Kimi3Flow — Privacy Policy

Last updated: 27 July 2026

Kimi3Flow is a free, open-source browser extension that adds Kimi 3 (Moonshot) assistance to GitHub. This policy explains exactly what the extension does and does not do with your data.

In short: Kimi3Flow collects no personal data, has no servers, and includes no analytics or tracking. Your settings stay in your browser, and page content is sent only to the API endpoint you configure, only when you run a command.

The developer collects nothing

The developer of Kimi3Flow operates no backend and receives no data from the extension. There is no account, no telemetry, no analytics, no advertising, and no sale or sharing of data of any kind.

What is stored, and where

The extension stores only the settings you enter on its options page — your API base URL, API key, and default model. These are kept locally in your browser using the standard chrome.storage API and never leave your browser except as part of the requests described below. Your API key is used solely to authenticate those requests to the endpoint you chose.

What is sent, when, and to whom

When you explicitly run a flow (by opening the command palette and choosing a command), the extension reads content from the GitHub page you are viewing — a pull request diff, a file's text, or an issue's title and body — and sends that content, together with the command's prompt, to the API endpoint you configured (for example https://api.moonshot.ai/v1).

This happens only when you trigger a command — never in the background.
The data goes only to the endpoint you set in options; it is not sent anywhere else.
Nothing is transmitted until you have entered your own API key.

How that endpoint's provider handles the data is governed by their privacy policy. If you use Moonshot / Kimi, see the Moonshot AI privacy policy. If you point the extension at a different OpenAI-compatible endpoint, that provider's policy applies.

Permissions

storage — to save your settings locally.
host access to github.com — so the extension can read the current PR, file, or issue and show its interface on the page.
optional access to your API host — requested at runtime, only for the endpoint you configure, so requests to it aren't blocked by the browser. Nothing is requested until you save your settings.

Data sold to third parties

None. Kimi3Flow does not sell or transfer your data to third parties, does not use it for any purpose unrelated to its single function, and does not use it to determine creditworthiness or for lending.

Open source

The full source code is public, so you can verify everything above: github.com/wushu75/Kimi3Flow.

Contact

Questions or concerns? Open an issue at github.com/wushu75/Kimi3Flow/issues.