannot access this browser account sync content. Clearing generated caches or resetting interface preferences does not remove to-dos; uninstalling removes local copies, while synced copies follow browser account sync state and these user controls.
Public sources (Ampira) are enabled by default to add public news alongside bookmark sources, and users can turn them off in Settings. The first public-source authorization lists all nine exact domains in the current interface-language pack at once: six native sources and three reserved cross-language major-news sources. Reserved sources are not requested, refreshed, or added to the news cache until AI is fully configured. A cross-language item is shown only after its title and summary are successfully localized and validated in the current interface language; raw foreign-language content stays hidden when AI is off, quota is exhausted, or generation fails. If an allowed page declares a Feed on another domain, Ampira records and displays that pending domain but does not connect until the user separately allows it.
The inspiration source is a one-at-a-time choice between Inspiration preset (Ampira) and the user’s existing bookmark folder. Switching never creates, changes, or removes browser bookmarks and preserves the selected personal folder. The preset contains 48 public HTTPS links and 24 original covers packaged with the extension. Preset covers make no remote image requests, and preset links do not automatically enter website-origin permissions. When the user opens in-app reading, Ampira first tries the access publicly allowed by the site’s CORS policy; only if the site blocks that read does Ampira offer exact-domain access and retry. AI analysis still requests a required exact origin only after an explicit user action.
For remote images, Ampira reads inert public page metadata only after the user allows the exact site domain. If an authorized Feed item has no usable image, Ampira may make a limited read of image metadata from the first 1 MiB of the strictly same-origin article page; it does not contact another article origin or execute page scripts. News cards try Feed and original-page image candidates. In personal-bookmark mode, inspiration cards try up to three original-page candidates and start preloading all three reshuffle batches before first render. Web image search uses Brave only when a news or personal inspiration card has no usable original image or every original fails to load, and only after the user has enabled and configured it. It is not used for preset covers or Reader images.
Without user action, Ampira does not send bookmarks, reading state, or search questions to the developer or a third party. When the user opens in-app reading, Ampira first connects directly to the public website with an ordinary CORS request that omits credentials and referrer information. If the browser blocks that read, Ampira may make one credential-free HEAD request that reads no content to distinguish an unreachable site from one that needs access. A successful public read does not request website access or enter the permission-bound Reader cache. When a dashboard card or the reader displays a remote image, the browser requests it directly from the image host. Even when no referring-page information is sent, that host receives ordinary network information required for the request, such as the IP address and browser information. Ampira does not proxy these requests.
When the user explicitly enables AI, submitted questions, article titles, summaries, selected text, and an article URL needed for context are sent to the provider configured by that user. If the initial public-source authorization already includes cross-language sources, their Feed titles, summaries, and article URLs are sent automatically to that provider once AI is fully configured; this is required before those items can enter the Feed, daily brief, or search. Depending on the feature path and extension version, the article URL may be the URL stored by the source or a normalized or minimized form with unnecessary information removed. A URL may still contain path or query information and should be treated as transmitted data. The AI API key is sent directly with the request to the configured provider solely to authenticate that request; it is not sent to the Ampira developer.
When Brave Image Search is enabled, generated image queries and the corresponding API key are sent directly to the Brave Search API, where the key authenticates the request. These third-party transfers use HTTPS. HTTP is allowed only for a user-configured localhost service.
After the user explicitly enables browser search in Settings → Browser, text submitted in the top search field goes through the browser's built-in Search API directly to the user's current default search provider, and the result replaces the requesting Ampira tab. Ampira does not store the query or send it to the developer. Ampira content search in the navigation remains unchanged.
Only after the user submits a city in the weather card does Ampira request access to Open-Meteo’s Geocoding API and Weather Forecast API origins. Queries matching Chinese county-level-or-above administrative places are resolved locally from a bundled GeoNames-derived index and are not transmitted for search; other city queries are sent directly to Open-Meteo’s Geocoding API. After the user explicitly selects a matching city, its latitude and longitude are sent directly to the forecast API. Ampira does not use browser geolocation, and the developer cannot access these queries, coordinates, or weather results. Chinese location candidates attribute GeoNames under CC BY 4.0, and weather data is attributed under Open-Meteo’s terms and license.
activeTab temporarily reads only the current tab’s title and URL after the user clicks the Ampira toolbar icon, so the page can be added to Read later. Access ends when the tab navigates or closes and does not provide continuous tab or browsing-history access. The reading queue enters browser account sync only if the user separately enables its default-off switch. bookmarks provides read-only bookmark organization; Ampira does not call bookmark write APIs. storage stores local settings and caches plus content the user chooses to place in browser account sync. alarms checks due sources every 15 minutes. The optional search permission is requested only after the user enables browser search and uses the browser's built-in API with the user's default search provider; it can be removed from the same setting and is not synchronized or exported. The optional favicon permission is requested only after a user action and uses the browser’s built-in API to display icons for bookmark and page URLs already shown by Ampira; it does not grant browsing-history or continuous tab access, and those URLs are not sent to a third-party icon service. When Microsoft Edge does not expose this service, Ampira does not request the permission and uses its packaged icon instead. Website-origin access is likewise optional and requested for exact domains only after a user gesture. Weather requests only the exact https://geocoding-api.open-meteo.com/* and https://api.open-meteo.com/* origins when the user submits a city. Each can be revoked in Settings → Browser; revocation stops requests and removes the weather cache while preserving the selected city.
Ampira does not sell, share, or use data for advertising. News cache is retained for at most 30 days and limited to about 25 MB. Weather data is reused for 30 minutes and, if refresh fails, may fall back only to data no more than 6 hours old. Users can clear caches at any time or use Factory reset under Settings → About → Import & export to clear local Ampira data, optional permissions, and Ampira settings plus opted-in content in browser account sync. Synced deletions propagate to other devices on the same account but do not remotely erase local-only data unique to those devices. Uninstalling removes extension-local data; browser account sync data continues to follow the browser’s synchronization rules.
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Ampira uses that data only for its disclosed single purpose and user-facing features; it does not use it for personalized advertising, credit assessment, or data resale. Ampira has no backend through which its developer or personnel can read that data.
Use the project support channel for privacy or support questions. Never include API keys, private bookmarks, or personal browsing information.