Privacy policy
What happens to your data
Effective 8 August 2026 · Applies to the Phantaslate browser extension for Google Chrome and Microsoft Edge, and to translation performed on phantaslate.com
Summary
Phantaslate is a translation tool built on a stateless relay. Text you submit is passed through for translation and is not stored, logged, or associated with you.
- No account is required, and none exists.
- No translation history is kept — not on your device, not on our server.
- No advertising, no analytics, no tracking, no profiling.
- The text you submit is sent to a machine-translation provider in order to translate it. This is disclosed in full below, and applies equally to the extension and to this website.
- The extension is free and open source. The claims on this page can be verified by reading the code.
This document describes exactly what happens to your data. If anything here is unclear or appears to contradict the source code, please open an issue on GitHub.
1. What Phantaslate does not collect
Phantaslate does not collect, request, or store:
- Names, email addresses, or any account identifiers
- Passwords or authentication credentials
- Payment or financial information
- Browsing history or the list of pages you visit
- Clicks, scrolling, keystrokes, mouse position, or other behavioural telemetry
- Device fingerprints
- Health, biometric, or demographic information
There is no analytics SDK, no advertising SDK, and no third-party tracking script in the extension.
2. What is transmitted, and to whom
Phantaslate only transmits text that you explicitly submit for translation — by typing or pasting it into the panel and pressing Translate. Text on a page you are merely viewing is never read or transmitted.
When you press Translate, the following happens:
- Your submitted text, along with your chosen source and target languages, is sent over HTTPS to the Phantaslate relay at
api.phantaslate.com. - The relay forwards that text to DeepSeek, a third-party machine-translation provider, in order to produce the translation.
- The translation is returned through the relay to your browser and displayed in the panel.
- The relay holds the text only in memory for the duration of the request. Once the response is returned, it is gone. Nothing is written to disk, to a database, or to a log.
The DeepSeek disclosure
The relay is stateless, but it is not a translation engine on its own. Producing a translation requires sending your text to DeepSeek's API. Once your text reaches DeepSeek, it is subject to DeepSeek's own data handling practices, which Phantaslate does not control and cannot make guarantees about.
We state this plainly because a privacy promise that quietly omits it would not be worth much. What Phantaslate controls is everything on its own side of that boundary: no retention, no logging, no linkage between your text and any identifier.
Please review DeepSeek's own privacy documentation if this matters to your use case. If you handle text that must never reach a third-party API, Phantaslate — like every hosted translation service — is not the right tool for it.
Other infrastructure providers
- Render hosts the relay. As with any hosting provider, Render may generate transient operational and network-level logs as part of running the service. Phantaslate does not create, request, or retain application logs of translation content.
- Cloudflare plays two distinct roles, and the difference matters. It provides DNS resolution for the
phantaslate.comdomain, and theapisubdomain — the relay your translations actually pass through — is configured as DNS-only, meaning Cloudflare resolves the address but does not proxy or inspect that traffic. The website you are reading is a separate matter: it is served from Cloudflare's network, so Cloudflare handles requests for these pages and may generate transient network-level logs in doing so, as any host would. Translation text does not travel that path.
2b. Translating on this website
The translation panel on the phantaslate.com homepage sends text to the same relay the extension uses, and that text is handled the same way: held in memory for the length of the request, never written to disk, to a database, or to a log.
The website differs from the extension in one respect, and it is worth stating rather than glossing over. The extension identifies itself with a browser-extension origin and an install token. A public web page has neither, and anyone can send requests to a public endpoint. Keeping the site free and open therefore requires counting usage, and counting usage requires telling one visitor from another.
Two signals are used, both short-lived:
- A salted, rotating hash of your IP address, exactly as described in section 3. The raw IP address is not stored.
- A random identifier your browser generates and keeps for the current tab session. It is not derived from anything about you or your device, it carries no personal information, it is cleared when you close the tab, and you can reset it at any time by clearing site data.
The second exists so that several people sharing one internet connection — an office, a campus, a mobile network — are not counted as a single visitor. It is combined with the IP hash purely to produce a counter key. Neither value is linked to the text you translate, and neither is used to build a profile.
Translation is capped at 5,000 characters per request and 30,000 characters per day. The same limits apply on the website and in the extension. These limits exist to keep a free service affordable, not to gather information about you.
Same third-party disclosure applies. Text translated on this website reaches DeepSeek in exactly the same way as text translated in the extension, and is subject to DeepSeek's own data handling practices. See the disclosure in section 2 — it is not a different arrangement because it happens on a web page.
The website itself carries no analytics, no advertising, no tracking scripts, and makes no third-party requests. Fonts, images, styles and scripts are all served from phantaslate.com.
3. Abuse prevention
To keep a free, account-free service usable, Phantaslate applies a daily usage cap — a baseline of 30,000 characters per day, which may be reduced during periods of high demand or cost pressure.
Enforcing a limit without accounts requires some way to distinguish one user from another. Phantaslate does this in the least identifying way we could design, using exactly two values:
- Your IP address, combined with a secret and the current day, then hashed. The resulting hash is used as a counter key. The raw IP address is never stored, and because the day is part of what is hashed, today's hash of an address and yesterday's are unrelated strings — usage cannot be correlated across days. IPv6 addresses are reduced to their network prefix before hashing, so a device that rotates addresses is still counted as one subscriber.
- An install token — a random value generated once, the first time the extension runs. It contains no personal information and is not derived from anything about you, your device, or your browsing. It is sent with each translation request and, on the relay, is hashed by the same day-scoped method as the IP address.
To be precise about the install token's lifetime, since "anonymous" is sometimes used loosely: it is not short-lived. It persists in your browser's local storage until you uninstall the extension or clear its storage, and it is the same value on every request you make. What it is not is an account, a login, or a profile — it is never linked to translation content, never given a name or an email address, and exists solely so that a daily cap can belong to one installation rather than to an entire shared network, which is what would happen if IP address were the only signal available. You can reset it at any time by clearing the extension's storage, which simply starts a fresh count.
Neither value is used to build a profile, neither is linked to translation content, and neither is shared with anyone.
Because an IP address is processed — even momentarily, and even in hashed form — we disclose "Location" in the Chrome Web Store data usage form, and declare the same processing in the Microsoft Edge Add-ons submission. We would rather over-disclose than have a technically true claim mislead you.
4. Data stored on your device
The browser extension stores a small amount of data locally using chrome.storage.local (the same API in Chrome and Edge). Only one item is ever sent to the relay, and it is marked below:
| Stored value | Purpose | Sent to relay? |
|---|---|---|
| Panel position and size | Keeps the panel where you left it | No |
| Relay URL | Allows you to point the extension at a different relay | No |
| "Clear text when the panel closes" preference | On by default | No |
| "Remember last used languages" preference | Opt-in only; off by default | No |
| Last used language pair | Stored only if you enable the option above | No |
| Install token | Counts usage against the daily cap (section 3) | Yes, with each translation request |
Translation text and results are never written to storage. Closing the panel clears its contents by default.
You can remove all locally stored data, including the install token, at any time by uninstalling the extension or by clearing the extension's storage from your browser's settings.
On this website, the only value kept in your browser is the session identifier described in section 2b, which your browser discards when you close the tab.
5. Permissions and why they are needed
These apply to the browser extension. The website requires no permissions.
| Permission | Why it is required |
|---|---|
activeTab | Grants temporary access to the tab you are on, and only at the moment you click the extension icon. Access ends when you navigate away |
scripting | Injects the translation panel into that tab so you can translate without leaving the page. Used only in response to your click |
storage | Saves the local data listed in section 4 |
clipboardWrite | Powers the panel's Copy button, on click only |
Host permission — api.phantaslate.com | Required to send submitted text to the relay and receive the translation |
Host permissions — localhost and 127.0.0.1 | Lets you point the extension at a relay running on your own machine, using the relay endpoint field in settings. Unused unless you change that setting |
No permission is used for any purpose beyond the one stated above.
What is deliberately absent. Phantaslate requests no broad host permission — no <all_urls>, no wildcard over the sites you visit. It is therefore not technically capable of reading page content in the background, and the panel appears only on a tab where you have clicked the icon. This is checkable in seconds: open manifest.json in the repository and read the host_permissions list. Its three entries are the ones in the table above.
6. Data retention
| Data | Retention |
|---|---|
| Submitted text | Held in memory for the duration of the request only |
| Translation results | Not retained by the relay |
| Usage counters (salted hashes) | Held in memory only; expire with the daily window, and are lost entirely whenever the relay restarts |
| Local preferences and install token | Kept on your device until you clear them or uninstall |
| Website session identifier | Discarded by your browser when you close the tab |
Phantaslate has no database of user content. There is no archive to search, no history to export, and nothing to hand over in response to a request — because nothing is kept.
7. Your rights
Because Phantaslate does not hold personal data associated with you, there is nothing to access, correct, export, or delete on our side. There is no account to close. The one identifier that persists — the install token described in section 3 — is held on your device, not ours, and you can remove it yourself at any time.
If you are in a jurisdiction with data protection rights such as the GDPR or CCPA and believe personal data of yours has nonetheless been processed, you are welcome to contact us using the details in section 10.
Phantaslate does not sell personal information, and does not share it for cross-context behavioural advertising.
8. Children
Phantaslate is not directed at children and does not knowingly collect information from them. Since no personal information is collected from anyone, this holds generally.
9. Verification and changes
Phantaslate is open source. Every claim in this document can be checked against the source code, including the relay:
github.com/October34th/phantaslate
If this policy changes, the revised version will be published at the same URL with an updated effective date, and material changes will be noted in the repository's release notes. Continued use of the extension or this website after a change indicates acceptance of the revised policy.
10. Contact
Questions, corrections, or concerns about this policy:
- GitHub issues: github.com/October34th/phantaslate/issues
- Email: cdxyu@tuta.com