Privacy Policy & Zero-Telemetry Charter

Chameleon Labs (“Chameleon”, “we”, “us”, or “our”) is committed to uncompromising user privacy. This Privacy Policy outlines our technical architecture, data handling philosophies, and operational commitments regarding the Chameleon desktop client application and this website.

Unlike typical cloud utilities, Chameleon operates on an air-gapped, local-first architecture. The client binary executes entirely within your workstation's local memory space and does not establish background telemetry connections to our servers.

To eliminate privacy ambiguity, Chameleon does NOT collect, record, log, monitor, or transmit any of the following categories of data:

• Browsing & URL Activity: We do not log web addresses, browsing history, cookies, bookmarks, or web session cache from your Chameleon window.
• Screen Captures & OCR Data: Screen snips captured via shortcut or trigger remain in local device memory (RAM). We operate zero servers that store or analyze your screen images.
• Keystrokes & Clipboard Data: KeyPaste synthesizes OS-level virtual key events locally. No text from your clipboard, keystroke timings, or typing buffers are ever recorded or uploaded.
• Audio & Microphone Feeds: Chameleon does not intercept, record, stream, or monitor your microphone or speaker audio feeds.
• Personal Identifiers: The desktop application does not harvest your computer's MAC address, IP address, serial numbers, user account names, or connected hardware lists.

The window invisibility technology utilized by Chameleon operates exclusively at the local operating system compositor level. On macOS, Chameleon configures Apple Quartz Window Server window-sharing properties (CGWindowSharingNone). On Windows, it invokes Desktop Window Manager SetWindowDisplayAffinity APIs.

Both mechanisms instruct your computer's local graphics subsystem to exclude Chameleon from capture surfaces. This operation occurs entirely inside your graphics pipeline with zero network overhead, zero cloud communication, and zero third-party data exchange.

Chameleon provides an optional, user-initiated AI assistance interface. When you configure API keys for OpenAI (ChatGPT), Google (Gemini), Anthropic (Claude), xAI (Grok), or DeepSeek, requests are dispatched directly from your device to the chosen AI provider's official API endpoint.

Key architectural protections for AI requests include:

• No Chameleon Middleware Proxy: Your API requests and screen images do NOT route through Chameleon servers. They travel over encrypted HTTPS directly to the AI provider.
• Local API Key Storage: Your personal API keys are encrypted and stored locally in your operating system secure keychain or local app configuration. They are never transmitted to us.
• Third-Party Privacy Policies: Your interaction with third-party AI models is governed directly by each provider's individual privacy policy and enterprise data agreements.

To verify software authenticity, Chameleon connects periodically to our static update manifest. This query transmits only a cryptographic software hash, application version, and license token. No machine identifiers, personal credentials, or usage patterns are attached.

Software update checks download static release packages over secure TLS (HTTPS). You retain full autonomy over when updates are downloaded and installed.

Software licenses and recurring subscriptions are processed by our Merchant of Record and online reseller, Paddle.com. Chameleon does NOT collect, process, or store credit card numbers, CVVs, bank account information, or billing street addresses on its servers. All payment transactions and customer billing data are handled directly and securely by Paddle.com in accordance with strict PCI-DSS Level 1 security standards.

Paddle provides us only with non-sensitive transactional receipts and webhooks (e.g. Paddle Order ID, subscription status, license tier, and customer email address for license authentication and cryptographic entitlement verification).

Our marketing website (chameleon-browser.com) may use standard privacy-respecting analytics (such as Google Analytics with IP anonymization) to measure aggregate website traffic, page visits, and referral channels.

Website analytics apply exclusively to visitors browsing our public web pages and are completely independent of the Chameleon desktop application. The desktop application contains zero Google Analytics or web tracking beacons.

Because Chameleon operates on a zero-knowledge architecture and does not maintain databases of end-user activity, screen captures, or telemetry logs, we store minimal personal data.

For European Economic Area (GDPR) and California Consumer Privacy Act (CCPA) residents, you have the right to request disclosure, rectification, or deletion of any billing or support communications associated with your email address.

We do not sell, rent, or trade user data to third parties, data brokers, or advertising networks under any circumstances.

Chameleon is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us immediately so we can promptly delete such data.

All local temporary files created by Chameleon (such as ephemeral screen snips) are written to protected volatile RAM cache and are scrubbed immediately after dispatch or window closure.

Local settings and session state are protected by your operating system's native user-space file permissions and sandboxing constraints.

We may update this Privacy Policy from time to time to reflect operational or technological developments. Changes become effective upon publication to this page.

If you have questions, concerns, or data requests regarding this Privacy Policy or our architectural zero-knowledge design, please contact our privacy compliance team at:
[email protected]