Last updated: 2026-09-22 · Identity Praxis, Inc. · praxamark@identitypraxis.com
Praxamark™ is a browser extension that clips web pages and your notes into places you control: AI twins, Obsidian, Tinderbox, Zotero, reference files, shared folders, email and the clipboard. This statement says what it stores, what it reads, what it sends and to whom. It is written around the principles of self-sovereign identity, because Praxamark is built on them: your knowledge is yours, it lives where you put it, and nothing about you passes through anyone else’s hands on the way.
The short version: nothing leaves your computer until you press Post, and then it goes only where you told it to. The author receives nothing, ever.
The principles, and what each one means here
1. Existence. You exist independently of the tool. Praxamark has no account, no sign-up and no identity of its own for you. It does not know who you are. The one name it can carry is the contributor name you choose to type, and it carries it only into your own clips. The identifiers you may add under Settings → Identity & data (a DID, an ORCID iD, an ISNI, your Bluesky DID and Wikidata item, your organisation’s LEI, vLEI and ROR id) are yours, kept in your browser, and written into clips only when you tick Identifiers in clips; Praxamark sends them nowhere (IDENTITY.md).
2. Control. You are the authority over your data. Every clip, note, setting and key is stored in your browser’s own storage on your device, or in the destinations you configure. You can edit anything before it is posted, delete the history from the History page, and remove everything by uninstalling the extension. No copy exists anywhere else.
3. Access. You can always see what is held about you. Everything Praxamark keeps is readable in its own pages: Settings shows every setting and destination, History shows every post with the text that was sent, and the clip you are about to send is shown in full before you send it. There is no hidden store.
4. Transparency. The systems are open. This statement lists every store, every read and every connection. The extension makes no network connection to any host you have not approved through the browser’s own permission prompt, and its source is available to read.
5. Persistence. Your data lasts as long as you want it to. Clips live in your destinations, in plain formats (Markdown, YAML, RIS, BibTeX, Tinderbox notes), and stay there whatever happens to the extension. Praxamark keeps a post history for your review; you set how long, from none to everything.
6. Portability. Your data is not locked in. Every clip carries a structured header with your intention, status, tags, citation, provenance and a stable identifier, in plain text, so it can be moved, searched and cited from any tool. History exports as CSV. Nothing is stored in a format only this extension can read.
7. Interoperability. It works with what you already use. Praxamark posts to your existing destinations through their own open interfaces, on your own credentials, and adds nothing of its own between you and them.
8. Consent. Nothing happens without your agreement. A page is read only when you act on it. A connection to a host is made only after you have allowed that host. A post happens only when you press Post. Optional services (an AI provider, Wikidata, Wiktionary, Crossref, the Wayback Machine) are used only when you configure or press them.
9. Minimalization. Only what is needed, and no more. Praxamark reads the page you are on, not other tabs, cookies or browsing history. It sends a destination only the clip and the fields that destination needs. It collects no analytics, telemetry, usage statistics, crash reports or advertising identifiers.
10. Protection. Your rights come first. Keys are stored only in your browser, can be kept in memory only, are never written into clips, history or exports (except a settings backup you choose to make with keys, which says so), and are never forwarded to any host but the one they belong to. The on-page bar is isolated from the page’s own scripts. What leaves your machine is what you see, and it goes where you see it going.
1. What the extension stores, on your device
All of the following is kept in the extension’s storage inside your browser profile. None of it is synced to a Google account or sent to the author.
| Data | Purpose |
|---|---|
| Destinations: names, addresses, request formats, folder paths | To post |
| API keys for twins, Zotero, an Obsidian Local REST API vault and, optionally, an AI provider | To authenticate to that destination only. Kept on disk, or in memory only when Keys in memory only is on |
| A Solid pod sign-in: your WebID, your login server and storage addresses, and its tokens; a signing key made in this browser | To write to your pod. The key cannot be exported, even by Praxamark, so the tokens are useless off this browser. Sign out revokes the refresh token and forgets the sign-in |
| Preferences (statuses, item types, colours and their meanings, limits, switches) | Your configuration |
| Identity & data: your contributor name, DID, ORCID iD, ISNI, Bluesky DID, Wikidata item, other public pages, and the organisation you act for (name, LEI, vLEI identifiers, ROR, Wikidata, role) | Written into clips only when you tick Identifiers in clips; never sent by Praxamark itself |
| Whether this copy passed its signature check, for the browser session | The Genuine seal. The check reads the extension’s own files; nothing is sent |
| Recent intentions, tags and the last status | Suggestions and pre-fill |
| The clip in progress for each tab, until posted or the browser closes | So a clip survives the popup closing |
| Post history: time, destination, title, outcome and the posted text | Review, retry, and the “posted before” note. Capped at the number you set (50 by default; 0 keeps nothing) |
| A tally of counts per day (posts per destination, clips, statuses, intentions, tags, pages saved, clipped and removed from Saved) | The History page’s charts. Counts only: no titles, addresses or text |
| Saved: pages you kept to read and clip another time (address, title, site, date, citation, your note, a passage if selected, tags, project, reading time, the page’s description, and the page you came from: its site and path only) | The Saved list. Nothing is sent anywhere (Export writes a file you choose to keep; Import reads one you pick); a page leaves the list when you post a clip of it or remove it |
| Share log: what you said about a page through Share, and where | The Social shares page and the clip’s header |
| Contacts: the people you @mention in your own notes, To Dos and post notes (the handle, where it was first written, when last mentioned), what you fill in about them (name in parts, organisation, role, email, phone, LinkedIn and other network handles, ORCID, a note), notes and To Dos kept on them, and an index of the notes, To Dos and posts that name them | The @ suggestions as you write, the Contacts page, Share by email’s address and greeting, and the people in a post. A post carries the @handle as you typed it; its people’s details go only to the places Settings → Identity & data → Where posts go allows for their audience: by default your private ones (your vault, Tinderbox, your Personal AI, Zotero) get name, organisation, role, email, phone and network handles, and public ones (a public AI twin), email to others and the clipboard the handle only; you change what goes where. Praxamark sends nothing about them anywhere by itself. Export writes a file you choose to keep |
| The element registry: each term, person, entity, quote and statistic you kept, with the post it came from (title, address, date, project, tags) | History’s Elements page. Never sent anywhere |
| Email aliases, when you switch them on: each address you gave a site (the site, date, your intention and note, how it was made) and, for flags, the sending address and domain and the dates seen | The alias ledger and its flags. Nothing is sent anywhere; Export writes a file you choose to keep |
| The tracker log, unless you switch it off: for each clip you post, the trackers recognised in it (the site, the tracker and what it does, where it was, a tracking code’s name, and its value only for readable campaign tags) | Insights → Trackers → In your clips. Never sent anywhere |
| The tracker manager’s rules and, when you keep it, its record of trackers met while browsing: per day, the site’s name, the tracker, blocked or seen, and how many times; never pages or addresses. Off until you switch it on | Blocking (Chrome applies the rules; Praxamark never sees the requests) and Insights → Trackers → While browsing. Never sent anywhere |
| My Browsing, when you switch it on: each web page’s address (without its query or tracking codes), title, first and last visit, number of visits and time in front; never incognito, never Praxamark’s own pages, never a site on your Never list; kept as long as you chose (30, 90 or 365 days, or forever) | Insights → Browsing; an export or a send to a private place, only when you press it, and never with a site on your Private list |
| My Digital Exhaust, when you switch it on and press Keep receipt: the site, the date, the kinds of field you gave and (unless you switch values off) what you typed, never a password, username, card, bank or ID number, and never your signature (only that you signed; the drawing is not copied, kept or sent): of a card or bank account only its last four, of an ID number only a salted fingerprint, both worked out on the page (a PIN, a security answer or a one-time code typed into an ordinary text box can be kept as an “other answer”; untick it on the card); the terms and policies you agreed to, with a dated text copy of each and its SHA-256; an AI reading of a policy if you ask for one; field labels learned for naming | The My Digital Exhaust page and its charts, and the weekly look at the policies. Nothing about you is sent anywhere; Export writes a file you choose to keep |
| Folder grants, one per folder you chose through the browser’s own picker | Writing clips into that folder. Read-write for that folder only; the extension never reads existing files |
2. What the extension reads from pages
Only from the tab you are on, and only when you act, using the browser’s per-click permission: the page title and metadata (Open Graph, Dublin Core, Google Scholar citation tags, description, keywords, language), the canonical address, your selection, the article’s main text when you ask for it, the images on the page when you open the Images view, a video’s position and the transcript panel when you use them, and text inside embedded frames when you have allowed that frame’s site. Nothing from other tabs, cookies or browsing history. Everything read is shown before it is posted and can be edited or removed. Text in form fields is never captured or highlighted.
Before anything is posted, and before page text goes to a cloud AI provider, the extension checks it on your device for
sensitive data (passwords, API keys, private keys, card numbers, IBANs, Social Security and National Insurance numbers,
and whatever you or your organisation add) and replaces what it finds with [redacted: …] unless you choose to keep it.
Nothing is sent anywhere for this check. History records how many items were masked or kept and of which kind, never
the data itself.
Email aliases are the exception, and only when you switch them on (Settings → Configuration → Email aliases, which asks Chrome for access to all sites). A small script then runs on every page to find sign-up forms: it looks at the form you are in (its fields, button and heading) and, when you send one, the address you gave it, which it offers to record. It reads nothing else on the page, stays on your device, and does not run on webmail pages (Gmail, Outlook, Fastmail, iCloud, Proton, Yahoo). Praxamark never opens or reads your mail.
Trackers on each page, only when you choose it (Settings → Trackers): a small script on each page reads the page’s list of what it loaded (addresses only, never the page itself) and matches the host names, on this computer, to the trackers Praxamark knows. Only the count is kept, for that tab’s badge, until the tab moves on.
The tracker manager is the other exception, and only when you switch it on (Settings → Trackers → Tracker manager, which asks Chrome for access to all sites, and, for its record, for Chrome’s report of which rules matched). Chrome itself blocks or lets through requests to known trackers by rules Praxamark gives it; Praxamark reads no page and sees no request. For the record, Chrome tells Praxamark which rule matched, in which tab and when, and Praxamark notes each tab’s site name as it changes; what is kept is per day, the site’s name, the tracker and a count. It never leaves this computer, and Clear the browsing record empties it. My Digital Exhaust is the same, and only when you switch it on. Its script looks at a form only when you send it, and only at that form and the agreement text beside it. A password, username, card, bank or ID number never leaves the page. Nothing is kept until you press Keep receipt on the card it shows, unless you chose in Settings to keep receipts without being asked (then a note says so, with Undo, or nothing does if you chose quietly). In a copy your organisation manages, the organisation cannot switch it on, change its settings or see what it keeps, and an AI provider the organisation chose is never used for it.
3. What the extension sends, and to whom
| When | What | To |
|---|---|---|
| You press Post to an AI twin or HTTP endpoint | The title, the clip (header, note, captured text), a source tag and the clip’s identifier | That host, over HTTPS, with its own key. A redirect is refused, so a key is never forwarded elsewhere |
| You post to an Obsidian vault by its Local REST API | The note and the element notes, as Markdown | The plugin on this computer (127.0.0.1). No network |
| You post to a vault or shared folder through the helper | The same, as files, written into the folder you allowed (the Helper asks you once per folder) | Your disk. No network |
| You share to a public network with Sign what I share on (off unless you switch it on) | The words you share, the page’s address and title, the network, the time, your DID and name, signed | Your identity folder, through the helper, then your own site by your own git push (GitHub Pages or the like). Public, like the post. The signing key never leaves this browser |
| You post to Tinderbox | The clip and its element notes | Tinderbox on this Mac, through the helper. No network |
| You post with To Dos to Reminders on (Mac, off unless you switch it on) | Each To Do in the clip, with the passage it was on and the page’s title and address | Apple Reminders on this Mac, through the helper, after macOS has asked you once. No network from Praxamark; Reminders syncs through your iCloud if you use it |
| You post to Zotero | A bibliographic item and two notes | api.zotero.org, over HTTPS, with your Zotero key |
| You connect Your CRM (Twenty), then press Find in Twenty… in Contacts, or tick Add to my CRM for a person (off unless you connect one) | Your key, as a bearer; a check of what the workspace has; for each of your contacts, one search by their email, LinkedIn profile or name; and, for a person you tick, their name, email, LinkedIn, role, organisation (linked to a company already there), phone and @handle: a new person, or only what is empty on the one found. Nothing is overwritten, deleted or merged, and only the people matching yours are read | The Twenty you own, at the address you typed (https, or this computer), allowed by Chrome for that address alone. A redirect is refused. What comes back is shown to you and kept only if you tick it |
| You right-click a picture, choose Use as a person’s picture… and press Keep the picture | Nothing leaves: the picture is read from its address (from the site that serves it, as the page already did), made small and kept with the contact you chose. With the separate Also send it to my Twenty tick (off each time, shown only when Your CRM is connected): the picture’s web address, and, if they are not yet in your Twenty, the person as for Add to my CRM | This computer. With the tick: the Twenty you own, as above; Twenty is given the address only when it has no picture for them |
| You press Look up… on a contact, then a place to look | Apple Contacts (on a Mac, through the Helper): their email address or name, to your own address book, on this Mac only; Bluesky: their handle or name; Wikidata: their name; Gravatar: a scrambled form of their email address (its SHA-256 hash), never the address; Check email: their email’s domain only | Your Mac’s Contacts (read only; macOS asks once); public.api.bsky.app; wikidata.org and commons.wikimedia.org; api.gravatar.com and gravatar.com; cloudflare-dns.com. What comes back is shown to you and kept only if you tick it; a picture is kept small, on this computer |
| You press Create and fill in an email alias menu, with Fastmail, addy.io or SimpleLogin chosen (off unless you choose one) | A request for one new address, with the site and, as its description, why you signed up and your note | api.fastmail.com, app.addy.io or app.simplelogin.io, over HTTPS, with your token, under that service’s terms. Check the token sends only the token |
| You keep a receipt that agreed to terms or a policy, and once a week after (My Digital Exhaust, off unless you switch it on) | A plain request for each policy page, with no cookies | The site that published the policy: a public web site, or the sign-up’s own site; never this computer or a private network (an address that leads there is not kept). Nothing about you is sent |
| You press Back up now or Archive, or the weekly backup runs (My Digital Exhaust, off unless you set a backup passphrase and tick it) | Your receipts, policy copies and alias ledger, encrypted so only your backup passphrase opens them | A file in your Downloads folder (Praxamark Backups). Nothing is sent over the network; where the file goes from there is up to your own backup tools |
| You press Read it for me on a policy, or switch on AI read or Naming fields (all off unless you choose) | The policy’s public text; for naming, field labels only (“Your DOB”), never what you typed | The AI provider you chose in Configuration → AI; a local model (Ollama, LM Studio) keeps it on this computer |
| You post to a Solid pod | The clip as Markdown and, unless switched off, the same facts as linked data (Turtle) naming your WebID as creator | Your pod, over HTTPS, signed by your login server’s token and this browser’s key. Your password is typed only on your login server’s own page |
| You post to a reference file | An RIS or BibTeX file | Your Downloads folder |
| You post to Email | The clip as a new message | Your own mail client, through a mailto link. The extension sends nothing |
| You post to the Clipboard, or press Copy | The clip or passage | Your clipboard, through the extension’s own page, not the web page’s |
| You post with images ticked | A download of each ticked image | The image’s own host, then your disk |
| You ask a question about a page (the Ask AI tab) | Your question, the page’s text, title and address, and the thread’s earlier questions and answers | The AI chosen for questions or picked beside the question. The tab shows where each question goes; a public AI gets a notice first, and a thread can be kept on this computer. The thread is kept with the page’s clip on this computer and is not posted |
| You ask for an AI summary or definition | The page’s text, title and address, or the selected word and its sentence | The provider you configured for that job (your main AI, or another you added under Settings → Configuration → AI → More AIs, or picked beside Summarise): a local model on this computer, or Anthropic or an OpenAI-compatible service with your key, under their terms. Before a summary goes to a public AI, the Summary tab says so and offers an AI on this computer. Masking removes known sensitive data, not what the page is about |
| You press Define with no AI provider set | The selected word | en.wiktionary.org, after you allow it once |
| You press Look up | An entity’s name, then one item fetch | www.wikidata.org, after you allow it once |
| You press Find beside Bluesky (Identity & data) | Your Bluesky handle | public.api.bsky.app, Bluesky’s public directory, which answers with the DID behind it (no key, no cookies) |
| You open a PDF in Praxamark’s reader | A download of the PDF, with your session on its site; then the PDF’s DOI, when it has one | The PDF’s own site, after you allow it once; api.crossref.org, for the citation (the DOI alone, no key, no cookies) |
| You post, with Settings → Configuration → Behaviour → Save to the Wayback Machine on (off by default) | The page’s address, to ask the Wayback Machine to save a public copy; never a page on this computer or a private network, or an address Sensitive data masked | web.archive.org, allowed when you turn it on (no key, no cookies). The copy is public, in the Internet Archive |
| You press Check Wayback, under an undated page’s citation | The page’s address, to ask when the Wayback Machine first saved it | web.archive.org, after you allow it once (no key, no cookies) |
| You choose a network under Share | Nothing from the extension. It opens that network’s compose page in your browser with your text in the address | The network, in your own session, under its terms |
| You press Report on the bar or the Feedback page | Nothing from the extension. It opens a GitHub issue form in your browser with the extension’s version, your browser’s name and the page address in the form’s address; you decide what to submit | GitHub, in your own session, under its terms |
| You press Feedback → email | Nothing. Your mail client opens with an addressed message you can edit or discard | Your mail client |
| A sound theme is on (Settings → Configuration → Sounds; off unless you choose one) | A short phrase, with your name or nickname now and then | This computer’s own voices (the tts permission). A voice marked remote, which would send the words to a server, is never used. No network |
No other connection is made.
4. What is not collected
No analytics, telemetry, usage statistics, crash reports, advertising identifiers or remote code. The author receives no data from the extension, at any time, for any reason. There is no server behind it.
5. Third parties
Data reaches only the destinations and services you configure, on your credentials, and their privacy policies govern it from there: your twin provider, Zotero, an AI provider you choose, Wikidata, Wiktionary, the Wayback Machine, a social network or GitHub when you open them. The browser’s on-device summariser, when used, runs entirely on your device.
6. Children
Praxamark is a general-purpose tool, not directed at children, and collects no personal data on its own.
7. Enterprise and branded copies
A company’s branded copy may carry team defaults and destinations set by its administrator through the browser’s managed policy. Such settings are shown in Settings, marked as set by policy. The statement above applies to a branded copy in full: it, too, sends nothing to Identity Praxis, Inc.
8. Changes
Changes to this statement are listed in the changelog with the version they apply to.
9. Contact
Identity Praxis, Inc. · Dr. Michael J. Becker · praxamark@identitypraxis.com · www.identitypraxis.com