Open-source Chrome extension that estimates, on request, how likely a Reddit post is to be promotional. Not affiliated with Reddit.
Version 0.3, 10 September 2026. Published at https://phidesign.github.io/promolens/privacy. This policy will be updated before any change to what is collected.
In one sentence: PromoLens reads only the Reddit post you click on (and that author’s public posts); that one post is sent to the PromoLens service (or, if you choose, to OpenAI with your own key) identified only by an anonymous install id, and nothing else leaves your browser.
Only for a post you chose to analyse, from the post page you are viewing:
Additionally:
The extension requests the storage permission and host access to https://www.reddit.com/* (needed for the author-history request) and https://promolens-api.amaturos.workers.dev/* (the PromoLens service); it runs only on https://www.reddit.com/*. Access to https://api.openai.com/* is optional and requested only when you save your own key.
Before you click: no. Results are cached inside Chrome’s extension storage on your device.
When you click the button: the background worker sends the fields listed above for that one post, plus the locally detected signals and a content hash, to the option you selected: Included analyses (the PromoLens service, see below), Use my own OpenAI API key (directly to OpenAI), or a local API server you run (developers). Nothing is sent for posts you do not click.
When Deeper analysis uses Included analyses, the post you clicked (title, body, up to 20 visible comments, the author-history summary and the rule signals) is sent to the PromoLens service, which forwards it to a language-model provider (OpenAI) and returns quoted evidence. To count analyses, the extension sends an anonymous install id - a random identifier created once on install. It is not linked to your name, email, Reddit account or IP beyond the request itself; reinstalling creates a new one. The service keeps: the install id, how many analyses were used this month, and - for Plus - the licence key you activated. It does not store post text (results are cached in memory for 24 hours, keyed by a hash), does not log post text, and does not sell or train on anything.
PromoLens Plus is sold through Lemon Squeezy, which handles payment, invoices and your email; PromoLens never sees your card details. To stop the service from holding anything about your install, remove the licence in the popup (this deletes the binding) and uninstall the extension; the monthly counter for an install id is dropped after two months of inactivity.
If you choose Use my own OpenAI API key in the popup, the extension itself sends the post you clicked (title, body, up to 20 visible comments, the author-history summary and the rule signals) to api.openai.com using your key, and receives quoted evidence back. Chrome asks you once for permission to contact that address; nothing is sent before you save a key.
Your key is stored in this extension’s storage on your device, is never sent anywhere except in the request to OpenAI, and can be removed by clearing the field or removing the extension. Usage is billed to your OpenAI account. OpenAI’s own policies apply to what they receive; by default OpenAI does not train on API traffic. PromoLens has no server in this path and sees nothing.
When the local API is started with ANALYSIS_PROVIDER=openai, each analysed post is also sent from your local API server to the configured model endpoint (by default OpenAI’s). This only happens if you (1) run the API yourself, (2) put a key in apps/api/.env, (3) switch on Deeper analysis in the extension popup, and (4) click the button on a post.
What is sent to the model: the subreddit name, the post title, up to 6,000 characters of the visible post body, up to ten visible links, the list of rule signals already detected, and the compact author-history summary (titles, subreddits, domains, short excerpts, dates of the author’s recent public posts and comments). No votes, no browsing history, nothing about you. Up to 20 visible top-level comments (300 characters each, with the post author’s replies marked) are included so the model can weigh what the thread says.
What comes back: criterion IDs with short verbatim quotes. The model never returns a score; the rule engine computes it. Quotes that do not appear in the post are discarded, so the model cannot invent evidence.
The provider’s own retention and training policies apply to what it receives; check them before enabling. PromoLens itself does not store the post text on the server (only the hashed result, for the cache TTL) and never logs it unless LOG_RAW_CONTENT=true is set for local debugging.
The extension never contains or receives the API key.
When you click “analyse” on a post, the extension also reads the author’s recent public submissions and comments and their public account age/karma - the same pages anyone can open at reddit.com/user/<name> - using your own browser session. It keeps a compact summary (subreddit, title, outbound domain, a short excerpt, date) of up to 40 posts and 40 comments, uses it to check whether the same product recurs, and holds that summary in the extension’s worker memory only for up to 6 hours per author - it is never written to disk, and it disappears when the browser or the extension’s background worker stops. Evidence taken from another post is shown with the username and a link back to that post. If deeper analysis is on, the titles/excerpts summary is included in what goes to your local API and the model provider.
It does not read private messages, saved items, hidden or removed content, or anything not publicly visible. It never fetches a profile for a post you did not click, and never fetches profiles of commenters. Switch the toggle off in the popup to stop it; the engine then reports “author history not checked” and keeps confidence lower.
Official API option. When the extension is built with a registered Reddit app id, the popup offers Log in with Reddit. Logging in (read-only scopes: identity, read, history) makes these reads go through Reddit’s Data API with your own account’s token instead of the page session; PromoLens never posts, votes, or changes anything on your account. Tokens are stored in the extension’s storage on your device and are revoked at Reddit and deleted when you log out. Until Reddit has approved PromoLens’s Data API access, the login option is hidden and the extension reads public pages with your browser session, as described above; see docs/reddit-compliance.md.
Clicking the button on a feed card fetches that one post’s public content (title, body, links, top comments) in the background so it can be scored with the same data as on the post page - the same page you would get by opening the post, read through Reddit’s public JSON listing with your own session. It is kept in the worker’s memory for 10 minutes and otherwise treated exactly like a post you opened. Nothing is fetched for cards you do not click. Switch Also show it on feed cards off in the popup to remove the buttons from feeds.
settings.cacheTtlHours). Expired entries are removed automatically. You can delete everything at any time with Clear cached results in the toolbar popup, or by removing the extension.CACHE_TTL_HOURS (24 h default), and disappear when the process stops. Request logs record method, path, status and duration - never post text - unless you deliberately set LOG_RAW_CONTENT=true while debugging.There is no automatic scanning. To remove the button entirely, click the PromoLens toolbar icon and switch off Show PromoLens on post pages. You can also disable or remove the extension from chrome://extensions.
The PromoLens service stores, per anonymous install id: the monthly analysis count and, for Plus, the licence key you activated. Nothing else, and no post text. To delete it: remove the licence in the popup (this deletes the binding immediately) and uninstall the extension; the counter for an install id that has not been seen for two months is deleted automatically. You can also ask for immediate deletion by opening an issue at https://github.com/PhiDesign/promolens/issues; reinstalling the extension creates a new install id, and the old one is deleted after two months of inactivity.
If an AI provider is added later, its API key lives only in apps/api/.env on the server. It is never bundled into the extension and never sent to the browser. .env files are excluded from Git by .gitignore.