SPUR Extension

Privacy policy

• Effective date: 3 November 2026
• Publisher: SPUR Lab
• Contact: spur-acct-group@njit.edu

What this extension does

The SPUR Extension for LimeSurvey lets a research participant view their own conversations and memory from ChatGPT, Claude or Google Gemini inside a research survey. It runs entirely in the participant’s browser.

The extension has no server of its own. Conversations and memory are read from the participant’s own account, held on the participant’s own computer, and displayed to the participant. There is no account to sign up for, no analytics, and no tracking.

Conversations and memory are never sent to the research team, to the study’s survey server, or to any third party, except what the participant chooses to submit on the survey questions described under What is transmitted, and to whom below:

• conversation titles the participant selects on the title donation question,
• whole conversations — about security or privacy topics — the participant selects on the keyword donation question,
• a conversation’s title or text, or a memory section’s heading or text, the participant adds to a summary with a button, and
• memory subtitles the participant chooses to share on the memory choices question.

Nothing is selected for them, and a participant who selects nothing sends nothing.

Apart from those answers, the participant’s own device is the only place this copy of their conversations and memory exists, and they can erase it at any time.

What the extension accesses

Only from the chatbot the participant chooses, only while they are already signed in, and only their own account:

• Conversation titles, and the provider’s conversation identifiers. Every title is read, on the participant’s computer, so that a sample can be drawn and the donation questions can list them
• Message text, message roles, timestamps, and project/folder names, for five conversations chosen at random and for any others the participant asks the keyword donation question to check
• The chatbot’s memory about the participant, which can include personal details such as their name, profession, education, where they live, interests and relationships. For ChatGPT this is its saved memories and “About you” profile; for Claude, its memory summary and memory files; for Gemini, its answer to the message described under The one change to a provider account
• The participant’s existing session cookies, used to authenticate these requests, and the access tokens ChatGPT and Gemini issue to that session. These tokens are held in memory only, and are never written to disk or sent anywhere other than the chatbot that issued them
• For Gemini only, the email addresses of the Google accounts signed in to that browser, so the survey can ask which account to read. These are displayed to the participant and not stored; only the account’s position in the list is

To read Claude’s memory, the extension runs a script in a claude.ai tab, opening a temporary background tab if none is open and closing it afterwards. To ask Gemini for its memory, it runs a script in a small window it opens for that purpose.

The extension does not read browsing history and does not track visited pages. It looks at open tabs only to find the survey and claude.ai.

Where data is stored

All storage is local to the participant’s browser profile:

The extension stores nothing outside the participant’s own machine.

What is transmitted, and to whom

To the chosen chatbot. Requests go to chatgpt.com, claude.ai or gemini.google.com, to read the participant’s own data using their own session. For Gemini, this includes the one message described under The one change to a provider account.

To Google Fonts. The extension’s Debug log and Clear Data page loads its icons from fonts.googleapis.com, which discloses the participant’s IP address to Google when that page is opened. No study data is included.

To the research survey — nothing, except what the participant chooses to donate or writes themselves, and a count of their conversations they choose to fill in.

The extension displays conversations and memory inside the survey page by writing them into the page in the participant’s browser. That rendering is local. This content is written only into question types that contain no input field, so displaying it never makes it part of what the survey submits. Outside the four questions below, no message text and no memory profile text reaches the survey server.

Four questions are deliberate exceptions, and they are the only ones.

Title donation. The participant is shown a list of their conversation titles with nothing selected, ticks any they are willing to share, and presses a button that writes those titles — and nothing else — into an ordinary answer box they can read and edit before continuing. Only titles they selected are submitted. Titles they did not select, the conversations behind them, their identifiers and their dates are not submitted.

Keyword donation. The extension searches the participant’s conversation titles, on their own computer, for words related to security and privacy, and lists only the conversations whose titles match, each labelled with the topic it matched. The participant may ask the extension to read any of those conversations in full; that reading also happens on their computer and sends nothing. The participant then ticks any checked conversations they are willing to share and presses a button that writes those entire conversations — the title, the matched topics, and the full text of every message, both the participant’s and the chatbot’s — into an ordinary answer box they can read and edit before continuing. Only conversations they ticked are submitted. Conversations they did not tick, did not check, or that were not listed, and all conversation identifiers and message timestamps, are not submitted.

Writing a summary. The survey asks the participant to describe something it has shown them — either a conversation or a section of the chatbot’s memory about them — in their own words, in an ordinary answer box. Two optional buttons help them fill it: one adds the conversation’s title or the memory section’s heading, the other adds the conversation’s full text or the memory section’s text. Each button adds one thing, and both add to the box rather than replacing what is in it, so the participant can edit or delete anything there before continuing. A participant who ignores the buttons and writes a sentence submits only that sentence. Nothing is put in the box unless they press a button.

Memory choices. The survey lists the subtitles of the chatbot’s memory about the participant — section headings only, never the text under them — and for each one asks how the chatbot should update it, how long it should keep it, and whether the participant is willing to share the subtitle. Their choices are written into an ordinary answer box as they make them. A subtitle is written into that box only if the participant chose to share it; every other row is recorded as a section number with their choices. Anything they type into an “Other” option is written there too.

The summary buttons and the memory choices question are the only ways memory profile text can be submitted: memory section text only if the participant presses a summary button themselves, and memory subtitles only if they choose to share them. Every other question that shows memory is display-only.

On all four questions nothing is selected or written in advance, and a participant who selects nothing and writes nothing sends nothing.

How many conversations they have. One further question asks the participant how many conversations they have had with their chatbot, and offers a button that fills in the number for them. What this submits is a number and nothing else — no titles, no message text, no identifiers and no dates — so it is not one of the exceptions above. The box is an ordinary one they can type over: the question tells them they may round the number, or answer 0 instead of answering at all, and nothing is filled in unless they press the button.

To the research team — nothing automatically. The extension sends no data to us. Its participant version has no first-party endpoint, no analytics, no telemetry, and no crash reporting, and it does not report who installed it or what it read.

Error reports — only if the participant sends one. The extension keeps a log of its own technical messages on the participant’s computer, for the last 24 hours. If they have a problem, its Debug log page offers two reports to copy, and they choose whether to send either one. The extension never sends them.

• The short report is the one we ask for. It is built from a fixed list of fields: the extension and Chrome versions, the chosen chatbot, the status of each collection, how many of the sampled conversations were collected, whether the account has at least the study’s minimum number of conversations, and the type and code location of any errors.
• The full report is sent only if we ask for it. It adds the technical log and more detail on the extension’s state. Before an entry is stored, identifiers, email addresses, access tokens, quoted text and conversation counts are masked. The log is written not to contain conversation text, titles or memory, but masking cannot recognise every kind of personal detail, such as an unquoted name inside an error message from a provider.

Reports are sent as a message through Prolific, which hides email addresses and shows us the participant’s Prolific ID. We ask participants not to add their name, email address or anything from their chats. The log is erased by Clear log, by Clear Data, and by the 24-hour automatic deletion.

Processing

Keyword matching on conversation titles and text happens on the participant’s computer. No conversation text is sent to any AI service for processing, and the extension does not generate summaries.

The one change to a provider account

The extension only reads from ChatGPT and Claude. It does not delete, edit, rename or send anything in those accounts.

Gemini is the exception. Gemini has no way to read its memory directly, so after the participant confirms, the extension sends one message from their account, shown to them first, asking Gemini to sum up what it knows about them. It then reads the answer and closes the window. That chat stays in their Gemini history, where they can delete it themselves. The extension leaves it out of the conversations it collects.

The extension makes no DELETE request to any provider. Deleting collected data removes the extension’s local copy only; the participant’s conversations stay in their account untouched.

Retention and removal

Collected data is deleted automatically 24 hours after it is collected, whether or not the participant takes any action. If the computer is switched off when that moment passes, the deletion is carried out the next time the browser is opened.

Participants can also remove it sooner, at any time. They may:

• Press the delete button on the final page of the survey, which erases everything immediately
• Use Clear Data on the page the extension’s toolbar icon opens, to erase all stored conversations, messages, memory, survey progress and the debug log
• Uninstall the extension, which removes its stored data with it

Because the research team does not receive this locally stored data, we hold nothing of it for a participant to request access to, correction of, or deletion of. Control rests entirely with the participant, on their own device.

The exceptions are anything a participant chose to submit in the survey, and any error report they chose to send. Survey answers, including donated titles, conversations and memory items, are held with the rest of their survey response, and are covered by the study’s consent form and by the retention and withdrawal terms described there — not by this policy, which governs the extension.

What we do not do

• We do not sell or transfer data to third parties
• We do not use data for advertising, profiling, or creditworthiness or lending purposes
• We do not use data for any purpose unrelated to the research study described to participants
• We do not receive personally identifying information from the extension. It handles Gemini account email addresses and memory that can contain personal details, on the participant’s computer only
• We do not receive any data from the extension itself — it has no endpoint to send to. The only information that reaches us is what a participant submits through the survey (their own answers, and anything they chose to donate) and any error report they choose to send

Study context

Participants recruited through a research panel complete a survey hosted by NJIT. That survey collects the participant’s responses and their panel identifier for compensation purposes. The extension does not receive, store, or transmit any such identifier, and the survey does not receive conversation or memory content other than what the participant chooses to donate or write on the four questions described above. Survey participation is governed by the study’s consent form and its IRB approval, which are provided to participants separately.

This policy covers the version of the extension given to participants. The research team also runs a developer version on its own test accounts, which includes a side panel and an automatic health check and is not distributed to participants.

Changes

Material changes to this policy will be published at this address with a revised effective date.

Contact

Questions about this policy or the extension: spur-acct-group@njit.edu