Makro Privacy Policy
TechHQ USA, LLC (“we”, “us”, “our”) operates the Makro browser extension (“Makro”, “the Extension”). This Privacy Policy explains what data Makro collects, how it is used, and your rights regarding that data.
Summary
Makro is designed with a local-first, privacy-first architecture:
- Free tier: Your macro data stays on your device. The exception is a pack you choose to submit to the public library: that pack is stored on our servers in readable form and, once a moderator approves it, published for anyone to install. Submitting is available on every tier and needs no account. Section 1.8 covers it in full. Smart Rewrite is optional and clearly disclosed (25 free Makro Credits/month). A weekly anonymous heartbeat carries a small base payload that needs no in-product opt-in, plus two opt-in tiers (basic counts and detailed feature usage). On Firefox the base payload is governed by the browser's own data-collection consent instead, and is not sent unless that is granted. Alongside it, the extension contacts our API for license validation and any cloud feature you use. No personal data is collected. Both tiers can be independently controlled in Settings > Privacy Controls.
- Pro/Premium tiers: Cloud sync transmits only end-to-end encrypted data: synced macros are encrypted before leaving your device and our servers cannot read them. AI features are different: the text an AI request works on reaches our own Worker in readable form. That covers the text you submit for an AI action and, with the semantic suggestions setting turned on (off by default), the title and body of a macro when you save it, to update your search index. A free 30-day trial is available through our payment processor Polar.sh; payment method is collected to prevent trial abuse, no charges occur during the trial period, and you may cancel anytime.
- No behavioral analytics, no ads, no user tracking. We collect minimal, anonymous telemetry: a weekly heartbeat whose small base payload (version, platform, locale, plan tier, build-type flag, and which of the two UI surfaces you use) needs no in-product opt-in on Chrome and Edge, and on Firefox is gated on the browser's own data-collection consent, plus two independent opt-in tiers on top of it, Tier 1 (basic counts) and Tier 2 (feature usage), both disabled by default. This data cannot identify individual users, is never sold or shared, and cannot be correlated with personal information. We do not collect behavioral data, browsing activity, or macro content.
1. Data We Collect
1.1 Data Stored Locally (All Users)
The following data is stored on your device using the browser’s extension storage. It leaves your device only through features described in this policy - cloud sync (end-to-end encrypted), the AI features covered in Sections 1.3 and 4.2, a pack you submit to the public library (Section 1.8, stored and published in readable form), and the opt-in analytics tiers (aggregate totals only, never macro content):
- Macros: Hotwords, titles, body text, tags, keyboard shortcuts, and category structure
- Settings: Theme preferences, editor options, AI provider configuration
- Usage statistics: Per-macro usage counts and timestamps (for the Stats tab)
- Clipboard history: Recent clipboard entries (if you enable this feature). Clipboard data is encrypted and stored locally only. Entries that appear to be passwords are automatically excluded if the “Skip passwords” setting is on. An optional “Auto-clear clipboard” toggle automatically clears entries flagged as sensitive (passwords, API keys) 30 seconds after capture.
- Smart Copy (OCR) data: When you use Smart Copy to extract text from an image, the image is fetched from its source URL and processed locally on your device using tesseract-wasm (WebAssembly). No image data is sent to our servers. The image buffer may be temporarily cached in browser session storage (cleared when you close your browser) to allow retries without re-fetching. The extracted text is also held in session storage for the
[$OCR_RESULT]placeholder. On Chrome, image processing runs in an offscreen document; on Firefox, it runs in the extension’s event page. - Device identifier: A randomly generated UUID used for encryption key derivation. This is not linked to your identity.
- Encryption keys: A device-specific key and a random salt, used to encrypt your local data with AES-256-GCM.
1.2 Anonymous Telemetry (All Users)
Makro sends a weekly anonymous heartbeat to our server. It has three parts: a base payload with no in-product toggle, and two opt-in tiers on top of it that you control.
Base payload
Extension version, browser platform, browser locale, your plan tier, a build-type flag, and which of the two UI surfaces this install uses. No device identifier, no macro content, no usage counts.
On Chrome and Edge there is no separate toggle for this payload; the legal basis is our legitimate interest in counting active installs, and it carries nothing that identifies you. On Firefox it is governed by the browser's own technical-data consent instead: Firefox 140 and later show that choice during install and declining it stops the heartbeat entirely, and on Firefox 128 to 139, which predates that prompt, Makro cannot confirm a choice was ever offered and so does not send it at all. It is also best-effort everywhere: if you are offline it is dropped, never retried.
Tier 1 - Basic Analytics (opt-in during onboarding; can be changed in Settings > Privacy Controls)
| Data | Purpose | Retained |
|---|---|---|
| Extension version | Track adoption of new versions | 1 year, then auto-deleted |
| Browser platform | Understand platform distribution | 1 year, then auto-deleted |
| Browser locale | Prioritize localization efforts | 1 year, then auto-deleted |
| Country (derived from IP by Cloudflare) | Understand geographic distribution | 1 year, then auto-deleted |
| Subscription tier (free, pro, or premium) | Understand tier distribution | 1 year, then auto-deleted |
| Macro count (aggregate total) | Understand usage scale | 1 year, then auto-deleted |
| Expansion count (aggregate total) | Understand feature adoption | 1 year, then auto-deleted |
| Category count (aggregate total) | Understand organizational complexity | 1 year, then auto-deleted |
| Time saved (estimated seconds) | Aggregate productivity metrics | 1 year, then auto-deleted |
| Days since install | Understand retention | 1 year, then auto-deleted |
Build type (isDev flag) | Keep test installs and uninstall pings out of real-user metrics (so they don’t inflate our usage stats) | 1 year, then auto-deleted |
Tier 2 - Detailed Analytics (separate opt-in; disabled by default)
Only sent if you explicitly enable “Detailed usage analytics” in Settings > Privacy Controls. This data helps us understand which features to improve.
| Data | Purpose | Retained |
|---|---|---|
| Browser name (e.g. Chrome, Firefox) | Prioritize browser-specific fixes | 1 year, then auto-deleted |
| AI provider (ollama, lmstudio, or cloud) | Understand AI feature usage | 1 year, then auto-deleted |
| Theme (dark or light) | Prioritize theme improvements | 1 year, then auto-deleted |
| Import source (last format used) | Prioritize importer maintenance | 1 year, then auto-deleted |
| Features used (list of enabled toggles) | Understand feature adoption | 1 year, then auto-deleted |
This heartbeat is:
- Weekly - sent once every 7 days while the extension is active (rate-limited to 1 per device per day)
- Anonymous - no device identifier is sent at all unless you turn on basic analytics in Settings. When you do, the device ID is hashed (SHA-256, one-way) before transmission, so we still cannot link heartbeats to your identity
- IP not stored - your IP address is used for rate limiting (discarded within 24 hours) but never saved to our database
- Auto-deleted - telemetry records are automatically purged after 1 year
- Best-effort - if the request fails (offline, network error), it is silently dropped with no retry
- No personal data - no macro content, browsing activity, or personal information is included. Aggregate counts and feature flags cannot be linked to your identity
- Two independent toggles - you can enable or disable Tier 1 and Tier 2 independently via Settings > Privacy Controls
Why we collect this data: These aggregate metrics help us understand how many people use Makro, which platforms to prioritize, and whether new features are adopted. The data is purely statistical - it contains no names, no email addresses, no browsing history, no macro content, and no information that could identify, profile, or track any individual user. We never sell, share, or provide this data to third parties. It exists solely to help us build a better product.
1.3 Data Transmitted to Our Servers (Paid Subscriptions)
When you activate a paid subscription, the following data may be transmitted. Some server transmissions are not limited to paid subscriptions: cloud AI actions metered against Makro Credits run on the free tier as well, and public pack submissions (Section 1.8) are open to every tier and to people with no account at all.
| Data | When | Purpose |
|---|---|---|
| License key hash (SHA-256; raw key never leaves your device) | Every API request | Subscription validation and tier enforcement |
| Encrypted macros | When you click “Sync to Cloud” | Cross-device synchronization |
| Encrypted category names | When you click “Sync to Cloud” | Category structure synchronization |
| Device ID and device name | During cloud sync | Multi-device management |
| Sync timestamps | During cloud sync | Conflict resolution |
| Macro text (Pro and Premium) | When you use AI Rewrite, or, with the semantic suggestions setting turned on (off by default; blocked while Local AI only is on), when saving a macro sends its title and body (capped at 512 characters) to update your search index | AI text processing |
| Focused-field text window (Pro, semantic suggestions on) | If you turn on semantic suggestions (off by default; blocked while Local AI only is on), a 200-character window of the text field you are typing in is sent so it can be matched against your own macros | Macro suggestions |
| OCR-extracted text (Makro Cloud; any tier, credit-metered) | When you trigger cloud AI Cleanup after a Smart Copy extraction (see Section 1.7) | AI text cleanup of OCR results |
| Metadata-stripped image data (Makro Cloud; any tier, credit-metered) | When you trigger cloud Vision after a Smart Copy extraction (see Section 1.7) | AI Vision processing of the selected image |
AI text is sent for the specific operation that needs it - a rewrite, search, or cleanup you start, or the save-time index update while semantic suggestions are turned on - and is not stored after processing. AI-generated content is for general informational purposes only and does not constitute professional advice (legal, medical, financial, etc.).
Local AI Only mode: If you enable the “Local AI only” toggle in Settings > Privacy, all AI processing is restricted to local AI (Ollama or LM Studio) on your device. No macro text is sent to our servers or any third party. This toggle is independent of your subscription tier.
1.4 Website Form Data
If you use the beta signup or contact form on our website, we collect the following data depending on the form:
- Beta signup: email address, current tool usage (survey checkboxes), websites of interest (survey checkboxes), and an optional use-case description
- Contact form: name, email address, message category, and category-specific fields (bug details, billing issue description, or general message)
For contact form submissions, your IP address is hashed (one-way, irreversible) for abuse detection; the raw IP is never stored. Both forms use a proof-of-work bot check (ALTCHA) that runs entirely from our own servers - no script loads from a third party. This data is used solely to respond to your inquiry or notify you about beta access. It is not shared with other third parties or used for marketing.
1.5 Website Analytics
When you visit our website, we collect anonymous analytics: page path, referrer domain, country (from Cloudflare), UTM campaign parameters (if present in the URL), and a daily-rotating one-way hash of your IP for unique visitor counting. We also track anonymous button click events (e.g. "install clicked") to understand how visitors interact with our pages. No cookies and no cross-site tracking. No third-party scripts are loaded on our website - the bot check on our forms (Section 1.4) runs from our own servers. Analytics data is automatically deleted after 90 days.
1.6 Data We Do NOT Collect
- Names or personal identifiers, except the ones you hand over yourself: a website form (Section 1.4), or the author name on a pack you submit to the public library (Section 1.8)
- Browsing history or web activity
- Location data
- Financial or payment information (payments are handled entirely by Polar.sh)
- Page content from websites you visit (Smart Copy reads only the specific image you right-click, not other page content; and with Pro semantic suggestions turned on, off by default, a 200-character window of the text field you are typing in is sent to match against your own macros)
- Keystroke data outside of explicit macro expansions you trigger
1.7 Beta Features
A small number of features are currently beta-gated and only visible to users who have signed up at makroexpander.com/beta and been granted beta access on their license:
- Smart Variants: Context-aware macro bodies that pick a different expansion based on the site, time of day, language, or other conditions. When beta is off, the editor section shows a locked overlay with a signup link; no Smart Variants data is collected, stored on our servers, or transmitted as part of telemetry.
- Conditional placeholders
[$IF:…]…[$ELSE]…[$ENDIF]: Inline conditions inside macro bodies. For users without beta access, the[$ELSE]branch is used if present, otherwise the condition text is left as a literal. No additional data is collected.
Smart Copy (OCR) is generally available and no longer requires beta access. The OCR extraction step runs locally on your device via tesseract-wasm - no image data is sent to our servers during that extraction step, as described in Section 1.1. Optional AI Cleanup and Vision can use a local provider (Ollama or LM Studio) on any tier without Makro Credits, in which case the text or image remains on your device. If you use Makro Cloud, AI Cleanup and Vision are available on every tier, including Free, and consume Makro Credits. Cloud AI Cleanup sends the extracted text; cloud Vision sends a metadata-stripped copy of the selected image to our cloud AI provider as described in Section 1.3.
Beta features do not change what we collect. They are gated behind a server-set flag on your license and have no separate telemetry. If you join the beta and later opt out, the gates revert to the locked state with no data carry-over.
1.8 Community Pack Submissions
A pack is a bundle of macros you export from the extension. You can keep it as a file, hand it to someone as a share link, or submit it to our public pack library. Submitting is free on every tier and works without an account.
A submitted pack is public data. Its contents are stored on our servers in readable form, because the library exists so other people can find and install it. Cloud sync encryption does not apply here: a pack you submit is not encrypted at rest, and we can read it. Once a moderator approves the pack it is served publicly, and other people install it into their own extensions.
What a submission sends us:
- The pack body: the macros in the category you picked, with their hotwords, titles, and body text, plus the pack name, description, version, and tags you filled in. The rest of your library is not sent.
- An author name, if you fill one in. On a submission made without a license key we drop it before publishing, because an anonymous row carries no identifier a later deletion request could match. The extension tells you when that has happened.
- Your license key hash, if you have one, so the cap on how many submissions you can have in review at once applies to your account. Anonymous submissions are rate-limited by IP instead.
Safety checks on the URLs in your pack. Every http or https link inside a submitted pack is checked twice. First it is matched against blocklist feeds we download daily and hold on our own infrastructure; that match runs in our Worker and sends nothing to anyone. Second, for up to five registrable domains per submission, we look up how recently each domain was registered, which discloses the domain name to a third-party RDAP service (Section 4.5). The age lookup is skipped when the blocklist has already flagged the pack. Submitted packs are re-checked against refreshed blocklists on a daily schedule, which can repeat the lookup.
Taking a pack down. Write to support@makroexpander.com and we will unpublish it. Removal stops future installs. It cannot reach copies already installed on other people’s devices, because an installed pack lives in that person’s own local macro storage. Retention rules for submissions are in Section 5.
2. How We Use Your Data
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Macro expansion | Locally stored macros | Core functionality |
| License validation | License key | Contract performance |
| Cloud sync | Encrypted macros, device info | Your explicit opt-in |
| AI text rewrite | Macro text you select for rewriting | Your explicit action |
| Semantic search | Macro titles and bodies (for embedding), and a 200-character window of the focused field (for suggestions) | Your explicit opt-in |
| Smart Copy (OCR) | Image URL, image data (processed locally), extracted text | Your explicit action (right-click) |
| Device management | Device ID, device name | Multi-device sync |
| Rate limiting | License key, request counts | Service protection |
| Weekly telemetry (base payload) | Version, platform, locale, plan tier, build-type flag, and which of the two UI surfaces you use. No device identifier | On Chrome and Edge, legitimate interest in aggregate active-install counting. On Firefox, the browser's own data-collection consent: Firefox 140+ asks at install and declining stops it entirely, and Firefox 128-139 predates that prompt so nothing is sent |
| Weekly telemetry (Tier 1) | Version, platform, locale, country, tier, aggregate counts, time saved, days since install | Explicit opt-in (during onboarding); can be changed in Settings |
| Weekly telemetry (Tier 2) | Browser name, AI provider, theme, import source, features used | Explicit opt-in only (disabled by default) |
3. Encryption and Security
3.1 Local Encryption
All macro data stored on your device is encrypted using AES-256-GCM with a key derived via PBKDF2 (600,000 iterations, SHA-256) from a randomly generated device key and a per-user random salt.
| Parameter | Value | Standard |
|---|---|---|
| Cipher | AES-256-GCM | NIST FIPS 197 / SP 800-38D |
| Key derivation | PBKDF2 (SHA-256, 600,000 iterations) | NIST SP 800-132 |
| IV / Nonce | 96-bit, random per operation | NIST SP 800-38D |
| Salt | 128-bit, random per installation | NIST SP 800-132 |
| Crypto library | Web Crypto API (browser-native) | W3C Web Cryptography API |
3.2 Cloud Sync Encryption (Zero-Knowledge)
When you use cloud sync, your macros are encrypted on your device before transmission using a key derived from your license key. Our servers store only encrypted blobs and cannot read your macro content. Only devices with your license key can decrypt the data.
3.3 Sensitive Data Warning
While your macros are encrypted both locally and in the cloud, Makro is not a password manager or secrets vault. Anyone with access to your browser or device can open the extension, trigger your hotwords, and view your macro content in plaintext. We strongly recommend that you do not store passwords, API keys, authentication tokens, or other sensitive credentials in your macros.
3.4 Session Security
Decrypted data is held in memory only during your active session. The session auto-locks after 30 minutes of inactivity. Encryption keys are never stored in plaintext.
4. Third-Party Services
Makro uses the following third-party services:
4.1 Polar.sh (License Validation)
- Purpose: Validate subscription license keys and determine tier (Free, Pro, Premium)
- Data shared: License key (validated against our Polar.sh organization)
- Privacy policy: https://polar.sh/legal/privacy
4.2 Cloudflare (Infrastructure & Makro Cloud AI)
- Purpose: Hosts our API (Cloudflare Workers) and database (Cloudflare D1) for license validation, cloud sync, and the optional Makro Cloud AI provider (text rewriting, embeddings) via Cloudflare Workers AI
- Data stored: Encrypted macros (cloud sync), device records, AI usage counts
- AI processing: Makro Cloud is an opt-in AI provider that you select in Settings > AI. When selected, the text a request works on - text you ask to rewrite and, while semantic suggestions are turned on, the title and body of a macro you save (for embedding) - is processed transiently by open-source models running on Cloudflare Workers AI; your text is never sent to a third-party AI provider and is not stored, logged, or used for model training. If you have not selected Makro Cloud, no macro text is transmitted for AI processing
- Privacy policy: https://www.cloudflare.com/privacypolicy/
4.3 Local AI - Ollama / LM Studio (Default for new installs)
- Purpose: Local AI providers that run entirely on your machine. Local providers are the default starting point; Makro Cloud is opt-in
- Data shared: None - all processing happens locally on your device and never leaves it
- When: Whenever Ollama or LM Studio is configured as your AI provider in Settings
4.4 Browser Permissions
Makro requests the following browser permissions, which are necessary for core functionality:
| Permission | Purpose |
|---|---|
storage | Store macros, settings, and statistics locally |
clipboardRead | Capture clipboard history (optional, user-enabled feature) and [$CLIPBOARD] placeholder |
clipboardWrite | Copy expansion results and extracted OCR text to clipboard |
activeTab | Act on the tab you are looking at when you invoke Makro from the toolbar or the right-click menu, without requesting the broader tabs permission |
contextMenus | Right-click context menu for quick macro access |
alarms | Schedule periodic tasks: license revalidation (every 6 hours), cloud sync pull (every 6 hours), scheduled auto-backup, weekly anonymous heartbeat, session auto-lock, Teams membership refresh, and OCR worker idle shutdown |
downloads | Export macros as JSON files |
declarativeNetRequest | One static rule set (rules.json) that rewrites the Origin request header on requests to a local Ollama server at localhost:11434 or 127.0.0.1:11434, so Ollama's CORS check accepts them. No other request matches the rules, and no request is blocked or redirected |
notifications | Display sync status and system notifications |
offscreen | Run OCR text extraction (tesseract-wasm) in a background document (Chrome only; Firefox uses the event page) |
scripting | Re-inject the content script into tabs that were already open when Makro was installed or updated, so expansion works without reloading the page |
Makro also declares these host permissions:
| Host | Purpose |
|---|---|
<all_urls> | Text expansion has to work in any text field on any site, so Makro's content script matches every page. On Chrome this access is granted at install. On Firefox it is optional: Makro ships without it and asks for it in the extension itself, and until you grant it expansion only runs on sites you approve. This permission is what lets Makro watch for your hotwords locally; it is not used to read, collect, or transmit page content. The one exception is Pro semantic suggestions, which are off by default: with that setting on, a 200-character window of the field you are typing in is sent so it can be matched against your own macros. See sections 2 and 3 |
localhost:11434, 127.0.0.1:11434, localhost:1234, 127.0.0.1:1234 | Talk to a local AI server (Ollama or LM Studio) running on your own machine. These are loopback addresses; requests never leave your device |
api.makroexpander.com | License activation, encrypted cloud sync, and Makro Cloud AI requests |
We do not request tabs, history, cookies, webRequest, bookmarks, management, or debugger.
4.5 RDAP (Domain Age Checks on Submitted Packs)
- Purpose: Part of the safety check on a pack submitted to the public library (Section 1.8). A domain registered days ago is a signal our blocklist feeds cannot carry yet, so we ask how old the domain is.
- Data shared: The registrable domain of a link inside the submitted pack, for example
example.com, sent tordap.organd forwarded by it to the registry authoritative for that domain. We send the domain name and nothing else: no path, no query string, no pack contents, no identifier for you. We never fetch the submitted URL itself. - When: At submission, and again when the daily re-check runs against refreshed blocklists. It is capped at five domains per submission and skipped when a blocklist has already flagged the pack. Answers are cached, so a domain another submission already asked about is not queried again.
- Scope: Only submissions to the public pack library. Nothing about a macro you keep to yourself, share by link, or sync is ever sent to RDAP.
- Protocol: https://about.rdap.org/
5. Data Retention
- Local data: Stored until you uninstall the extension or clear browser data.
- Cloud sync data: Stored on our servers as long as your subscription is active. Deleted within 30 days of subscription cancellation.
- Trial data: Stored during the 30-day trial period. If you do not subscribe after the trial, server-side data is deleted within 30 days.
- AI usage logs: Request counts (no content) retained for 90 days for quota enforcement, then deleted.
- Device records: Removed when you deactivate a device or cancel your subscription.
- Telemetry heartbeats: Anonymous records automatically purged after 1 year.
- Community pack submissions (Section 1.8): An approved pack stays published until you or a moderator take it down. Two kinds of submission are deleted on a schedule instead: an anonymous submission that a moderator rejected is deleted 7 days after the review, and a submission still waiting for review is deleted 30 days after it was sent unless the submitter holds a paid plan or an active team membership. Any submission outside those two rules is kept until you ask us to remove it.
- Community pack submissions after account deletion: Your pending and rejected submissions are deleted. Published ones stay up, with your account link replaced by a deletion marker and the author name cleared, because other people have installed them.
6. Data Deletion
You can delete your data at any time:
- Local data: Uninstall the extension or use your browser’s “Clear extension data” feature.
- Cloud data: Contact us at support@makroexpander.com to request deletion of all server-side data.
- Device records: Use the “Manage Devices” feature in the extension to deactivate and remove devices, or contact us at support@makroexpander.com.
7. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your data (“right to be forgotten”)
- Export your data (use the extension’s Export feature)
- Restrict processing of your data
- Object to processing of your data
To exercise any of these rights, contact us at support@makroexpander.com.
7.1 California Residents (CCPA)
California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected and the right to request its deletion. For information on your CCPA rights or to submit a request, contact us at support@makroexpander.com.
8. Children’s Privacy
Makro is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.
9. International Data Transfers
Our servers are hosted on Cloudflare’s global network. By using cloud sync or AI features, your data (encrypted blobs for sync; the readable request text for AI) may be processed in data centers outside your country of residence. Cloudflare maintains appropriate safeguards for international data transfers.
10. Security Incident Response
In the event of a security incident affecting our servers, we will notify affected users within 72 hours as required by applicable law and provide details on impacted data and recommended actions.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify users of material changes by updating the “Last Updated” date at the top of this document and, where appropriate, via in-product notice or email. Continued use of Makro after changes constitutes acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy or your data:
- Email: support@makroexpander.com
Full terms of service: Terms of Service