Privacy Policy

litmus is local-first and bring-your-own-key. It has no servers of its own.

Last updated: June 2026

The short version

litmus runs entirely inside your browser. Anthropic/the extension author does not operate any server that receives your prompts, API keys, results, or usage. The only network requests litmus makes are directly from your browser to the model provider you choose, in order to run the tests you ask for.

What is stored, and where

• API keys — saved in your browser's extension storage (chrome.storage.local) on your device. They are used only to authenticate calls to the matching provider and are never transmitted anywhere else.
• Prompts, eval rubrics, test cases, and run history — kept locally in the browser (extension storage / IndexedDB) so your versions persist between sessions.
• Settings — your default model, judge model, pass threshold, and spend cap, stored locally.

None of this is sent to litmus or to any third party other than the model provider during a run.

What leaves your browser

When you run an analysis, generate cases, run a test, or apply fixes, litmus sends the relevant content (your system prompt and the case inputs/outputs) to the provider you selected, using your key:

• OpenAI — api.openai.com
• Anthropic — api.anthropic.com
• Google — generativelanguage.googleapis.com

That data is handled under that provider's own privacy and data-use policies. Please review the policy of whichever provider you use. litmus does not add itself as an intermediary.

What litmus does NOT do

• No analytics, telemetry, or usage tracking.
• No advertising, and no selling or sharing of your data.
• No account, sign-in, or cloud sync.
• No background data collection — requests are made only when you take an action.

Permissions

The extension requests only what it needs to function: sidePanel (to show its UI), storage (to keep keys, settings, and version history locally), and activeTab / scripting (to let you grab a prompt from the current page when you click "Grab from this tab"). Host access is limited to the three provider API domains listed above.

Deleting your data

Use Delete all keys in Settings to remove stored API keys. Removing the extension from your browser clears all locally stored litmus data, including version history.

Changes

If this policy changes, the "Last updated" date above will change with it.