Privacy / DM Craft
DM Craft — Privacy Policy
AI DM drafting for X, LinkedIn, and Instagram.
Last updated: April 8, 2026
1. Who we are
DM Craft is a Chrome extension published under the toolsmith brand by Visualab AI ("we", "our", "us"). This Privacy Policy describes how DM Craft handles your information.
Contact: [email protected]
Support page: /support/dmcraft
2. Chrome Web Store Limited Use disclosure
DM Craft's use and transfer of information received from Google APIs (and any other browser-provided user data) adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
- We only use user data to provide and improve the user-facing features of DM Craft.
- We do not sell user data to third parties.
- We do not use user data for advertising, including retargeting, personalized or interest-based advertising.
- We do not allow humans to read user data, except (a) with your explicit consent, (b) for security investigations, or (c) to comply with applicable law.
3. Permissions we request
| Permission | Why we need it |
|---|---|
| storage | Save your tone presets, draft history, and Pro subscription state in chrome.storage.local on your device. |
| activeTab | Read the currently active X / LinkedIn / Instagram tab when you click the DM Craft button, so we can pull the profile context the AI uses to draft a DM. |
| scripting | Inject the DM Craft composer into supported social sites (x.com, linkedin.com, instagram.com). |
| host_permissions: x.com, linkedin.com, instagram.com | Required to read profile/post context on the supported sites where DM Craft operates. |
| host_permissions: api.toolsmith.visualab-ai.com | Send the AI generation request to our Cloudflare Workers proxy, which forwards to the Anthropic Claude API. |
4. Data flow — what leaves your browser
| Data | Destination | Purpose | Retention |
|---|---|---|---|
| Profile name, bio, last 1-3 public posts of the open profile | Cloudflare Workers proxy → Anthropic Claude API | Generate the DM draft | Not stored on our servers; passed through in real time |
| Your tone preset and prompt template | Cloudflare Workers proxy → Anthropic Claude API | Style the DM draft | Not stored server-side |
| Draft history (last 100 drafts) | Your browser only (chrome.storage.local) | Let you review and reuse previous drafts | Until you uninstall or click "Clear history" |
| Google account email (Pro users only) | ExtensionPay / Stripe | Verify your Pro subscription | Until you cancel and request deletion |
| Anonymous events (e.g. "draft_generated", "tone=friendly") | PostHog | Aggregate usage analytics, no PII | 12 months |
Note: DM Craft never reads your existing DM inbox. It only reads the profile or post you are looking at when you click the DM Craft button. The generated draft is placed in the composer for you to edit or send manually — DM Craft never sends messages on your behalf.
5. Third-party sub-processors
DM Craft may transmit data to the following sub-processors:
- Anthropic, PBC — Claude API, used to generate AI responses. Anthropic does not use API inputs/outputs to train models by default. Privacy policy.
- Cloudflare, Inc. — Workers used as a secure proxy in front of the AI API (rate limiting, key protection). Logs are kept for up to 7 days for abuse prevention only. Privacy policy.
- ExtensionPay / Stripe, Inc. — Subscription billing for Pro features. We never see full card numbers. ExtensionPay / Stripe.
- PostHog Inc. — Anonymous, aggregated product analytics. IP addresses are anonymized and no personally identifying information is sent. Privacy policy.
6. Where your data is stored
- On your device: Settings, history, and preferences are stored in
chrome.storage.local. This data never leaves your browser unless you explicitly export it. - In transit: AI requests pass through Cloudflare Workers (US/EU edge) to the Anthropic API (US).
- Billing: Stripe stores payment data in accordance with PCI-DSS in the US/EU.
- Analytics: PostHog stores anonymous events for up to 12 months.
7. How to delete your data
- Local data: Open the DM Craft options page and click "Reset all data", or uninstall the extension from
chrome://extensions. - Subscription data: Email [email protected] with subject "Account Deletion" — we will remove your ExtensionPay record within 30 days.
- Analytics: Anonymous PostHog events cannot be tied to a specific user, but you can opt out from the extension settings.
8. Your rights (GDPR / CCPA)
If you are in the EU/EEA (GDPR) or California (CCPA), you have the right to access, correct, delete, port, and restrict processing of your personal data, and to object to processing or withdraw consent at any time. Email [email protected] to exercise any of these rights. We respond within 30 days.
9. Children's privacy
DM Craft is not directed at children under 13 (or 16 in the EU). We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it.
10. Changes to this policy
Material changes will be reflected on this page with a new "Last updated" date. Continued use of DM Craft after changes constitutes acceptance.
11. Contact
Visualab AI
Email: [email protected]
Website: visualab-ai.com