To use these add-ons, you'll need to download Firefox.

Log in
Add-on icon

Privacy policy for LeXpand

LeXpand by JAG AI

0 Stars out of 5
5
0
4
0
3
0
2
0
1
0
Privacy policy for LeXpand

Last Updated: October 13, 2026

LeXpand ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how your data is used in relation to using the LeXpand browser extension.



LeXpand is designed with a local-first philosophy. Your snippets, folders, settings, local recovery snapshot, and optional OAuth session token are stored on your device using the browser's storage API. We (the developers) do not have access to your snippets, shortcuts, or expansion history. Your data remains yours.


To detect your shortcuts, LeXpand runs on normal http and https web pages and examines text as you type in supported editable fields. Matching and expansion happen locally in the extension. Password fields are excluded from expansion and are not inspected for shortcut matching.


We do not collect or store your personal information.
- Account Identity: When you use the optional Google Drive Sync feature, the extension requests your Google Account email address solely to display your connection status (for example, "Connected: user@gmail.com") and to identify the connected Google account.
- No Developer Collection: This email address is retrieved from Google and displayed locally in the extension. It is never sent to our servers.


If you enable the Google Drive Sync feature, the extension will request access to your Google Drive appData folder.
- What we access: We only access the private appData folder specifically created for LeXpand. We do not have access to your personal files, documents, or photos in your general Google Drive.
- Why we access it: To sync your snippets privately across your own devices.
- Data Storage: Your synced data stays within your own Google account. No snippet data is sent to our servers.

On Firefox, optional data transmission consent is requested when you turn on Drive Sync, before Google authorization starts. The declared categories cover authentication information, account identity, snippet content, and usage metadata included in synced snippets. Declining consent leaves local text expansion available. If you revoke that consent in Firefox's add-on settings, subsequent Drive authentication and synchronization attempts are blocked, including when a token was previously cached.


If you turn on Auto Backup, the extension requests the optional downloads permission at that time. When enabled, it writes a JSON backup of your folders and snippets to Downloads/LeXpand/lexpand-backup.json. Normal manual exports use a browser download initiated by your click and do not require this optional permission.


When using Google Drive Sync, the extension uses the chrome.identity API to authenticate with Google. We only use this information to facilitate the sync process. We do not store or collect your email address or profile information on our own servers. Again, we don't even have servers.

  • Storage: Used to save snippets, folders, settings, recovery metadata, and optional Drive authentication state on your device.
  • clipboardRead: Used ONLY when a snippet specifically contains a {clipboard} placeholder, to allow the extension to insert your clipboard content into the expansion.
  • Identity: Used to authenticate with Google for the optional Drive Sync feature.
  • Alarms: Used to trigger periodic background syncs (every 30 minutes) if Sync is enabled.
  • Side Panel / Sidebar: Used to display the LeXpand dashboard beside the page where you are writing. Firefox provides a sidebar declaration and a separate options dashboard.
  • Downloads (optional): Requested only when you turn on Auto Backup and used only to write the automatic JSON backup file.
  • Web Page Access: Used to detect and expand your shortcuts in editable fields on normal web pages, including supported rich-text editor frames.


We do not sell or trade your data. Local text expansion does not send your snippets or browsing activity to developer-operated servers. If you enable and authorize optional Drive Sync, LeXpand sends snippet records, folders, deletion metadata, and sync timestamps to Google for storage in your private Google Drive appData folder. Synced snippet records can include their usage count and last-used timestamp. Google authentication sends the OAuth request and authorization token to Google's services, and retrieves the connected-account information for local display. Your browser's normal network requests to Google also expose connection information such as your IP address to Google.

Rich snippet content or pasted HTML can contain third-party resource URLs, such as remote images. Your browser can request those resources when the content is displayed or parsed, and the resource host receives the usual connection information. HTML sanitization removes unsafe scripts and event handlers; it does not promise to prevent all resource requests.


We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.


If you have any questions about this Privacy Policy, please contact us at: developer@jagai.cc or jag-a-i on Github.