First Pass Privacy Policy

First Pass is a Chrome extension that helps Google Docs reviewers write comments faster. It learns from comments you wrote on selected Google Docs and uses that history to suggest comments on new documents you ask it to review.

• Your Google account email address, used to identify your reviewer profile.
• Your reviewer display name, entered during onboarding, used to label your private reviewer profile.
• Short-lived Google OAuth access tokens used to authenticate your account and selected-file access. Drive tokens are handled only in browser memory and are not stored by First Pass.
• Comments from Google Docs you select through the Drive picker.
• Highlighted text, document titles, document IDs, and timestamps associated with imported comments when Google provides them.
• Document text from the active Google Doc when you run First Pass.
• Your private accept, reject, edit, and copy decisions, stored locally so the review queue can be restored.
• Extension usage and error-event metadata such as onboarding completion, Drive import status, review completion, suggestion decisions, and visible errors. Analytics events do not include document or comment text.
• Standard HTTPS request metadata, such as IP address and user agent, that hosting and security providers may process to deliver and protect the service. First Pass does not use it to build a browsing history.

First Pass requests `userinfo.email` to verify your account and `drive.file` to access only the Google Drive files you select or create through the extension. First Pass does not request full Drive access, Gmail access, or browser history access.

The extension uses the Google Picker to grant access file by file. It reads selected files and filters comments inside Chrome using Google's author identity. The Google Drive access token is not sent to the First Pass API or the `getbossbot.com` server.

Because Google Picker's official JavaScript cannot run in a privileged Manifest V3 extension page, First Pass displays it in an isolated page at `getbossbot.com/firstpass/picker-v1.html`. That page has no Chrome extension APIs. The extension passes the short-lived Drive token to the page in browser memory using an origin-checked, one-time window message. The page passes it only to Google Picker; it does not log, store, place in its own URL, or send the token to a First Pass or BossBot server.

• To create and maintain your First Pass reviewer profile.
• To import and process your selected historical comments.
• To generate evidence-backed comment suggestions for documents you choose to review.
• To debug failures and understand whether onboarding, import, and suggestion flows work.
• To improve First Pass quality and reliability.

First Pass does not sell your data or use it for advertising.

First Pass sends selected comment content and document text to the First Pass API at `firstpass-api.vercel.app`. Data is processed by the First Pass AI pipeline and stored in Supabase-managed Postgres in the United States. API hosting is provided by Vercel.

AI inference providers may receive selected comments, document text, and generated prompt context only to provide the First Pass suggestion feature.

We share data with service providers needed to operate First Pass: Google for OAuth and Drive APIs, Supabase for database hosting, Vercel for application hosting, Amplitude for event-metadata product analytics, and AI inference providers used by First Pass. We do not sell user data.

First Pass stores imported feedback examples and derived reviewer profile data so future suggestions can match your review style. You can request deletion of your First Pass data by emailing `support@getbossbot.com`. We will delete the reviewer profile, imported feedback examples, derived style data, and associated extension analytics that can reasonably be tied to your account.

First Pass uses HTTPS for data in transit. The Chrome extension is bundled statically; privileged extension pages execute only packaged JavaScript. Google's Picker JavaScript executes only in the isolated `getbossbot.com` frame described above, which cannot call extension APIs and is restricted to the published First Pass extension origin. The extension does not ship a long-lived shared API key; it uses a short-lived bearer token issued after Google verifies your email. Private suggestion decisions are kept in Chrome storage, and the extension never creates a Google Docs comment or edits document text.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Questions or deletion requests: support@getbossbot.com.