we count showing up, not what you say.

The extension watches a fixed list of known AI tool domains. While a tab on one of those domains is open, it records:

• Domains you visit among tracked AI tools (chatgpt.com, claude.ai, …)
• Active vs idle minutes per tab
• Number of visits per tool
• Sync timestamps, used for streak math

Browsing anywhere outside that list is never observed or recorded. Collected activity is synced to your Cribble account and attributed to the browser it came from.

• Your prompts. Ever.
• The model's responses
• Your chat history or files
• Keystrokes, clipboard contents, or screen captures

The extension does not read, store, or transmit page content from any site, including the AI tools it tracks. It logs the session, never the conversation.

Signing in to cribble.dev uses OAuth through GitHub or X. We never see your password. Your account stores:

• Your OAuth identity: username, display name, and avatar from GitHub or X
• Profile details you choose to add (role, goals, preferred tools)
• Usage stats derived from extension data: scores, streaks, and ranks
• Records linking your browser extension to your account
• If you submit a sponsor ad: the ad content you submit and the billing email you provide for it
• Your browser's timezone and a two-letter country code, used as coarse context for aggregate trends
• If you enable Cribble Agent: machine name, IANA timezone, coding-agent/model identifiers, event timestamps, token counts, and estimated cost (never prompts, responses, files, or message content)

The timezone is reported by your browser. The country code is derived from request metadata at the moment the extension syncs — the IP address it comes from is never stored.

cribble.dev itself keeps two small counts, separate from the extension and your account:

• Pageviews, via Vercel Analytics — no cookies, no personal identifiers
• Public traffic stats, via GoatCounter — cookie-free pageviews, referrers, and countries anyone can open from the leaderboard ticker
• How many people are on the site right now, and how many in the last 12 hours, shown on the leaderboard ticker

GoatCounter never stores IP addresses or cookies. The live ticker hashes a request fingerprint and stores only that hash — never the IP, never a cookie, never a page path. Hashes older than 12 hours are deleted. None of this is tied to accounts, used to target ads, or sold.

Usage data exists first to compute your scores, streaks, and leaderboard positions. Leaderboards and profiles are visible to other Cribble users, so your username, avatar, and scores are public within the app.

We may also publish aggregated, anonymized usage trends — for example, total active minutes per AI tool across all users. Aggregates are computed over minimum cohort sizes so they can never identify an individual. Because a true aggregate contains no individual data, aggregates computed before you delete your account persist after it. If you would rather not be counted at all, you can opt out of aggregate insights in settings.

We do not sell your data, and we do not share it with third parties, except for the infrastructure providers (hosting and database services) that process it on our behalf to run Cribble. Cribble does show sponsor cards — clearly marked paid placements. They are never targeted using your personal data; everyone sees the same cards.

If Cribble is ever acquired or merged into another company, your data transfers with it under the same commitments in this policy.

Cribble Agent token facts stay private unless you explicitly join the Burn Board. The public board receives only your public profile and aggregated totals and breakdowns; it never exposes event rows, client UUIDs, machine names, or API-key details.

Your data is retained while your account is active. You can delete your account at any time from the in-app settings; this permanently removes your usage events, daily metrics, scores, linked devices, notifications, and sessions.

One carve-out: anonymized aggregates already computed under Section 5 persist after deletion. They hold totals across many users, no individual rows, and nothing that can be traced back to you.

Uninstalling the extension stops all collection immediately — nothing is gathered without it.

Questions about this policy or your data? Reach us at hello@cribble.dev.

If this policy changes in a way that affects what we collect or how we use it, we will update this page and revise the date at the top.