ProvokeAI
Provoke Deck

Privacy Policy

Effective November 2, 2026 · Last updated November 2, 2026

Plain-English summary: Provoke Deck is designed to keep operational browser data local. It does not include advertising trackers. Licensing requests send a limited set of entitlement and device identifiers to ProvokeAI so the extension can validate a license and enforce device limits. Licensed customers may optionally claim a Client Portal account, which requires multi-factor authentication and stores account-security and support information separately from local browser workflow data.

1. Scope

This Privacy Policy explains how ProvokeAI handles information in connection with the Provoke Deck browser extension, its licensing service, and Provoke Deck-related Client Portal functions. It does not control the privacy practices of third-party websites you visit or download from.

2. Information processed or stored locally

Provoke Deck uses Chrome storage and browser APIs to provide its user-facing features. Depending on the features you use, local data can include:

  • extension settings and preferences;
  • favorites;
  • download history, queue state, retry state, and duplicate-prevention records;
  • preview cache information;
  • local diagnostic events used to troubleshoot extension behavior;
  • a randomly generated installation identifier;
  • your activation key, signed entitlement token, and cached licensing state.

Supported-page content may be read and processed locally in your browser so Provoke Deck can provide gallery, preview, queue, history, and download features. Local processing still counts as data handling, which is why it is disclosed here.

3. Third-party site sessions and cookies

Provoke Deck does not request Chrome's cookies permission and does not use the Chrome Cookies API to read, enumerate, modify, or delete cookie values.

For a supported-site preview feature, Provoke Deck may request the selected third-party media page using the browser's existing credentials for that site. This means cookies already associated with the third-party site may accompany that specific request in the normal way a signed-in browser request can. Those session credentials are sent to the applicable third-party site, not to ProvokeAI, and Provoke Deck does not extract their values.

4. Information sent to ProvokeAI for licensing

When you activate, refresh, validate, or deactivate a license, Provoke Deck communicates over HTTPS with the ProvokeAI licensing service. Those requests may include:

  • the product identifier;
  • your activation key;
  • the installation identifier;
  • the extension version;
  • a general device label such as “Chrome extension”;
  • standard network metadata inherently processed when a request reaches an internet service, such as IP address, timestamp, and HTTP request metadata.

The licensing service uses this information to determine whether a subscription is active, issue or validate signed entitlement tokens, enforce device limits, support deactivation, prevent abuse, and troubleshoot licensing failures.

Provoke Deck does not send downloaded file contents or page contents to ProvokeAI as part of license validation. Downloads are requested from the applicable third-party source selected by the user.

5. Client Portal account and security data

A licensed customer can claim a Client Portal account by verifying the email address and activation key already associated with the license. Portal data can include the email address, customer and subscription identifiers, a salted password hash, multi-factor authentication configuration, one-time recovery-code hashes, hashed session tokens, account and session timestamps, limited browser/network metadata used for security controls, and authentication/security audit events.

Multi-factor authentication is required for Client Portal access. Authenticator-app secrets are stored encrypted using a server-side key that is not stored in the portal database. Recovery codes are shown when generated and are then stored only as one-way hashes. Sensitive portal actions can require a recent second-factor verification.

The Client Portal can display license status and devices from the existing ProvokeAI licensing database, reveal the activation key after authorization, deactivate a device, and associate authenticated support or feature requests with the relevant customer and subscription records.

Authenticated support and feature requests may include the text you submit, request category or title, customer and subscription identifiers, status, timestamps, and internal priority/notification metadata. Feature requests are restricted to customers with an active entitlement.

6. Selling, sharing, advertising, and analytics

ProvokeAI does not sell Provoke Deck or Client Portal user data. The current extension does not use behavioral advertising or third-party advertising trackers. The ProvokeAI website also launches without third-party advertising analytics.

Infrastructure providers may process limited technical information on our behalf. The production licensing and Client Portal services are hosted on Cloudflare infrastructure. If external email or payment services are used, those providers process the information needed to provide those functions.

The Client Portal is designed so full payment-card numbers and card security codes are handled by the applicable hosted payment provider rather than stored in the ProvokeAI licensing database. ProvokeAI may retain limited billing-provider identifiers and subscription-status metadata needed to operate the service.

We may disclose information when reasonably necessary to comply with law, protect users or services, investigate abuse, or defend legal rights.

7. Retention

Local extension data remains on your device until you delete it, clear extension storage, uninstall the extension, or use a feature that removes it. Licensing records such as subscription state, activation identifiers, device activation state, and related timestamps are retained as needed to provide licensing, device enforcement, support, fraud prevention, and service integrity.

Portal account, session, audit, support, and feature-request records are retained for as long as reasonably necessary to operate and secure the account and service, resolve requests, enforce licensing, prevent abuse, and meet applicable obligations. Expired or revoked security records may be deleted or retained in limited form when needed for security or audit purposes.

8. Security

Licensing and Client Portal traffic is transmitted over HTTPS. Entitlement responses are cryptographically signed and verified by the extension. Client Portal passwords are stored using a salted slow password hash rather than plaintext, portal sessions use secure HTTP-only cookies, multi-factor authentication is required, and authenticator secrets are encrypted at rest. No security measure eliminates all risk, and customers should protect activation keys, passwords, authenticator access, and recovery codes.

9. Your choices and deletion requests

You can uninstall Provoke Deck or clear its Chrome storage to remove locally stored extension data. You can deactivate a licensed device from the extension or Client Portal where supported. For requests concerning licensing, account, support, or feature-request information held by ProvokeAI, use the support page. We may need enough information to verify the request and identify the relevant account or license.

10. Children

Provoke Deck is not directed to children under 13, and ProvokeAI does not knowingly collect personal information from children under 13 through the licensing service or Client Portal.

11. Changes

We may update this policy when Provoke Deck, its permissions, licensing system, Client Portal, security controls, service providers, or legal obligations change. The “Last updated” date at the top will reflect material revisions.

12. Contact

Questions about this policy or Provoke Deck privacy can be submitted through the ProvokeAI support page. Licensed customers may also use the authenticated Client Portal.