Browser extension

Privacy Policy

Effective: August 5, 2026  |  Last updated: August 5, 2026

Believe keeps frequently visited sites, custom shortcuts, preferences, and cached affirmations inside the browser. It does not send browsing history, shortcuts, search queries, or mood entries to Heart It Out. If a user chooses account sign-in, the Extension sends the phone number and OTP to Heart It Out for authentication and uses Heart It Out account cookies to recognize the signed-in session.

This Privacy Policy explains how Heart It Out Pvt. Ltd. ("Heart It Out," "we," "us," or "our") handles information when you use the Believe by Heart It Out browser extension ("Believe" or the "Extension"). It applies to Believe as distributed through browser-extension stores. When Believe opens a Heart It Out webpage, including the wellbeing dashboard, mood tracker, moodboard, diagnostic, or account pages, information handled on that webpage is also governed by the Heart It Out website privacy policy.

1. What Believe does

Believe replaces the browser's new-tab page with affirmations, Google search, shortcuts, appearance controls, and links to Heart It Out's server-hosted wellbeing tools. Believe can be used without signing in. Users who choose to sign in can use phone-number and one-time-password (OTP) authentication to connect their Heart It Out account.

Believe does not record or store mood entries, mood notes, tags, mood history, mood charts, or mood insights inside the Extension. Those features operate on Heart It Out's servers after the user opens the relevant Heart It Out webpage.

2. Information handled by Believe

Affirmations and quotes

Believe requests a rotating set of affirmations or quotes from the Heart It Out API. The returned content and the time of the latest update are cached in the browser's local extension storage and normally refreshed once per hour. This allows Believe to display varied content and continue working when the user is offline.

Believe does not send top-site history, custom shortcuts, search queries, or mood information with an affirmation request. Like other internet requests, the Heart It Out server may receive standard network and request information such as IP address, request time, and browser or protocol information for delivery, reliability, and security.

Optional account sign-in and OTP verification

If a user chooses to sign in or create an account, Believe handles:

• country code and phone number;
• the OTP entered by the user;
• a temporary verification token returned by the login service;
• login-security information supplied by the Heart It Out login page, such as a CSRF token, page URL, and IP-address field; and
• the Heart It Out authentication response and account-session cookies.

This information is sent to Heart It Out only to send and verify the OTP, establish the requested session, prevent abuse, and provide account-based wellbeing tools. The OTP and temporary verification token are kept in memory only for the authentication flow and are not written to the Extension's local storage.

After successful authentication, Believe may read the hio-dashboard cookie on heartitout.in. That cookie may provide an account identifier, name, email address, and phone number. Believe stores a minimal account summary locally so it can show the signed-in state and open the appropriate Heart It Out page. If the account cookie is not immediately available, Believe may store the verified phone number as the local account display state.

Believe also creates an extension-specific login_id_believe cookie on heartitout.in, containing the Heart It Out account identifier, for up to 30 days. It associates the Extension's session with the correct Heart It Out account. Believe does not read cookies from unrelated websites.

Most-visited sites and favicons

With the browser's Top Sites permission, Believe retrieves the titles and URLs of frequently visited sites to display shortcuts on the new-tab page. This information is processed inside Believe for the current interface. It is not sent to Heart It Out or any third party by Believe and is not saved by Believe as a separate browsing-history database.

With the browser's favicon capability, Believe asks the browser for cached site icons so shortcuts are recognizable. Believe does not use an external favicon-tracking service. The browser may manage its own favicon cache under the browser provider's policies.

Custom shortcuts, preferences, and local state

Believe stores user-created shortcut names and URLs in local extension storage. It also stores appearance preferences, onboarding completion, guest-mode status, the cached affirmation set, the last quote-update time, and the minimal account display state described above. This information is used only to provide and remember Extension features. Custom shortcuts and preferences are not transmitted to Heart It Out.

Google search and external links

When a user submits a search from the new-tab page, the query is sent directly to Google Search. Believe does not store the query or send it to Heart It Out. Links to Gmail, Drive, Sheets, Docs, Meet, Calendar, Heart It Out, and user-created shortcut destinations navigate to the selected service. Those services may receive normal web-request information and handle information under their own privacy policies.

Mood tracker, moodboard, diagnostic, and dashboard

Believe opens Heart It Out's hosted dashboard, mood tracker, moodboard, and wellbeing diagnostic. Believe itself does not read or store entries made on those pages. Information submitted to those webpages, including mood or wellbeing information, is handled by Heart It Out's web services and is subject to the Heart It Out website privacy policy and applicable account controls.

Voluntary uninstall survey

After Believe is uninstalled, the browser may open a voluntary Google Forms survey. Believe does not automatically submit survey responses. Information the user chooses to enter is provided to Heart It Out through Google Forms and is subject to the notices shown with the survey and Google's applicable privacy terms.

3. Why we handle information

We handle information as necessary to:

• provide the new-tab, shortcut, appearance, offline affirmation, and account features requested by the user;
• authenticate users and maintain the Heart It Out session they request;
• direct signed-in and guest users to the appropriate wellbeing pages;
• maintain the security, integrity, reliability, and availability of our APIs and authentication services;
• comply with applicable legal obligations; and
• obtain consent where applicable law requires it.

4. Browser permissions

Believe requests only the browser permissions needed for its current features:

• Alarms: refreshes the cached affirmation set approximately once per hour.
• Storage: keeps cached affirmations, update time, preferences, onboarding status, custom shortcuts, guest status, and minimal account display state locally.
• Cookies: reads the Heart It Out authentication cookie and manages the extension-specific Heart It Out account cookie. It does not access unrelated-site cookies.
• Top Sites: displays frequently visited sites as new-tab shortcuts.
• Favicon: displays browser-cached icons for shortcut sites without using a remote favicon service.
• Access to https://heartitout.in/*: retrieves affirmations, loads the Heart It Out login context, sends and verifies OTPs, and accesses the Heart It Out account session required by Believe.

5. Sharing and service providers

We do not sell information handled by Believe, use it for targeted advertising, or transmit a user's top sites, custom shortcuts, appearance preference, or search queries to Heart It Out.

Information may be processed by service providers that support Heart It Out's hosting, security, communications, and OTP delivery, solely to provide those services. If a user chooses Google Search, a Google service link, or the uninstall survey, information is provided directly to Google under Google's policies. We may also disclose information when required by law, to protect users or our services, or in connection with a lawful business reorganization, subject to applicable safeguards.

6. Retention

• Cached affirmations remain in local extension storage until replaced, browser storage is cleared, or Believe is uninstalled.
• Preferences, onboarding status, guest status, and custom shortcuts remain until changed, browser storage is cleared, or Believe is uninstalled.
• The local account summary remains until the user signs out, clears Believe's data, or uninstalls Believe.
• The login_id_believe cookie is configured to expire after up to 30 days and is removed when the user signs out through Believe.
• OTP values and temporary verification tokens are not stored in local extension storage.
• Heart It Out server logs, account records, OTP-delivery records, and information entered on Heart It Out webpages are retained according to Heart It Out's server-side policies, operational needs, and legal obligations.

7. User choices and controls

Users can use Believe without an account. Users can also:

• sign out or use a different Heart It Out account from Believe;
• add or replace custom shortcuts;
• change light and dark appearance preferences;
• clear Believe's stored data through the browser's extension or site-data controls; or
• uninstall Believe, which removes the Extension and its browser-managed local extension storage.

Depending on applicable law, users may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent for personal information held by Heart It Out. Requests can be made using the contact information below. We may need to verify a request before acting on it.

8. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information handled by Believe and Heart It Out's services. Internet transmission and electronic storage cannot be guaranteed to be completely secure. Users should protect access to their device, browser profile, and phone because a person with access to them may be able to view locally stored Extension information or account sessions.

9. International processing

Heart It Out and its service providers may process information in India and other countries where they operate. Where required, we use appropriate safeguards for transfers of personal information across jurisdictions.

10. Changes to this policy

We may update this Privacy Policy when Believe's features, data practices, legal requirements, or service providers change. The updated policy will display a revised "Last updated" date. If a material change requires additional notice or consent, we will provide it as required by applicable law or browser-store policy.

11. Contact us

For privacy questions or requests concerning Believe, contact: