Privacy Policy

Last updated: September 03, 2026

1. Introduction

Welcome to SM Tools ("we", "our", or "us"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Chrome browser extension and related services (collectively, the "Service").

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this policy, please do not access the Service.

2. Information We Collect

2.1 Information We Do NOT Collect

  • Facebook Passwords: We never collect, store, transmit, or have access to your Facebook login credentials.
  • Personal Content: We do not collect, read, or store any content you publish through the extension beyond what is necessary for publishing.
  • Browsing History: We do not track or collect your browsing history outside of Facebook group interactions.

2.2 Information We Collect

  • License Key & Google OAuth: When you sign in with Google, we receive your Google email and name via secure PKCE OAuth (scopes: userinfo.email, userinfo.profile). We use this only to create/authenticate your account. We also verify your license key.
  • Device Information: We collect device fingerprint data (browser type, screen resolution, hardware info, timezone, language) for device binding and security purposes. This ensures your license key is used only on authorized devices.
  • Account Information: Name and email address provided during registration / Google Sign-In for account management purposes.
  • Usage Logs: We collect usage data (login timestamps, device information, actions performed, publishing history) for service improvement, abuse prevention, and security monitoring.
  • Facebook Profile Data: The extension reads your Facebook profile name and profile picture from the browser page via content script to display in the extension interface. This data is stored locally and not transmitted to our servers except as needed to display your account.
  • Content You Create: Articles, comments, keywords and URLs you enter for Group/Comment Marketing are stored locally (chrome.storage.local) and pasted into Facebook group pages only when you click Post. They are not sent to our servers unless you explicitly use AI generation.
  • AI Provider Data (Optional): If you enable AI features and enter your own OpenAI or NaraRouter (router.bynara.id) API key, your prompts (keyword/topic) are sent directly from your browser to those providers to generate articles. We do not see or store your API keys on our servers — they remain in your local extension storage.

3. How We Use Your Information

  • To authenticate and verify your subscription status
  • To provide and maintain the Service
  • To detect and prevent abuse, fraud, and unauthorized access
  • To improve our Service and develop new features
  • To communicate with you about updates, security alerts, and support
  • To comply with legal obligations

4. Data Storage & Security

Your data is stored securely using industry-standard encryption. We use Supabase (a trusted cloud database provider) for data storage. Data is transmitted over encrypted connections (HTTPS/TLS).

  • Data is encrypted in transit (TLS/SSL)
  • Access is restricted to authorized personnel only
  • All API communications are authenticated with JWT tokens
  • Device binding data is stored to prevent unauthorized license usage

Note: The extension operates within your browser and interacts with Facebook's website through your existing browser session. Your Facebook credentials are never accessed or transmitted by our extension.

5. Third-Party Services

We use the following third-party services:

  • Supabase (adqisrodsfafxdvinccl.supabase.co): For database hosting, authentication, and Edge Functions (license validation, referral, payments) — subject to Supabase Privacy Policy
  • Google Identity (OAuth2): For "Continue with Google" sign-in via chrome.identity API. We request only userinfo.email and userinfo.profile. No offline access.
  • Facebook (facebook.com / web.facebook.com): Content script runs only on Facebook to automate posting you initiate. We never store your Facebook password. Automation uses your existing browser session.
  • OpenAI (api.openai.com) — Optional: Only if you enter your own API key and enable ChatGPT in Settings. Prompts are sent directly from your browser to OpenAI (OpenAI Privacy).
  • NaraRouter (router.bynara.id) — Optional: Alternative AI provider, also only if you provide your own key (NaraRouter Privacy).
  • NowPayments: For cryptocurrency payment processing (subject to NowPayments Privacy Policy)

These services have access to information only as needed to perform their functions and are obligated to protect your data. AI keys never leave your device to our servers.

5.1 Chrome Permissions Justification

The extension requests the following permissions for its single purpose — Facebook Group Publishing Automation:

  • storage, alarms: Save your groups, accounts, queue, history and run scheduler.
  • tabs, activeTab, windows, scripting: Open selected Facebook group in a popup window and inject automation to paste your article and click Post — only on facebook.com after you click Post.
  • notifications: Show success/failure of posts.
  • identity: Google Sign-In via chrome.identity.launchWebAuthFlow (PKCE).
  • clipboardWrite: Copy your generated article to paste into Facebook's editor (we do not read your clipboard).
  • host_permissions: facebook.com for automation, supabase.co for backend, openai.com / bynara.id only if you enable AI.

6. Data Retention

We retain your account information and usage logs for as long as your account is active. When you delete your account, all personal data is permanently removed within 30 days. Anonymous usage statistics may be retained for analytical purposes.

7. Your Rights

You have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion of your data
  • Object to processing of your data
  • Data portability
  • Withdraw consent at any time

To exercise these rights, contact us at privacy@smtools.online

8. Children's Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page with an updated "Last updated" date. You are advised to review this page periodically for any changes.

10. Contact Us

If you have any questions about this Privacy Policy, please contact us: