Last updated: 1 September 2026
Popup Dictionary is a browser extension run by one individual — Lê Văn Thiện, trading as Epitchi, in Vietnam — who is the data controller for everything described here. There is no company, no advertising, no analytics and no tracking of your browsing. Nothing here is sold to anyone, ever.
The free extension needs no account and stores nothing about you on any server we run. Buying Premium is the only thing that creates a record, and this policy says exactly what that record is, where it lives and how to have it deleted.
Only the text you deliberately select and look up. Your browsing activity, the contents of pages and every page you never look a word up on are never transmitted.
With the settings the extension ships with, nothing is sent until you click the lookup button or press the shortcut — simply selecting text sends nothing. Two optional triggers change that, and you switch them on yourself: with "look up on double-click" enabled, double- clicking a word is the request, and with the Shift trigger enabled, releasing Shift while any text is selected is the request. Turn them off in Settings if you would rather ask explicitly every time.
| Sent to | What is sent | Why |
|---|---|---|
| Google Translate | the selected text and your chosen target language | to return the translation |
| dictionaryapi.dev | the single English word you selected | to return definitions, phonetics and synonyms |
No account identifier accompanies either request, because there is no account.
Two more things worth knowing. Pronunciation: when a recorded pronunciation exists we play the audio file dictionaryapi.dev returns, which your browser fetches from that same service. Read-aloud: the speak button hands the text to your browser's own text-to-speech. Some browsers do that on the device and some send the text to their maker's speech service — which of the two happens is your browser's choice, not ours, and we cannot see it.
chrome.storage.local. They are never uploaded to us or to anyone else, and
they are deleted when you remove them or uninstall the extension.Payment is taken by Creem, which is the merchant of record — legally the seller for the transaction. Your name, billing address, tax status and card details go to Creem and are handled under Creem's privacy policy. We never see or store your card details.
Creem then notifies our server of the purchase. From that notification we keep this, and only this:
| What | Where | How long |
|---|---|---|
| The email address you paid with, with the plan you bought and the date it runs until. The same date is also kept against the licence id on its own, with no address attached, and that copy is the one the extension actually checks | Cloudflare KV, on our own Cloudflare Worker | Deleted automatically when Creem tells us the purchase was refunded, disputed, cancelled or has lapsed. If that notice never arrives, the record stops granting access on its own expiry date but the row stays until you ask us to remove it — and asking is enough, see section 8 |
| A count of AI requests this calendar month, stored against a licence id — a one-way fingerprint of your licence key, which is not your key and cannot be turned back into it | Cloudflare KV | Expires by itself after 60 days |
| A note that a licence was refunded, disputed, or has lapsed, stored against the licence id and nothing else. It is how the extension stops working when a purchase ends, and it contains no name, address or purchase detail | Cloudflare KV | Expires by itself after about 13 months |
| The activation id our payment provider returns the first time your licence key is used, stored against that same licence id. It is kept because the provider will not tell us it a second time, and without it your key could never be released from this product | Cloudflare KV | Kept while the licence exists |
| A short-lived request counter keyed by IP address, used only to stop automated abuse of the activation endpoint | Cloudflare KV | Expires by itself after 2 minutes |
Two counters have nothing personal in them at all. We keep, for a year, the identifier of each purchase notification Creem sends us — an opaque event id — so that a notification delivered twice cannot grant a licence twice. And we keep, for three days, a total count of AI requests handled per day across everyone, which is how the service stops itself running up a bill it cannot pay. Neither can be traced to a person.
That is the whole record. There is no profile, no purchase history beyond the current plan, no password, and no login. Access is proved by the licence key that came with your purchase, and the extension never sends that key anywhere except the one moment you activate it — after that it carries only the licence id above. An email address used to be what proved a purchase; it no longer is, because an address is not a secret and anyone who knew yours could have claimed your licence. We do not run analytics and we do not keep server logs of your lookups.
The three Premium actions — summarise, improve writing, check grammar — cannot run inside your browser. When you use one, the text you selected is sent to our Cloudflare Worker, which forwards it to our AI model provider:
| Sent to | What is sent | What is NOT sent |
|---|---|---|
Xiaomi MiMo, at token-plan-sgp.xiaomimimo.com (servers in Singapore) |
the text you selected and the language you asked for | your licence key, your licence id, your token, your IP address, the page you were on |
Your identity is checked by our Worker before the model is called, and is not passed on to it. The model provider handles the text under its own terms, and we do not know whether it retains submitted text or trains on it — we have no agreement with them that says it does not, and we will say so plainly rather than imply otherwise. Do not put text you cannot share with a third party into the AI actions — the same caution that applies to any online AI tool applies here.
This page runs no analytics and sets no cookies. It reads the country Cloudflare derives from your network connection, once, to decide whether to show you the Vietnam price — nothing about that is stored. Like any web host, Cloudflare keeps short-lived technical request logs (address, path, status) for its own operations; we do not analyse them and we build nothing from them.
The server is a Cloudflare Worker; Cloudflare is our infrastructure provider and processes requests on our behalf. Cloudflare KV stores data at Cloudflare's locations. The AI provider's endpoint is in Singapore. Creem processes payments on its own infrastructure. If you are in the EU, UK or elsewhere, using the paid features means your data is processed outside your country.
Only the four parties named above — Creem (payment), Cloudflare (hosting), the AI model provider (AI features only), and the free translation and dictionary services (free features only). Each does one job. We do not sell, rent, trade or share your data with anyone else, and we run no advertising and no third-party analytics. We disclose data otherwise only where the law requires it.
Payment records held by Creem are separate from ours; Creem keeps them as long as tax and accounting law requires, and requests about those go to Creem.
The extension is a general-purpose reading tool and is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has bought a licence, email us and we will delete the record.
Everything travels over HTTPS. Purchase notifications are rejected unless they carry a valid signature, and a licence token issued for one address cannot be used to unlock another. We hold no card details and no passwords, so there are none to lose.
There is also no password. The email address you paid with is the whole credential: anyone who knows it could activate Premium on it, and could learn from our server that the address has a plan. This is the price of having no accounts to break into, and it is a deliberate trade — but you should know it before you decide the address is a secret.
If this policy changes, the date at the top changes with it, in the same release as the code change it describes. Material changes affecting a paid licence are emailed to the address the licence is on.
Anything about this policy, or about data we hold: thienvanlea1@gmail.com — Lê Văn Thiện (trading as Epitchi), Vietnam.
Popup Dictionary · Terms of Service · thienvanlea1@gmail.com