Mentionable · Chrome extension · last updated 2026-09-04
Mentionable privacy policy
This policy covers the Mentionable Chrome extension specifically. The policy for this website is here.
The short version
Mentionable collects nothing. It has no analytics, no telemetry, no error reporting and no user accounts. Your API key, your prompts, your tracked brands and your results are stored only in your own browser (
Contact: team@levelbrook.comchrome.storage.sessionfor the key by default,chrome.storage.localfor everything else) and are never transmitted to Levelbrook Consulting or to any third party. When you run a prompt, your prompt and your API key go directly from your browser to the AI provider you selected and to nobody else. When you activate a Pro licence, your licence key and an anonymous, randomly generated install identifier are sent to our licence server so it can issue an entitlement token; no other data is sent, and no browsing or usage data is ever collected. Page audits are performed entirely inside your browser and the results never leave your machine.
What is stored, and where
| Data | Where it lives | Leaves your machine? |
|---|---|---|
| Your AI provider API key | chrome.storage.session by default — memory only, never written
to disk, cleared when Chrome closes. Optionally
chrome.storage.local if you enable scheduled runs.
Never chrome.storage.sync, so it never reaches a
Google server. |
Only to the AI provider you chose, as the authorisation header on your own request. Never to us. |
| Your prompts, brands, projects and results | chrome.storage.local, on your machine. Exportable and deletable at any
time. |
The prompt text goes to the provider you chose. Nothing goes to us. |
| Page-audit results | Computed and held in your browser. | No. The audit reads the page you are on and that page's own
/llms.txt and /robots.txt. Nothing is uploaded. |
| Pro licence key and install id | Your browser's extension storage. | Yes — only these two values, only to the Levelbrook licence service, only when you activate a licence and once a week to revalidate it. |
Every network request the extension can make
- The page you are auditing — its own
/llms.txtand/robots.txt, same origin, only when you click Audit this page. - The AI provider you selected — browser to provider, directly, carrying your key and your prompt. Provider endpoints are optional permissions, requested one at a time, only when you press Allow.
- The Levelbrook licence service — on activation, and once a week to revalidate a Pro key. It receives the licence key and an anonymous install id and nothing else.
There is no Mentionable server in the request path. There is nowhere for a
key, a prompt or an answer to be logged, because we operate nothing that they pass
through. You can verify this yourself: open chrome://extensions, enable
Developer mode, click service worker, and watch the network tab.
Permissions, and why each one exists
| Permission | Why |
|---|---|
storage | Your projects, prompts, brands, run history and settings, on your own machine. |
activeTab | Reads the page you are on, and only when you click the toolbar icon. Requested instead of a broad host permission specifically so the extension has no standing access to any site. |
scripting | Injects one self-contained metadata extractor into that one tab. It does not modify the page, does not persist, and runs in an isolated world. |
alarms | Fires the optional scheduled tracking run, and the weekly licence revalidation. A service worker cannot hold a timer, so this is the only available mechanism. |
| One licence-service host | Licence activation and weekly revalidation. Nothing else is sent to it. |
| Provider endpoints (optional) | OpenAI, Anthropic, Google and Perplexity. Requested one at a time, for the one provider you chose, at the moment you press Allow. |
There is deliberately no <all_urls>, no tabs, no
webRequest, no cookies and no downloads
permission. Exports use an object URL rather than the downloads API. There is no content
script in the manifest and no web_accessible_resources, so nothing in the
package is reachable from a web page.
Remote code
None. The extension executes no remote code of any kind. All JavaScript is
bundled into the package; there is no eval, no new Function, no
remotely hosted script, no WebAssembly and no CDN. The manifest sets
script-src 'self'; object-src 'none'.
Data-use declarations
- Mentionable does not collect or transmit personally identifiable information.
- Mentionable does not collect or transmit health information.
- Mentionable does not collect or transmit financial or payment information. Purchases are handled by Stripe on Stripe's own pages; the extension never sees a card.
- Mentionable does not collect authentication information, personal communications, location, web history or user activity.
- Data is not sold or transferred to third parties, is not used for any purpose unrelated to the extension's single purpose, and is not used to determine creditworthiness or for lending.
Children
Mentionable is a developer and marketing tool. It is not directed at children and collects nothing from anyone.
Changes, and how to reach us
If this policy ever changes, the change will be described here with its date. Because the extension collects nothing, there is no data to migrate, export or delete on request — everything it holds is already in your own browser, and uninstalling it removes all of it. If you want anything explained or corrected, email team@levelbrook.com and a human will answer.
Levelbrook LLC.