Brizka Privacy Policy

Brizka is a Chrome extension that uses AI to summarize YouTube videos. It is free to use, and Brizka Pro is an optional paid plan with higher limits. This policy covers the Brizka extension, the server it talks to (api.brizka.com) and this website (brizka.com), including Brizka Pro and its payments. It explains what data they use and why, who else receives it, how long it is kept, and what you can do about it.

Who we are

Brizka is provided by Karma Kai Design Studio, Unipessoal Lda., Incubadora da Universidade do Algarve, Campus de Gambelas, Pavilhão B1, 8005-226 Faro, Portugal, VAT number PT515218510 ("we", "us"). We are the controller of your personal data. That means we decide how it is used.

• For privacy questions and requests, write to privacy@brizka.com.
• For help with Brizka, write to support@brizka.com.

We have not appointed a Data Protection Officer, because the law doesn't require one for what we do. Mail to privacy@brizka.com reaches the people responsible for privacy at Brizka.

What Brizka does not collect

• Your browsing history. Brizka works only on YouTube (www.youtube.com). It can't read other websites.
• Your YouTube watch history. We receive a video only when you ask for its summary. When Brizka checks how many summaries you have left, it doesn't tell us which video you're watching.
• Your YouTube account, cookies or passwords.
• The title or channel of the videos you summarize. Brizka doesn't send them to us. It keeps the titles of your recent summaries on your device only (see Data stored on your device).
• Payment details. If you buy Brizka Pro, you enter your payment details in Paddle's checkout, not in Brizka, and they go to Paddle. We never see your full card number or security code, and we don't store any payment details (see Brizka Pro and payments).
• Data for ads or tracking. Brizka has no ads, no analytics, no tracking cookies and no error-reporting tools. We don't sell personal data or use it for advertising.

What we collect, and why

When you install Brizka

A random install ID. When you install Brizka, it creates a random code and saves it on your device. The code contains nothing about you. Brizka sends it to our server in only two cases: when you ask for a summary, and when it checks how many summaries you have left. It sends the ID even when you're signed in, but then we count your summaries under your account and don't store the install ID. Without an account, we use it to count your 2 free summaries. It can single out one installation, so we treat it as personal data. Reinstalling Brizka creates a new ID.

Technical settings from our server. Brizka downloads technical settings from our server, such as where to place its card on a YouTube page. It does this when you install or update it, when Chrome starts, and when you use it if its copy is more than 6 hours old. This request carries no ID, only the version of the extension. Like every request on the internet, it also carries your IP address and browser information. Our server doesn't store or log anything about it. Cloudflare handles it like any other request (see Who receives your data). Brizka needs these settings to show its card, so it downloads them even before you agree to anything.

Before your first summary

Brizka explains what it sends and asks you to agree. It does this on the welcome page after you install it, or before your first summary. It then saves a note on your device with the date and the version of the text you agreed to. That note is never sent to us. If that text changes, Brizka shows it again and asks you to agree again. Until you agree or sign in, Brizka contacts our server only to download its technical settings.

When you ask for a summary

1. Brizka reads the captions in your YouTube tab. These requests go from your browser to YouTube, like the YouTube player's own requests. Like the YouTube page itself, some of them include your YouTube cookies, but they go only to YouTube. To get the captions, Brizka may switch captions on for a moment or briefly open YouTube's transcript panel. We never receive your YouTube cookies or account details. YouTube handles these requests under Google's own privacy policy.
2. Brizka sends a request to our server (api.brizka.com). The request contains:
   • the video's ID and its length;
   • the captions, with their timestamps;
   • the language of the captions, and how Brizka read them;
   • the summary language and length you chose;
   • your install ID and the version of the extension;
   • if you're signed in, a sign-in token that shows which account is asking. The token also contains your email address, but our server doesn't use it for summaries.
   Like every request on the internet, it also carries your IP address and basic information about your browser (the "User-Agent").
3. Our server applies the rate limit and checks the video's length. Then it looks for a shared summary of the same video, made from the same captions with the same settings (see Shared summaries). If there is one, you get it straight away and it doesn't count toward your limit. If there isn't, our server checks your free limit and asks OpenAI to write the summary.
4. You get the summary. Brizka saves it on your device. A new summary is also kept in our shared summaries.

Checking how many summaries you have left. Once you have agreed or signed in, Brizka asks our server how many summaries you have left. It asks when its card appears on a YouTube video page, or when you open its side panel or toolbar popup, if it last checked more than a minute ago. If a Brizka page is open at the daily reset (midnight UTC), it checks again just after. This request carries your install ID, plus your sign-in token if you're signed in. It doesn't say which video you're watching.

Your IP address

Our server uses your IP address only to prevent abuse, in three ways:

• a rate limit of 20 summary requests a minute, and separate limits of 20 a minute for checks of your remaining summaries, for checks of your plan, and for opening Brizka Pro's checkout or Paddle's customer portal;
• without an account, a cap of 6 new summaries per IP address per day. This stops one computer from getting endless free summaries by reinstalling Brizka;
• with a free account, a cap of 30 new summaries per IP address per day, counted across all the free accounts on that connection. Brizka Pro accounts, and accounts we have given their own limits, aren't counted. This stops one person from getting endless free summaries by creating many accounts. It is counted separately from the cap without an account.

Before using your IP address, our server turns it into a code. The code is a hash made from the address, a secret value and the date, so it is different each day. For an IPv4 address, the whole address is used. For an IPv6 address, only the first half is used (the part that identifies the network). The rate limit uses this code as its key, and Cloudflare keeps the rate-limit counters for us. For the two caps, the code is also saved in our daily usage counters, with one count for new summaries without an account and another for free accounts. These counters hold only the code, the day, the number of new summaries and the day they last changed. They don't record the time, or which install or account asked for them. We delete them 7 days after the day they count. Our server never stores or logs your raw IP address. We hold the secret value, though, so the code is pseudonymized rather than anonymous, and we treat it as personal data.

Two of our providers also see your IP address: Cloudflare, which runs our server and this website, and Supabase, when you sign in (see If you create an account and Who receives your data).

Cloudflare also tells our server which country a request comes from, based on its IP address. Our server uses the country only to ask Paddle for Brizka Pro's prices in your country, and doesn't store it (see Brizka Pro and payments).

If you create an account

Your first 2 summaries need no account. After that, a free account gives you 3 new summaries a day, and Brizka Pro, a paid plan, gives you more (see Brizka Pro and payments). The count resets at midnight UTC, and shared summaries stay free. You sign in with your email address and a 6-digit one-time code. There is no password. To sign you in and keep you signed in, Brizka connects directly from your browser to our sign-in service, Supabase.

Supabase stores:

• your email address and account ID;
• when you created and confirmed your account, and when you last signed in;
• a hash of the code you were sent (not the code itself), which stops working once it is used or expires;
• your sign-in sessions, including the IP address and browser information used;
• security logs of sign-in events: the time, the account, the action, the IP address and browser information.

Asking for a code creates your account, even if you never enter the code. If you never enter one, we delete that account 30 days after the last code was sent.

Our server checks your sign-in token and takes your account ID from it, to count your summaries and look up your plan. It uses the email address in the token only when you start a Brizka Pro checkout, to send it to Paddle (see Brizka Pro and payments). It doesn't store your email address or the token.

Your new summaries also count toward the daily cap for free accounts on your IP address (see Your IP address).

If we change your account's limits (for example to give you extra summaries, a different daily limit or Brizka Pro), let it buy Brizka Pro to test it before Pro is on sale to everyone, or block it because of abuse, we record that with your account.

The emails with sign-in codes come from login@brizka.com. Cloudflare sends them for us. It receives your email address and the email itself, which contains the code, but doesn't keep a copy of the email.

Usage records

Our server keeps two kinds of record to apply the summary limits:

• Usage counters. These record how many new summaries an install ID has used in total, how many an account has used each day, and how many new summaries an IP code has received each day, counted once for installs without an account and once for free accounts. Each counter also records when it last changed, or only the day for an IP code.
• Recent-request records. For each new summary (not shared ones), these record which install or account asked for it, and when. If you ask for the same summary again within 15 minutes (after a dropped connection, for example), it isn't counted twice. Each summary belongs to a video, so these records show which videos you asked to summarize. They also include requests that were refused because a limit had been reached. We delete them after 24 hours.

Shared summaries

When Brizka writes a new summary, we keep it. The next person who asks for the same video, with the same captions and settings, gets it straight away, and it doesn't count toward their limit. Brizka labels it "Shared summary, free".

A shared summary is stored with:

• the video ID;
• the summary language and length;
• the AI model;
• a fingerprint of the captions;
• how often it has been reused, and when.

The fingerprint is a hash, not the captions themselves. The shared summary itself contains nothing about you. Only the recent-request records above connect it to your install or account, for 24 hours. Summaries of unlisted or private videos are stored the same way.

Server logs

For each summary request, our server writes one log line. It records:

• the result;
• the type of plan;
• whether the summary was a shared one;
• how the captions were read;
• a rough video length;
• the AI model;
• whether you closed the connection early;
• how long it took.

When our server starts writing a new summary, it also writes a shorter line with only the type of plan and a rough video length. For each message Paddle sends us, it writes a line with only the type of message and what our server did with it. Other log lines record technical errors.

Our server is built so that these logs don't contain your IP address, install ID, account ID, email address, Paddle customer or subscription ID, video ID or captions. We keep them for up to 7 days.

We also keep hourly and daily totals, such as how many summaries were written and how many accounts there are. The hourly totals are counted separately for each type of plan. When very few people use a type of plan, its hourly totals can be about one person. This can be the case for Brizka Pro while few people have it. So we treat the hourly totals as personal data and delete them after 90 days. The daily totals contain no personal data.

When you email us

If you write to privacy@brizka.com or support@brizka.com, we use your email address and your message to reply. Messages pass through Cloudflare, which forwards them to our mailbox at Dominios.pt, in Portugal, without keeping a copy. Cloudflare keeps only a record of each message (sender, recipient, subject and delivery status) for up to 31 days. We keep your messages for 2 years.

This website

This website (brizka.com) is a set of static pages. They set no cookies, run no scripts, use no analytics and load nothing from other websites, with one exception: the checkout page (brizka.com/checkout), which Brizka opens when you buy Brizka Pro.

The checkout page. This page runs Paddle's script (Paddle.js), loaded from Paddle's servers, and a small script of ours that only opens Paddle's checkout and shows whether it was completed or closed. Paddle's checkout then loads from Paddle's servers inside the page, so Paddle receives your IP address and browser information and everything you enter in the checkout. Paddle may set cookies or use similar technologies there, for the payment and to prevent fraud, under its own privacy notice. Our own code on that page still sets no cookies and stores nothing in your browser.

Like every request on the internet, a visit to any page carries your IP address and browser information to Cloudflare, which serves the website for us (see Who receives your data). Our own code doesn't log or store anything about your visit.

Brizka Pro and payments

Brizka Pro is an optional paid plan with higher limits. You need a Brizka account to buy it. Paddle.com is our online reseller and merchant of record: Paddle sells Brizka Pro to you, takes the payment, charges any tax and sends your receipts and invoices. We keep only what we need to give your account Pro.

Checking your plan. When you're signed in, Brizka asks our server which plan your account has, whether it has a Brizka Pro subscription and whether it can buy Pro, so that Brizka can show them. Like the check of your remaining summaries, this request carries your install ID and sign-in token, and doesn't say which video you're watching.

Prices. When your account can buy Pro, our server asks Paddle for Pro's prices in your country, so Brizka can show them in your currency, with tax where your country includes it in prices. It sends Paddle only the two-letter code of the country Cloudflare finds for your connection (such as PT), never your IP address or anything about your account. It keeps each country's prices for up to an hour and doesn't store your country.

Buying Pro. When you choose to buy Pro, our server creates the order with Paddle, and Brizka opens our checkout page, where Paddle's checkout shows it. For this, our server sends Paddle:

• your account's email address, taken from your sign-in token, so that Paddle's checkout and receipts use it. The first time, our server creates a customer record for you at Paddle with this address, and keeps the customer ID Paddle gives it;
• your account ID, inside the order, so that the payment gives Pro to the right account;
• the language Brizka uses, so that Paddle's checkout, emails and customer portal use it;
• the price you chose (monthly or yearly).

You enter your payment details, and anything else the checkout asks for, such as your country or postcode, in Paddle's checkout. They go to Paddle, not to us.

What we keep. Paddle tells our server when your subscription starts, renews, changes or ends, with messages (webhooks) that carry Paddle's signature. With your account, our database keeps:

• the Paddle customer ID linked to your account (not your email address or name);
• your subscription's ID and status (for example active, payment overdue, paused or cancelled);
• its price ID and how often you pay (monthly or yearly);
• when the current period ends, any scheduled change (such as a cancellation at the end of the period) and its date, and when the subscription started and was cancelled;
• until when your account has Pro from the subscription.

We use these records to give your account Pro, to show your subscription in Brizka and to help you with it. We also keep the ID, type and times of each message Paddle sends us about a subscription for 30 days, so that a message delivered twice is applied only once. We don't keep the messages themselves. If Paddle tells us about a subscription that matches no account, we keep its record without an account, so we can match it to the right account, and delete it 90 days after the subscription ends. If Paddle tells us it has refunded a payment in full, or that a bank reversed one, our server asks Paddle to cancel that subscription, sending only its subscription ID.

Managing your subscription. When you choose to manage your subscription in Brizka, our server asks Paddle for a link to Paddle's customer portal, sending your Paddle customer ID and subscription ID. In the portal, Paddle lets you see your payments and invoices, update your payment details and cancel.

What Paddle shows us. As the seller, Paddle shows us the details of each Brizka Pro order in its dashboard, such as your email address, country, what you bought, the amounts and taxes, the payment status and how you paid (for a card, its type and last four digits), and any business details you enter for an invoice. We use them only to help you with your order, refunds and disputes.

What Paddle does on its own. Paddle handles the payment, tax, receipts and invoices, fraud checks, refunds, chargebacks and its customer portal as an independent controller, under its own privacy notice: www.paddle.com/legal/privacy. It decides what it collects for these, such as your payment details, and how long it keeps your orders, for example to meet tax laws. It also emails you about your payments and subscription. For questions about Paddle's use of your data, write to Paddle at privacy@paddle.com.

Data stored on your device

Brizka keeps these items in Chrome's extension storage on your device:

The captions of up to 8 recent videos stay in the YouTube tab's memory while the tab is open, so Brizka can show the transcript without reading it again. They are never saved to storage.

Brizka uses no cookies, analytics or advertising trackers. Everything it stores is needed for Brizka to work. Uninstalling Brizka removes this data from your device.

Our legal bases

The "Agree" step before your first summary makes sure you know what is sent before anything leaves your browser. It is not the legal basis for this processing. You can stop at any time: just stop asking for summaries, or uninstall Brizka. If we ever ask for your consent to something, you can withdraw it at any time, as easily as you gave it.

Who receives your data

We share data only with service providers that process it for us, on our instructions:

• Cloudflare, Inc. runs our server at api.brizka.com, this website, and the network that requests pass through. It sees your IP address and the details of each request. It applies our rate limits and stores our server logs. It sends the emails with sign-in codes, so it receives your email address and the code. It also forwards email sent to privacy@brizka.com and support@brizka.com, without keeping a copy.
• Supabase (Supabase Pte. Ltd.) provides our sign-in service and our database. The database is in Frankfurt, Germany. Supabase receives your email address, IP address and browser information when you sign in. It also keeps technical logs of our server's database requests. These can include your install ID or account ID, which summary was requested and, for Brizka Pro, Paddle customer and subscription IDs.
• OpenAI (OpenAI Ireland Ltd) writes the summaries. It is our only AI provider.
• Dominios.pt (DMNS – DOMINIOS, S.A.) hosts the mailbox where your emails to us arrive and from which we reply. Its servers are in Portugal.

What OpenAI receives. OpenAI receives only the captions with timestamps, the video's length, and instructions (the summary language and length). The captions include whatever is said in the video. OpenAI doesn't receive the video ID, title or channel, or your install ID, account ID, email address or IP address.

Under its terms with us, OpenAI doesn't use this data to train its models. OpenAI keeps API data only in its abuse-monitoring logs, for up to 30 days unless the law requires longer. Shared summaries are delivered without contacting OpenAI.

Others who handle data under their own responsibility:

• Paddle sells Brizka Pro as our online reseller and merchant of record. The company that sells to you is Paddle.com Market Limited, in the United Kingdom, or another Paddle company named in Paddle's privacy notice, depending on where you are (for example Paddle.com Inc. in the United States). Paddle receives what our server sends it and what you enter in its checkout (see Brizka Pro and payments), and uses it under its own privacy notice.
• YouTube (Google) receives the caption requests your browser sends to it.
• Google stores your Brizka settings in your Google account if you use Chrome Sync.
• Public authorities receive data if the law requires us to share it.

We don't sell personal data, and we don't share it for advertising.

International transfers

Our database is in the EU, in Frankfurt. Some providers may process data outside the European Economic Area, including in the United States:

• OpenAI;
• Cloudflare;
• Supabase (a Singapore company with sub-processors in other countries).

We protect these transfers with the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). Where a provider is certified under the EU-US Data Privacy Framework, that also applies (Art. 45 GDPR). To get a copy of these safeguards, write to privacy@brizka.com.

For Brizka Pro, our server sends data to Paddle in the United Kingdom, which the European Commission recognizes as giving adequate protection (Art. 45 GDPR). Paddle may also process data in other countries, including the United States, as its own privacy notice describes.

How long we keep data

We keep data longer only if the law requires it, or if we need it to establish, exercise or defend a legal claim.

Your rights

Under the GDPR, you can ask us to:

• give you a copy of your personal data (access);
• correct it (rectification);
• delete it, including your account (erasure);
• limit how we use it (restriction);
• send it to you or to another service in a machine-readable format (portability).

Your right to object. You can object at any time, on grounds relating to your particular situation, to our use of your data based on legitimate interests. That covers free limits, abuse prevention, logs, hourly totals, shared summaries, Pro price quotes and the records of Paddle's messages. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms (such as preventing abuse), or we need the data for a legal claim.

How to make a request. Email privacy@brizka.com. If you have an account, write from your account's email address. We may send you a one-time code to confirm it's you. Requests are free. We reply within one month. If a request is complex, we may need up to two more months, and we will tell you why.

Deleting your account. Email privacy@brizka.com from your account's email address. Within one month, we delete your account and its usage counters and recent-request records, and we remove your address from Cloudflare's suppression list if it's there. Any copies in backups and logs disappear on the schedule above. Signing out in Brizka only signs you out of that browser. It doesn't delete your account.

Deleting an account with Brizka Pro. If your account has a Brizka Pro subscription that hasn't been cancelled, it must be cancelled before we delete the account, so that Paddle stops charging you. We cancel it in Paddle for you, straight away, and Pro ends then. If you'd rather keep Pro until the end of the period you've paid for, cancel the subscription yourself and ask us to delete your account after that date. Deleting your account deletes our Brizka Pro records with it. Paddle keeps its own records of your orders, for example because tax law requires it, under its own privacy notice. To ask Paddle about them, write to privacy@paddle.com.

Without an account. All we know is a random install ID, which Brizka doesn't show you, so we usually can't tell which data is yours. If you can give us information that lets us find it, we will act on your request. Uninstalling Brizka deletes everything stored on your device. The records we still hold about that install are deleted on the schedule above.

Complaints. You can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD):

• address: Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal;
• phone: +351 213 928 400;
• email: geral@cnpd.pt;
• website: www.cnpd.pt.

You can also complain to the authority in the EU country where you live or work. We'd appreciate the chance to help first, at privacy@brizka.com.

Do you have to give us data?

No law requires you to give us any data. But Brizka needs the video ID and captions to write a summary, and it needs your install ID and IP address to apply the free limits. An email address is needed only for an account, which you need after your first 2 summaries. To buy Brizka Pro, you need an account, and Paddle needs your email address and payment details to sell it to you.

Automated decisions

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Limits and plans are applied automatically: our server works out your plan from your account and from Paddle's messages about your subscription, and applies that plan's limits. All the limits do is cap how many summaries you get and how long a video can be. If your plan looks wrong, write to support@brizka.com and a person will check it. Paddle's checks on payments, such as fraud checks, are Paddle's own and are covered by its privacy notice.

Children

Brizka is not meant for children. You must be at least 13 years old to use it, or older if the law in your country requires it. To buy Brizka Pro, you must be at least 18, or have the permission of a parent or guardian. If you think a child below the age to use Brizka has given us personal data, write to privacy@brizka.com and we will delete it.

Security

• Data travels between Brizka, our server and our providers over encrypted connections (HTTPS). Emails, such as the sign-in codes and the messages you send us, are encrypted in transit whenever the other mail server supports it.
• Only our server and our team's admin tools can access Brizka's database tables, which aren't open to the extension or to the public. The admin tools are protected by Cloudflare Access and show an account's email address only when there is a reason for it: a support request, abuse or a legal requirement. Every such view, and every change to an account, is logged.
• Our server never stores your raw IP address, the captions or any payment details.
• Our server accepts messages about subscriptions only when they carry Paddle's signature, so no one else can change your plan.
• Your sign-in tokens are kept only on your device and by our sign-in service. Our server checks them but doesn't store them.

People who appear in videos

A summary can mention people who appear in a video or are talked about in it. That information comes from the video's captions on YouTube. To have a summary removed from our shared summaries, write to privacy@brizka.com with a link to the video. We will then delete the shared summaries of that video. Removing them doesn't stop Brizka from writing a new summary if someone asks for that video again.

Users in Brazil

If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD) also applies. Our legal bases are performance of a contract (Art. 7, V), which also covers Brizka Pro and its records, and legitimate interests (Art. 7, IX).

Under Art. 18 of the LGPD, you can ask us for:

• confirmation that we process your data;
• access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of data that is unnecessary or excessive, or that is processed unlawfully;
• portability;
• information about who we share your data with;
• where processing is based on consent: deletion of that data, information about the option not to consent, and withdrawal of consent.

You can also object to processing based on legitimate interests.

To use these rights, write to our encarregado (LGPD Art. 41), the contact for data protection under the LGPD. Our encarregado is the company itself, Karma Kai Design Studio, Unipessoal Lda., at privacy@brizka.com. We reply within 15 days. After contacting us, you can also petition the Agência Nacional de Proteção de Dados (ANPD) at www.gov.br/anpd.

Your data is transferred outside Brazil:

• to the European Union, whose level of protection Brazil recognizes as adequate;
• to other countries, including the United States, with the safeguards Art. 33 of the LGPD requires, such as standard contractual clauses, and, for Brizka Pro, to Paddle in the United Kingdom, because it is needed for the contract you ask for (Art. 33, IX).

Changes to this policy

If we change how we use your data, we will update this policy and tell you in the extension before the change takes effect.

On 9 October 2026, we added how Brizka Pro, the paid plan that Paddle will sell as our merchant of record, and the checkout page on this website use your data (see Brizka Pro and payments). Pro isn't on sale yet. Nothing changes for you unless you buy it.

The date at the top shows when this policy was last updated.

Chrome Web Store Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

We use the data Brizka collects only for its single purpose: summarizing the YouTube videos you ask for, within the limits of your plan. We transfer it only:

• to the service providers this policy describes;
• to Paddle, when you buy Brizka Pro, as this policy describes;
• to comply with the law;
• to protect against abuse, fraud or security threats.

We don't use it for advertising. We never use it to judge creditworthiness or for lending.

People at Brizka don't read your data, except:

• with your permission, for example when you ask us for help;
• to investigate security issues or abuse;
• to comply with the law;
• when it is aggregated so that no one can be identified.

If the Brizka business is ever sold or merged, we will transfer your data only with your explicit consent.

Contact

Privacy: privacy@brizka.com
Support: support@brizka.com