Install Now

Privacy

Privacy Policy

Privacy Policy

Effective date: August 17, 2026

This Privacy Policy explains how the Google Flow Automator - Nano Banana, VEO and Omni Flash Chrome extension and its optional GFA Studio companion app (together, the “products”, “we”) handle data.

Summary. We use Firebase for account, feature-access, quota, security, and support functions. Optional Google Analytics 4 counting is used only to estimate GFA Studio installations and recent active users with a random, locally stored pseudonymous counting identifier. We do not collect extension-activity analytics, sell personal data, or use it for advertising.

1. Data we process

  • Account and feature access: Google/Firebase sign-in session data, Firebase user identifier, email and profile details supplied by Firebase Authentication, active plan category, feature-access state, quota usage, installation/security state, and support records.
  • Local extension data: prompt queues, reference assets, settings, storyboards, download state, and short-lived operational logs stored in Chrome extension storage.
  • Optional Studio counts: analytics is off by default. If you affirmatively enable Share privacy-limited Studio usage counts in Settings, Studio deliberately supplies Google Analytics 4 with one studio_install event after the first successful opt-in, a studio_active heartbeat when Studio starts and about once every 10 minutes while it remains open, a synthetic GFA Studio page label, and minimal timing information. Studio also supplies a random, locally stored pseudonymous counting identifier. It is not derived from or linked to your Firebase account, membership, projects, or device-installation security identifier and is used only to avoid counting the same opted-in Studio installation as new on every launch. Google Analytics may automatically create records such as first_visit, session_start, and user_engagement.
  • Never deliberately included in analytics: extension activity, feature activity, names, email addresses, Firebase user IDs, membership, project names or content, prompts, images, video, audio, captions, file names or paths, page content, API keys, authentication tokens, diagnostic logs, advertising IDs, or precise location are not deliberately sent as event parameters. Because Studio connects directly to Google Analytics after opt-in, Google necessarily receives network and browser request information such as the IP address and user agent and may derive approximate location or device information under Google's policies.

2. How data is used

  • Authenticate users and maintain account, feature-access, quota, and security controls
  • Provide automation, queue, storyboard, and download functionality
  • Estimate opted-in Studio installations and recent active Studio users
  • Prevent abuse and respond to support requests

3. Storage and sharing

  • Local settings, queues, assets, and operational logs are stored in chrome.storage.local.
  • Account, feature-access, quota, security, and support records may be stored in Firebase.
  • After Studio analytics opt-in, an isolated local Studio counter sends the two deliberate count events and associated minimal fields directly to Google Analytics 4. Google Analytics may add the automatic records and inherent browser/network signals described above. Firebase is not used as an analytics relay.
  • We do not sell personal data, share it with data brokers, or use it for advertising, credit, or lending decisions.

3.1 GFA Studio project data and exports

  • Projects stay local. Imported media, project files, recordings, narration audio, background music, captions and rendered video are written to the local project folder you choose. They are not uploaded to a GFA server.
  • Prompt handoff. When you send media from the extension to Studio, the prompt that generated each item travels with it over the local connection between the extension and the Studio application on the same computer. We do not store those prompts on a GFA server. Studio uses them to write narration locally or through the AI provider you selected, which is why your images are not uploaded in order to write a script.
  • Exports are produced locally. Everything Studio exports — the rendered video, individual scene clips, narration audio, background music, SRT captions, the prompt CSV and the timing manifest — is generated on your computer and written to a folder you choose. No export passes through a GFA server.
  • Provider keys. Your OpenAI, Anthropic or ElevenLabs keys are held in your operating system's credential store. They are never sent to a GFA server. They travel over TLS only to the provider you selected, at the moment you use that provider.

4. Chrome Web Store Limited Use Policy

If Google APIs are used, Google user data is handled only for the specific features you choose to use. We operate under the Chrome Web Store User Data Policy and its Limited Use requirements.

  • We do not sell personal information.
  • We do not use your personal data for ad targeting.
  • We do not transfer personal information for credit or lending decisions.
  • We do not use user data to build separate advertising or behavioral profiles.

5. Third-party services

  • Google Firebase provides Authentication, Cloud Firestore, and Cloud Functions for account, feature-access, quota, security, and support.
  • Google Analytics 4 processes the two deliberately supplied, opted-in Studio count events, its automatic web-tag records, and the network/browser request information inherent in that direct connection. Analytics retention and international processing follow the settings and policies of our Google Analytics property.
  • Google Flow receives prompts and selected assets directly from your browser when you start automation, under your own Google account and Google's terms and privacy practices.
  • Google Chrome stores local extension data and performs downloads requested through the extension.
  • Payment providers (such as Buy Me a Coffee or equivalent): we do not store your payment card or bank account details. All financial transactions are handled by those external providers under their own privacy and security policies.
  • Cloud AI providers (for example OpenAI, Anthropic, and ElevenLabs) are used only if you choose to enable them. They process data under their own privacy policies.
  • Local-first services (local AI, local TTS, local captioning) operate on your machine and are connected to remote services only when you explicitly select a remote provider.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

6. Data retention

  • Membership and account data is retained while needed to operate and protect the service or satisfy legal obligations.
  • Local operational logs are retained for a limited period, currently up to approximately one hour. Local settings, queues, and assets remain until automatically cleaned up, cleared by you, or removed when the extension is uninstalled.
  • Deletion requests: non-essential server-side records can be removed from systems we control after cancellation or on valid request, except where a retention obligation applies (security, fraud-prevention, legal, or dispute records).

Project files and generated media are stored locally under your direct control. Analytics data is retained according to the configured Google Analytics property settings.

7. User choices

  • Studio counting is off by default. Enable or disable Share privacy-limited Studio usage counts in Settings at any time. Turning it off stops future analytics transmissions and removes the isolated Google Analytics frame from the running Studio interface; account, entitlement, quota, security and explicit support requests continue as needed to provide and protect the service.
  • Sign out from the extension.
  • Clear extension data through Chrome or uninstall the extension to remove locally stored data.
  • Contact us to request access to or deletion of eligible server-side account data. Security, fraud-prevention, legal, and dispute records may be retained when reasonably necessary.

8. Security and international processing

Connections to Firebase, Google Analytics, and Google Flow use HTTPS/TLS. Firebase and Google may process information in countries other than your own. Administrative access to server-side records is limited to account management, support, security, and abuse-prevention needs. We do not use product data or analytics for personalized advertising.

9. Changes to this policy

We may update this policy as the extension or applicable requirements change. Material changes may also be communicated in the extension, Chrome Web Store listing, or release notes.

10. Contact

YouTube: https://www.youtube.com/@quiki.studio
Support: https://buymeacoffee.com/littleaiplanner

Some Google/Firebase authentication and membership state is used by the service to verify licensed access and manage workspace sync. That access is limited to what is necessary for the feature set you use.