Privacy Notice — Noah's Ark

Version: 1.0
Effective date: 2026-05-22
Last updated: 2026-05-22

1. Identity and Contact

Data controller:
Hộ Kinh Doanh Võ Thị Huyền Vân – Cố Vấn Độc Lập
(Vietnamese registered household business / hộ kinh doanh, independent-consultant trade)
Principal: Võ Thị Huyền Vân
Business registration number: 046171000354
Registered address: 19 Trương Công Định, Phường Tân Bình, Thành Phố Hồ Chí Minh, Việt Nam

The Household Business is referred to as "we" in this notice. Developer operating under the Household Business: Lê Vũ Minh Phúc.

Contact for privacy matters:
Email: levuminhphuc2007@gmail.com
Phone: 0918425016

Business registration is made under applicable Vietnamese law governing household businesses (hộ kinh doanh). Disclosure of the registration number and registered address in this notice satisfies the commercial-disclosure obligation applicable to hộ kinh doanh.

2. Scope

This notice covers:

• The Noah's Ark Chrome extension (version 1.3, Manifest V3), identified by extension ID mcmdnfalhfjfojifmhihdoophopldefl.
• The server-side Cloud Functions backend (editorAction, proposeEntity, claimUsername, claimLegacyPosts) and associated Firestore database operated on Google Cloud under Firebase project noah-s-ark-4ee2d.

This notice does not cover third-party websites that Noah's Ark operates on. Those sites have their own privacy policies.

For EU users, see also data-protection.md (the GDPR-specific addendum).
For software license terms, see end-user-license-agreement.md.
For the service relationship contract, see terms-of-service.md.

3. What We Collect (and What We Do Not)

3.1 Client-side storage (local to your browser)

The extension stores the following in chrome.storage.local or chrome.storage.session. This data lives in your browser and is not transmitted unless explicitly noted.

3.2 Authentication data

When you sign in with Google:

• Firebase ID tokens — issued by Firebase Auth; managed in extension memory by the Firebase JS SDK; rotated automatically. Not persisted directly to chrome.storage.
• Google account email — from the email OAuth2 scope.
• Google display name — from the profile scope.
• Google profile photo URL — from the profile scope.

All three Google fields are optional. You may use Noah's Ark anonymously using a creator_uuid until you choose to sign in.

• Username — optional; user-chosen; unique per platform; validated via the claimUsername Cloud Function.

3.3 Server-side Firestore collections (user-initiated writes)

Your actions in the extension cause writes to these Firestore collections:

3.4 Server-only collections (not written or read by the extension client)

3.5 What we do not collect

• Additional personally identifiable information. No real-name mandate, no national ID numbers, no postal addresses, no phone numbers beyond those you choose to put in discussion posts.
• Financial information. Hosting discussions about publicly traded stocks and cryptocurrencies does not constitute collection of financial information. We do not collect bank account credentials, brokerage API keys, portfolio holdings, net worth, or transaction history.
• Health information. None.
• Location data. No Geolocation API calls, no IP-to-city lookups, no geographic data stored or transmitted.
• Web browsing history. Content scripts run only on the explicitly enumerated finance and crypto host patterns in node.js/manifest.json. We do not see, store, or transmit pages outside that list. We do not maintain a session log of visited URLs.
• Personal communications. No email scraping, no chat-channel access.
• Payment information. No payment flow exists in the current version. If a Pro billing flow ships, it will route through a third-party payment service provider — not through our systems.

4. Purposes of Collection

5. Legal Bases for Processing

5.1 Vietnam PDPL — Decree 13/2023/NĐ-CP

Vietnam's Personal Data Protection Law (effective 2023-07-01) is our primary governing regime.

Data subjects have the right to withdraw consent at any time. Withdrawal does not affect lawfulness of processing based on consent before the withdrawal.

5.2 GDPR — for EU/EEA users

GDPR (Regulation (EU) 2016/679) applies to users in the EU/EEA by virtue of the extension being made available to persons in the EU (Art. 3(2) territorial scope).

5.3 CCPA — for California residents

CCPA (California Civil Code §§1798.100 et seq., as amended by CPRA) is a disclosure-only regime for our purposes. We are a "business" as defined in §1798.140.

We do not "sell" personal information as defined in §1798.140(ad). We do not share personal information for cross-context behavioral advertising. We do not use personal data to determine creditworthiness or for lending. The three CWS certification checkboxes confirmed in docs/cws/privacy-disclosure.md apply here.

This notice satisfies the right-to-know notice obligation of §1798.115.

6. Third-Party Processors

6.1 Firebase / Google Cloud

Role: Infrastructure provider — Auth, Firestore, Cloud Functions, Storage.
Relationship: Controller (Household Business) – Processor (Google Cloud EMEA Limited and affiliates) under the Google Cloud Data Processing Addendum, which incorporates Standard Contractual Clauses for international transfers.
What is sent: All Firestore data described in §3.3–§3.4; Firebase Auth tokens; Cloud Functions invocations.
What is NOT sent: Anything not described in §3.

6.2 Perplexity AI

Role: Research data provider in the AI evidence pipeline.
What is sent: Research queries derived from the user-highlighted claim text and discussion context intent. Source: node.js/functions/index.js:1714.
What is NOT sent: The user's Firebase UID, email, display name, or any Firestore document content unrelated to the specific copilot request.
Caching: Responses cached server-side in evidence_cache (4h / 24h TTL) to reduce duplicate calls.

6.3 xAI (Grok)

Role: Research data provider in the AI evidence pipeline.
What is sent: Research queries derived from claim text. Endpoint: https://api.x.ai/v1 (OpenAI-compatible). Source: node.js/functions/index.js:1796.
What is NOT sent: Firebase UID, email, display name, or unrelated Firestore content.

6.4 Google Gemini

Role: Embeddings generation and research in the AI evidence pipeline.
What is sent: Research queries and embedding inputs derived from highlighted claim text. Endpoint: https://generativelanguage.googleapis.com via @google/generative-ai SDK.
What is NOT sent: Firebase UID, email, display name, or unrelated Firestore content.

6.5 Anthropic Claude

Role: Synthesis (Critic and Synthesizer roles) in the AI evidence pipeline.
What is sent: Synthesis prompt with retrieved evidence and the user's question intent. Endpoint: https://api.anthropic.com via @anthropic-ai/sdk.
What is NOT sent: Firebase UID, email, display name, or unrelated Firestore content.

6.6 What is never sent to any AI provider

The user's Firebase UID, email address, and display name are never sent to Perplexity, xAI, Google Gemini, or Anthropic Claude. All AI provider calls are made server-side by the editorAction Cloud Function. The extension client never directly calls any of these providers.

7. International Data Transfers

US-based providers: Perplexity AI, xAI, and Anthropic Claude are US-based. Transfers of EU-resident personal data (in the form of claim text and intent) to these providers occur under Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to GDPR Art. 46(2)(c), or equivalent appropriate safeguards. We rely on each provider's applicable data processing terms.

Google / Firebase: Operates globally. Google Cloud's Data Processing Addendum includes SCCs covering transfers from the EEA to Google infrastructure outside the EEA (GDPR Art. 46).

Vietnam PDPL: Cross-border transfers of personal data are conducted in accordance with the obligations set out in Decree 13/2023/NĐ-CP.

8. Retention

9. Your Rights

9.1 Rights under Vietnam PDPL — Decree 13/2023/NĐ-CP

• Right to access — obtain confirmation that your data is processed and access a copy, under Decree 13/2023/NĐ-CP.
• Right to correction — request correction of inaccurate data, under Decree 13/2023/NĐ-CP.
• Right to deletion — request deletion of personal data we hold about you, under Decree 13/2023/NĐ-CP.
• Right to restrict processing — object to processing and request restriction in certain circumstances, under Decree 13/2023/NĐ-CP.
• Right to withdraw consent — where processing is based on consent, you may withdraw at any time. Withdrawal does not affect processing already done.

Response deadline under Vietnam PDPL: within the period required by applicable Vietnamese law.

See also terms-of-service.md for the dispute-resolution clause applicable under Vietnamese law.

9.2 Rights under GDPR — for EU/EEA users

• Art. 15 — Right of access: obtain confirmation whether we process your data and receive a copy.
• Art. 16 — Right to rectification: request correction of inaccurate personal data.
• Art. 17 — Right to erasure ("right to be forgotten"): request deletion when data is no longer necessary, consent is withdrawn, or data was processed unlawfully.
• Art. 18 — Right to restriction of processing: pause processing while accuracy or legitimacy is contested.
• Art. 20 — Right to data portability: receive your data in a structured, machine-readable format and transfer it to another controller (applies where processing is consent- or contract-based and automated).
• Art. 21 — Right to object: object at any time to processing based on Art. 6(1)(f) (legitimate interests). We will stop processing unless we demonstrate compelling legitimate grounds.
• Art. 22 — Rights related to automated decision-making: we do not make solely automated decisions that produce legal or similarly significant effects on you. The gravity ranking algorithm ranks community posts, not individuals, and produces no legal effects.

Response deadline under GDPR: 1 month from receipt of request, extendable by 2 further months for complex requests (Art. 12(3)).

EU users may also lodge complaints with their national data-protection authority and bring proceedings in their EU member-state courts (GDPR Art. 79).

For full detail on controller/processor relationships, transfer mechanisms, and EU data-subject rights procedures, see data-protection.md.

9.3 Rights under CCPA — for California residents

• §1798.100 — Right to know what personal information we collect, use, disclose, and the purposes for collection.
• §1798.105 — Right to delete personal information we have collected, subject to statutory exceptions (e.g., legal compliance, security, completing the service).
• §1798.115 — Right to know about disclosures to third parties. We do not sell or share personal information for advertising. AI provider calls send only de-identified claim text; see §6.
• §1798.120 — Right to opt out of the sale or sharing of personal information. We do not sell personal information (§1798.140(ad)). This right is not applicable, but we note it for completeness.
• §1798.121 — Right to limit use of sensitive personal information. We do not process sensitive personal information as defined in §1798.140. This right is not applicable.
• §1798.125 — Right to non-discrimination. We do not deny goods or services, charge different prices, or provide a different quality of service because you exercised a privacy right.

Response deadline under CCPA: 45 days from receipt of a verifiable consumer request, extendable by 45 days with notice (§1798.130).

California users retain the right to file complaints with the California Privacy Protection Agency (CPPA) per CCPA §1798.155 (post-CPRA, eff. 2023-01-01; Stats. 2020 Ch. 30 §16, as amended) and exercise private-right-of-action remedies where applicable per §1798.150.

10. How to Exercise Your Rights

Send a request to: levuminhphuc2007@gmail.com

Identity verification: To process a deletion or access request, we must verify that the request comes from the account owner. Provide your Firebase UID in the request. Your Firebase UID is available in the extension by opening the side panel while signed in — your UID appears in the browser developer console log (look for "User authenticated: [uid]" in the service worker console).

Response timelines:

• Vietnam PDPL: within the period required by applicable Vietnamese law.
• GDPR (Art. 12(3)): 1 month, extendable by 2 months.
• CCPA (§1798.130): 45 days, extendable by 45 days.

11. Children's Privacy

Noah's Ark is not directed at children. The minimum age to use the service is 13 years (COPPA-aligned). In the EU, the minimum age for a child to provide their own consent for information society services is 16 years (GDPR Art. 8); users under 16 in the EU require parental or guardian consent.

We do not knowingly collect personal data from users under 13. If a parent or guardian believes their child under 13 has provided personal data, contact us at levuminhphuc2007@gmail.com and we will delete the data.

12. Security Measures

• Encryption at rest: Firebase and Google Cloud encrypt data at rest by default.
• Encryption in transit: All connections use TLS.
• Content Security Policy: The extension enforces script-src 'self' 'wasm-unsafe-eval'; object-src 'none'; base-uri 'none'; require-trusted-types-for 'script'; trusted-types dompurify default; — no unsafe-inline, no unsafe-eval, no remote script sources.
• Trusted Types: Every DOM mutation surface enforces the Trusted Types API.
• No remote code execution: No eval, no new Function, no dynamic import() of remote URLs anywhere in the codebase. All JavaScript is bundled at build time via esbuild.
• Firestore security rules: Server-side rules enforce that users may read and write only their own documents. Discussion posts are readable by all authenticated users.

13. Data Breach Notification

In the event of a personal data breach:

• GDPR (Art. 33): We will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons.
• GDPR (Art. 34): Where a breach is likely to result in high risk to affected data subjects, we will notify those individuals without undue delay.
• Vietnam PDPL: We will comply with breach notification obligations under Decree 13/2023/NĐ-CP within the period required by applicable Vietnamese law.

14. Changes to This Policy

This is version 1.0 of the privacy notice, effective 2026-05-22. We will post material changes in the extension popup before the updated policy takes effect. The version number and effective date will be updated at the top of this document. For changes that materially affect how we process your personal data, we will notify you via the extension popup at your next session.

15. Contact for Privacy Matters

Hộ Kinh Doanh Võ Thị Huyền Vân – Cố Vấn Độc Lập
19 Trương Công Định, Phường Tân Bình, Thành Phố Hồ Chí Minh, Việt Nam
Email: levuminhphuc2007@gmail.com
Phone: 0918425016

16. Sources Cited