Cookie Policy & Extension Permissions

Product: Sahi • Version: [1.0] • Effective: 01/04/2026

This page covers two things. Part A is the cookie policy for our website and admin console — short, because there is not much. Part B covers what the browser extension can access, which is what anyone installing a writing assistant actually wants to know.

Sahi is supplied by Caresoft Systems Private Limited. Read this with the Privacy Policy.

The short version.

Our website uses a handful of cookies, and analytics only if you say yes. The extension uses no cookies at all — it uses local browser storage for your settings. It reads the text you type into fields where checking is enabled, holds it in memory long enough to check it, and discards it. It does not read your browsing history, your other tabs, your passwords, or pages where you are not typing.

Part A · 1. What cookies are

Cookies are small text files a website stores in your browser. Some are necessary for a site to work at all — remembering that you are signed in, protecting a form from cross-site request forgery. Others are optional.

Part A · 2. Cookies we set

Cookie	Purpose	Type	Duration
`sahi_session`	Keeps you signed in to the console	Strictly necessary	Session
`sahi_csrf`	Protects forms against cross-site request forgery	Strictly necessary	Session
`sahi_consent`	Remembers your cookie choices so we stop asking	Strictly necessary	[12] months
`sahi_lang`	Remembers your interface language	Functional	[12] months
`sahi_theme`	Remembers light or dark preference	Functional	[12] months
Analytics cookies	Aggregate page usage — only if you consent	Analytics	[13] months

Strictly necessary cookies are set without consent because the site cannot function without them. Everything else waits for your choice.

Part A · 3. Analytics

Analytics run only with your consent, and refusing changes nothing about your access.
They measure aggregate use of our marketing site and documentation — which pages are read, where people give up.
The signed-in admin console is not tracked for analytics beyond what is needed to operate and secure it.
IP addresses are truncated before storage where the provider supports it.

Part A · 4. No advertising cookies

We place no advertising, retargeting or social media tracking cookies on any Sahi property — not on the marketing site, not in the console, and not through the extension.

There is no advertising pixel on any page. We do not build audiences, do not retarget visitors, and do not share visitor data with an ad network.

Part A · 5. Controlling cookies

Change your choices at any time through the cookie settings link in our footer.
Rejecting is exactly as easy as accepting — one click, same prominence, no dark patterns.
Your browser can block or clear cookies; blocking strictly necessary ones will prevent sign-in from working.

Part A · 6. Global Privacy Control

We honour the Global Privacy Control signal. If your browser sends GPC, we treat it as a refusal of optional cookies and do not ask again on that browser.

Part B · 7. The extension uses no cookies

The Sahi browser extension sets no cookies, on our sites or on any site you visit. It has no need for them.

It stores your settings in the browser's own extension storage, which is private to the extension and is not readable by any website you visit.

Part B · 8. What it stores locally

Stored on your device	Why
Your sign-in token	So you are not asked to sign in constantly
Your settings — enabled rule categories, tone, language variant	So the extension behaves as you configured it
Your personal dictionary additions	So words you accepted are not flagged again
Your site exclusion list	So the extension stays off where you told it to
A short-lived result cache	So retyping the same sentence does not trigger a fresh check

All of this is removed when you uninstall the extension or clear its storage.

Part B · 9. Permissions it requests

Browsers show a permission prompt at install. Here is what each one actually means for Sahi:

Permission	What the browser says	What Sahi actually does with it
`storage`	Store data on your device	Saves the settings in §8. Nothing else
`activeTab` / host access	"Read and change data on sites you visit"	This wording alarms people, understandably. It is the only permission that allows an extension to read a text box. Sahi uses it solely to read what you type into fields where checking is enabled, and to render suggestions there. See §10 and §11
`scripting`	Run scripts on pages	Injects the underline and suggestion card into the page you are typing on
`alarms`	Schedule background work	Refreshes your licence status and prunes the local cache

We keep the permission list as small as the function allows, and we do not request permissions for features we have not built. If a future version needs a new permission, the browser will ask you again — and we will say in the release notes why.

Part B · 10. What it reads

The text you type into an editable field on a page where checking is enabled.
Enough of the surrounding field to place a suggestion correctly.
The page's language attribute, to know which language you are writing in.

That is the whole list. Text is sent for checking (§13), a result comes back, suggestions are displayed, and the text is discarded.

Part B · 11. What it never reads

The extension does not:

• read your browsing history
• read pages you are only looking at, without typing
• read other open tabs
• read content outside the field you are typing in
• read your bookmarks, downloads or files
• read cookies belonging to any site you visit
• capture screenshots, keystrokes outside a checked field, or your clipboard
• track which sites you visit, or report them to anyone
• operate on a page where checking is disabled

Part B · 12. Fields excluded automatically

These are excluded on your device, before anything is processed or sent anywhere.

Excluded	Why
Password fields	Obvious
Payment card and CVV fields	Never appropriate to process
One-time password and verification code fields	Security-critical and never prose
Fields marked by the site as sensitive or excluded from autofill	The site has flagged them for a reason
Search boxes and URL fields	Not writing, and revealing

Exclusion happens in the browser. Excluded content never reaches our infrastructure at all — it is not filtered at our end, it never leaves yours.

Part B · 13. Exclusions you can add

Individual users can turn the extension off for a site, a page, or entirely, from the extension menu.
Organisations can exclude by domain, URL pattern or field, centrally, so that Sahi never operates on a system regardless of user settings.

Worth configuring before rollout: your HR system, any clinical or patient-record system, your finance and payroll tools, legal document management, and anything else where the content is more sensitive than the writing quality is worth. Sahi is for email, tickets and documents — it does not need to be everywhere.

Part B · 14. What leaves your browser

Leaves your browser	Does not leave your browser
The passage being checked, over TLS	Anything from an excluded field (§12)
The language variant and rule settings needed to check it	The URL or title of the page you are on
Your licence token, to confirm you may use the service	Who you were writing to
Anonymous error and usage counts	Your browsing activity

The passage is held in memory for the duration of the check and discarded. It is not written to a database and not retained. A cached result is stored against a hash of the passage for [7] days and pruned nightly — caching can be disabled for your organisation on request.

Administrators see usage counts and error categories. They cannot see the text, the recipient, or the site.

Part B · 15. On-premise deployments

Where Sahi is deployed on your own infrastructure, nothing in §14 reaches Caresoft at all — not text, not metadata, not usage counts, not licence checks beyond the terms in your Order.

The extension talks to your server. We do not see it, and we could not produce your data if asked.

Part B · 16. Extension updates

Updates are delivered through the browser's own extension store, on the browser's schedule.
An update that requires a new permission will prompt you — the browser enforces this, and we cannot bypass it.
Release notes state what changed. Where a change affects what the extension reads or sends, we say so plainly rather than describing it as an improvement.
Organisations deploying centrally can pin versions and control update timing through their browser management policy.

Part B · 17. Turning it off and removing it

Pause — from the extension menu, for this site or everywhere. It stops reading immediately.
Disable — from your browser's extension settings. It does nothing while disabled.
Uninstall — removes the extension and everything it stored locally (§8).
Uninstalling does not delete your account or settings held server-side. To delete those, use the console or write to [email protected].

18. Contact

Privacy: [email protected]
Grievance Officer: Rajeev Pillai acknowledgement within 24 hours, resolution within 15 days
Caresoft Systems Private Limited, 311, Mahesh Industrial Estate , Silver Park, Mira Road East , Thane -401107, CIN U72900MH2022PTC387875

We may update this page. Material changes are notified at least [30] days in advance. Any change to §11, §12 or §14 will be notified prominently and in advance — what the extension reads and sends is the substance of the promise.