ShroomPen Privacy Policy

Effective date: July 29, 2026

This Privacy Policy explains how ShroomPen handles information when you use the ShroomPen Chrome/Chromium browser extension or visit the public ShroomPen website at shroompen.mycelsystem.com.

ShroomPen is operated by Ivan Balshalapau. For privacy questions or requests, contact bolvax@mycelsystem.com.

What ShroomPen Does

ShroomPen is a privacy-first browser writing assistant. It helps users draft, refine, copy, insert, or replace text in the active page using context that the user explicitly chooses, such as current page text, selected text, editable field text, selected browser tabs, and recent session conversation context.

Users can also create persistent local Workspaces containing instructions, notes, imported text or Markdown, and explicitly saved browser-tab snapshots. ShroomPen has no required ShroomPen account, ShroomPen-hosted model, or ShroomPen generation backend.

Browser Access, Activation, and Permissions

You can open ShroomPen from its Chrome toolbar action, keyboard shortcut, or page context menu. The packaged extension content script runs on supported HTTP and HTTPS pages and eligible embedded frames so it can provide the overlay, Page Field Input Helper, focused-field handling, and explicit context and insertion features. It does not run on Chrome-restricted pages or file URLs.

A toolbar click messages that existing content script; it does not inject new code or request broader page access. If the page is unsupported, restricted, disabled in ShroomPen, or unavailable under Chrome's site-access settings, ShroomPen stays closed and the toolbar action shows a ! badge with an explanatory tooltip.

The extension uses Chrome permissions for its context-menu command, user-initiated OpenRouter sign-in, local and session storage, and user-selected tab context. It does not request activeTab. OpenRouter access is declared for OpenRouter itself. For another provider, ShroomPen explains and requests only the exact configured provider origin at runtime; Chrome asks you to confirm, and declining prevents ShroomPen from contacting that origin. Remote custom providers must use HTTPS, while HTTP is limited to loopback local-model addresses.

Running the content script makes browser-side features available, but ShroomPen sends page, field, selected-text, tab, or Workspace context to an AI provider only when you initiate a writing request with that context enabled.

Information ShroomPen Handles

ShroomPen may handle these categories of information:

• Authentication information: API keys, provider credentials, provider endpoint settings, and related BYOK configuration entered by the user.
• Personal communications: text the user chooses to draft, rewrite, reply to, summarize, copy, insert, or replace in communication surfaces such as email, chat, social websites, support tools, forms, or editors.
• Website content: visible page text, selected text, editable field text, links, page titles, and selected browser-tab content that the user explicitly includes as writing context.
• Browsing activity used for user-facing features: the titles and URLs of tabs shown in the explicit tab picker, URLs and titles of saved tab snapshots, disabled-domain patterns, and per-site Workspace defaults. ShroomPen does not collect a passive browsing-history feed.
• User-provided and generated content: prompts, session notes, Workspace instructions and notes, imported .txt or .md content, provider responses, and user-edited result drafts.
• Support communications: if you contact us by email, we may receive your email address and the content of your message so we can respond.
• Product Landing analytics: aggregate page-view information such as page path, filtered query parameters, referrer, approximate location, browser, operating system, and device type, as described below.

User-selected content can contain identifiers or other personal information. The browser extension does not create a ShroomPen identity profile, collect precise location, collect extension-usage analytics, or send a passive browsing-history feed to ShroomPen. It is designed to exclude sensitive fields such as passwords, one-time passcodes, payment fields, card fields, account-number fields, and other secret-like inputs from writing context.

How Information Is Used

The browser extension handles prompts, context, credentials, settings, and provider results only to provide its single purpose: helping the user write, revise, copy, insert, or replace text in the browser. Product Landing page-view information is handled separately for the website purposes described below.

When you request a generation, ShroomPen sends your prompt, enabled context, active Workspace instructions, and any included prior conversation turns directly from the extension to the AI provider endpoint you configured, such as OpenRouter, OpenAI, Gemini, Anthropic, an OpenAI-compatible provider, or a loopback local-model endpoint. Connection tests send the provider credential, selected model, and a small fixed test prompt directly to that provider; model discovery may also send the credential to the provider. ShroomPen does not operate a hosted model or generation backend.

Provider responses are treated as text output for you to review, edit, copy, or explicitly insert. A response or edited draft is sent back to the configured provider only when you include it in a follow-up or invoke an explicit result transformation. Provider responses are not executed as code.

Authenticated Google Docs Text Export

When you invoke Current Page reading on a Google Docs document, or explicitly capture or refresh that document as a selected browser-tab source, ShroomPen first requests the document's plain-text export from docs.google.com. The request uses your existing Google sign-in session, so Chrome may attach Google authentication cookies. ShroomPen does not read, copy, or store the Google password or cookie values.

If the export is unavailable, ShroomPen falls back to accessible document text or text already present in the page model. Extracted text is clipped to the normal page-context limit, stays session-only unless you explicitly save the selected tab as a Workspace snapshot, and is sent to the configured AI provider only when that source is enabled for your writing request.

Product Landing Website Analytics

The public Product Landing at shroompen.mycelsystem.com uses Vercel Web Analytics to measure aggregate visits. The browser extension, the install-time welcome page, and this privacy page do not load the Vercel Web Analytics component.

Vercel Web Analytics automatically records page views. Vercel states that an analytics data point may include the event timestamp, page URL or path, filtered query parameters, referrer, approximate city or country derived from the request, device type, operating system, browser, and analytics script version. Vercel processes request information to create an anonymized visitor hash that resets daily and does not use cookies for Web Analytics.

ShroomPen uses these aggregate reports only to understand Product Landing traffic and improve the public website. ShroomPen does not configure custom analytics events and does not send extension prompts, provider credentials, selected context, extension settings, or generated results to website analytics.

Vercel processes the website analytics data as ShroomPen's hosting and analytics provider. Vercel states that its daily visitor identifier is discarded after 24 hours; aggregate reporting availability follows the Vercel account plan. See Vercel's Web Analytics privacy documentation and Privacy Notice.

Local Storage and Retention

ShroomPen stores provider settings and API keys, disabled domains, the custom overlay shortcut, Workspace metadata, per-site Workspace defaults, and explicitly saved Workspace Sources in Chrome extension local storage for your browser profile. Persistent Workspace Sources include notes, imported text or Markdown, and saved tab snapshots with their titles, URLs, captured text, capture or import timestamps, content hashes, and clipping metadata. Saved page text is limited to 12,000 characters. Local records remain until you change or remove them, use Clear Local Data, uninstall the extension, or Chrome removes the extension storage.

Current Page, Current Field, and Selected text remain session-only working context and are not saved as Workspace Sources. Selected-tab text and session notes also start session-only. When you explicitly click Save context to Workspace, the selected tabs become persistent page snapshots and each nonblank session note becomes a persistent Workspace note.

ShroomPen stores up to 40 window-scoped conversations in Chrome session storage. Recents can include prompts and original or edited generated result text. A Recents record does not copy the raw page, field, selected-text, tab, note, or Workspace context attached to that request. Chrome documents that session storage is cleared when the extension is disabled, reloaded, or updated, and when the browser restarts.

Temporary OpenRouter PKCE state contains a random state value, code verifier, callback URL, and creation timestamp in Chrome session storage while the user completes sign-in. It is removed on completion, cancellation, or callback error. The returned OpenRouter API key is then stored in extension local storage.

The browser extension does not maintain a cloud account database, cloud conversation history, extension analytics profile, advertising profile, ShroomPen-hosted model, or ShroomPen generation backend. Aggregate Product Landing page views are handled separately as described above.

In-Product Disclosure and Consent

Before the browser extension handles any of your data, ShroomPen itself shows a disclosure describing what it reads, where that data goes, what is stored on your device, and which transports it uses. You must tick the acknowledgement and choose Enable ShroomPen before ShroomPen reads a page, a field, a selection, or another tab, and before it contacts an AI provider.

Until you do, the extension stays inert: the overlay shows only the disclosure, the in-field helper does not attach to any field, and the extension's background service worker refuses generation, provider tests, provider saves, model discovery, tab enumeration, tab-context reads, and Workspace writes. Choosing Not now closes the disclosure and records nothing.

The only thing stored when you agree is the disclosure version and the acceptance time. If the disclosure changes materially, ShroomPen asks again before doing anything further. You can withdraw at any time with Settings, Clear local data, which returns the extension to its pre-consent state.

Clear Local Data Boundary

Clear Local Data removes the ten local keys listed above. This deletes local provider configurations and credential copies, Workspaces and Workspace Sources, site defaults, disabled domains, custom shortcut, local privacy or legacy settings, and your recorded data consent.

Clear Local Data does not clear window Recents, temporary OpenRouter PKCE state, or Current Page, Current Field, Selected text, selected-tab working context, and session notes already held by the current content script. It does not revoke provider-issued keys or Chrome optional-host grants, sign out of Google or a provider, delete provider-side request/history records, delete Workspace export files or original imported files, clear browser cookies/browsing data, or delete Product Landing analytics records.

Install-Time Welcome Page

When you first install ShroomPen, the extension opens the ShroomPen welcome page (shroompen.mycelsystem.com/welcome.html) once in a new browser tab so you can set up and try the extension. This happens only on a fresh install, never on extension or browser updates.

Opening the welcome page is a plain browser navigation. The extension does not add an extension identifier, settings, or page content to the welcome URL, and the welcome page itself does not load Vercel Web Analytics or other tracking code.

Third-Party AI Providers

If you configure an AI provider, connection-test data, model-discovery requests, generation prompts, enabled context, included prior results, and applicable credentials are sent directly to that provider for the action you requested. The provider may process and retain that information under its own privacy policy and terms.

You control which provider endpoint is used. Remote provider endpoints must use HTTPS. HTTP is allowed only for localhost or loopback local-model endpoints — localhost and its subdomains, 127.0.0.1, and the IPv6 loopback address ::1 — whose traffic never leaves your device. Every other address, including 0.0.0.0 and private-network addresses, must use HTTPS. ShroomPen enforces this before saving a provider, before every connection test and model lookup, and before every generation request.

Remote Code

The browser extension does not load or execute remotely hosted JavaScript or WebAssembly. All extension code is included in the packaged extension. Network responses from AI providers are treated as text, not executable code.

Chrome Web Store Limited Use

ShroomPen's use and transfer of information received from Google APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Extension data is used only for the disclosed browser-writing purpose and is transferred only as needed for that user-requested functionality.

Selling, Sharing, Advertising, and Profiling

ShroomPen does not sell personal information.

ShroomPen does not share personal information for cross-context behavioral advertising.

Vercel processes public Product Landing page views on ShroomPen's behalf to provide website hosting and aggregate analytics.

ShroomPen does not use personal information for targeted advertising, creditworthiness, lending, or automated decisions that produce legal or similarly significant effects.

ShroomPen does not use sensitive personal information to infer characteristics about users.

Your Controls

You can choose which context sources are included before generating text, save or remove persistent Workspace Sources, delete individual Recents, delete provider credentials, disable ShroomPen on specific domains, export or import Workspaces, and use Clear Local Data with the boundary described above. You can revoke optional host access in Chrome and revoke provider-issued keys through the provider. You can uninstall the extension at any time. Browser privacy controls or content-blocking tools may prevent the Product Landing analytics request.

Because most ShroomPen data is stored locally in your browser profile, we usually cannot access or delete that local data for you. You can delete it from ShroomPen overlay settings, browser extension storage, or by uninstalling the extension.

Privacy Rights

Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or confirmation about how your personal information is handled.

To make a privacy request, email bolvax@mycelsystem.com. Include enough information for us to understand and respond to your request. We may ask for verification if needed.

If we deny your request and your local law provides an appeal right, you may appeal by replying to our decision email with the word "Appeal" and a short explanation.

You may also have the right to complain to your local privacy or data protection authority.

United States and California Notice

For U.S. state privacy laws, including California, ShroomPen may handle the following categories only as described above:

• Identifiers: your email address if you contact support; Vercel may process a visitor IP address to derive coarse location for Product Landing analytics. Vercel Web Analytics separately creates an anonymized daily visitor hash from request information.
• Authentication information: provider API keys or credentials you store locally in the extension.
• Internet or electronic network content: page, field, selected-text, and selected-tab content you explicitly include.
• Internet or electronic network activity: Product Landing page views, page path, filtered query parameters, referrer, approximate location, browser, operating system, and device type processed for aggregate website analytics.
• Personal communications: text you choose to draft, revise, reply to, copy, insert, or replace.

Sources of information are you, your browser, the active web page, selected browser tabs, your configured AI provider response, and Vercel for aggregate Product Landing reports.

Purposes are limited to providing ShroomPen's writing assistant functionality, storing your local settings, responding to support requests, preventing misuse, understanding aggregate Product Landing traffic, operating the public website, and complying with legal obligations.

ShroomPen does not sell or share personal information as those terms are used under California privacy law. ShroomPen does not offer financial incentives for personal information. ShroomPen does not discriminate against users for exercising privacy rights.

EU, UK, and Switzerland

For users in the EU/EEA, UK, or Switzerland, Ivan Balshalapau is the controller for privacy requests related to ShroomPen.

Depending on the context, ShroomPen relies on your request, consent, performance of the extension functionality you asked to use, legitimate interests in operating and securing the extension, and legal obligations where applicable.

If data is sent to a provider outside your region, that transfer happens because you configured or selected that provider for generation. Provider processing is governed by that provider's own terms and privacy policy.

Product Landing analytics may be processed by Vercel in other regions under Vercel's applicable transfer safeguards and privacy terms.

Canada, Quebec, Australia, New Zealand, and South Africa

For users in Canada, Quebec, Australia, New Zealand, and South Africa, you may request access to or correction of personal information handled by us, ask questions, withdraw consent where applicable, or make a complaint by emailing bolvax@mycelsystem.com.

For Quebec privacy requests, Ivan Balshalapau is the person responsible for the protection of personal information.

Children

ShroomPen is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided personal information through a support request, contact bolvax@mycelsystem.com.

Security

ShroomPen is designed to minimize data collection by keeping settings and credentials local to the browser profile where possible. You are responsible for protecting access to your browser profile, device, and provider API keys.

Provider API-key values are stored in Chrome extension local storage. ShroomPen does not add separate application-level encryption to those local records. Remote provider traffic uses HTTPS; HTTP provider traffic is limited to loopback local-model addresses.

No method of storage or transmission is completely secure.

Changes

We may update this Privacy Policy when ShroomPen changes or when legal requirements change. The updated policy will show a new effective date.

Contact