When you point at a paragraph and ParsiPad translates it, one network request leaves your browser. It goes to the provider whose key you entered in Settings, and to nobody else. This article walks through that request, because "we respect your privacy" is easier to say than to show.

Only the text you point at

ParsiPad reads the page to decide where to offer its icon, and that happens entirely inside your browser. Nothing is sent until you ask, and when you ask, only the passage you clicked goes into the request: the paragraph under your cursor, or the words you selected. The page title, the address and the rest of the article stay where they are.

Selected text is the one exception worth explaining. When you select a word or a short phrase, the sentence around it is included, so the model sees how the word is used. That is how bank comes back as ساحل next to a river and بانک next to a loan. The sentence is always part of the text in front of you.

The request, in full

Here is what a translation of a single paragraph looks like on the wire, with Claude as the provider. The other providers receive the same content in their own request shape.

POST https://api.anthropic.com/v1/messages
x-api-key: <your key, read from the extension's local storage>

{
  "model": "<the model you picked in Settings>",
  "max_tokens": 1024,
  "system": "<ParsiPad's translation instructions, the same for everyone>",
  "messages": [
    {
      "role": "user",
      "content": "The best way to learn a language is to read things you actually care about."
    }
  ]
}

That is the whole thing. No user ID, no installation ID, no page address. The instructions that travel with your text are in the source code, so you can read exactly what the model is asked to do.

There is no ParsiPad server in the middle. The request goes from your browser to your provider, and the answer comes straight back.

Where your key lives

Your API key is kept in the browser's local extension storage, on your computer, next to your history and favorites. That storage is not synced through your browser account, so the key stays on the machine where you entered it. It is sent only to its own provider, over HTTPS, as the authorization header of requests like the one above. If you remove ParsiPad, the key goes with it.

  • ParsiPad tests the key once when you save it, with one tiny real request, so a typo shows up immediately rather than on your first real translation.
  • Each provider has its own key, and each key goes only to that provider.
  • There is no ParsiPad account, so there is nothing to sign in to and nothing that could leak from a server.

What never leaves the browser

Everything you keep is local: history, favorites, saved lessons, flashcards, the words on your New Tab page and the usage counters behind Analytics. The cost estimates are worked out inside the extension from the token counts the provider returns, and reported nowhere.

If you want to check any of this yourself, the source is on GitHub, and the code that builds the request is short enough to read over a cup of tea.