Last updated: 2026-10-22
Manga Translator is a Chrome extension that translates foreign-language manga/comics on web pages using Vision Language Models (VLM). This privacy policy explains how the extension handles data.
The extension developer does not collect, receive, or store any user data. The developer operates no server of any kind.
This does not mean nothing leaves your device. When you translate a page, the extension sends the comic images it is translating to the Vision LLM provider you configured — that is the whole point of the tool. Those images are transmitted to that third party, which processes them under its own privacy policy and terms of service.
In Chrome Web Store data-usage terms, that transmission is a Website content disclosure: the extension transmits content from the page you are reading to a third party. It is not a collection by the developer, and the developer never receives the data.
All processing happens either locally on your device or through API calls to third-party Vision LLM providers that you configure yourself.
When you activate the extension on a webpage, the extension captures images from the page for OCR and translation. These images are sent directly from your browser to the Vision LLM provider you have configured (e.g., MiniMax, OpenAI API, Ollama running on localhost, LM Studio running on localhost). The extension developer runs no server and does not receive, see, or store any images.
The images are the content of the page you are reading, so this is a transfer of website content to the provider you chose. If you use a local provider (Ollama, LM Studio), the images never leave your machine at all. If you use a hosted provider, they do leave your machine, and that provider’s data handling applies — including whatever it retains, for how long, and whether it is used for training. Review that provider’s privacy policy before sending anything to it.
You may provide API keys for third-party services (e.g., OpenAI-compatible providers). User-entered keys are:
storage.local API (not synced across devices via your Google account)storage permission, or anyone with the unpacked bundle,
can reverse it. Its only purpose is to keep a key from being readable at a
glance in the storage inspector — do not treat it as a security boundary.
The content script is not web-accessible, so a page cannot read the salt
out of the shipped bundle, but the bundle itself is not a secret.Private builds may also preload provider credentials from a local .env file at
build time. Those credentials are compiled into that private extension bundle
and must not be distributed publicly. The build:public release path omits
provider API keys and is the required path for shared or Chrome Web Store
artifacts.
The plaintext key is held only by the extension’s service worker and its own pages. It is never placed in the content script — the code that runs inside every page you visit — because a key there would be a key in every page. The build enforces this in two ways: it fails if the content script’s import graph can reach the module that holds the key, and it fails if the built content script contains a key at all. The content script never receives the key itself: it gets the endpoint, the model name, and whether a key is configured, along with the settings a translation needs (target language, style, resolution, concurrency) — preferences, not credentials.
Note: Prior to v0.3.5, configuration was stored in
chrome.storage.sync, which meant obfuscated API keys were synced across devices via the user’s Google account. v0.3.5 moved all configuration tochrome.storage.localand performs a one-time automatic migration on startup; the oldstorage.synccopy is deleted after migration.
Your settings (target language, provider selection, UI preferences) are stored locally using Chrome’s storage.local API. None of this data is sent to the extension developer or synced across devices.
Translated text results are cached locally in your browser’s chrome.storage.local to avoid re-translating the same images. This cache is stored entirely on your device.
The extension integrates with third-party Vision LLM providers. When you configure a provider:
https://api.minimaxi.com/v1, model MiniMax-M3). Images are sent there unless you change the provider in Settings. MiniMax’s privacy policy applies to data sent to their servers.https://api.openai.com (or your custom base URL). OpenAI’s privacy policy applies to data sent to their servers.localhost:11434).localhost:1234).You are responsible for reviewing the privacy policies of any third-party API providers you choose to use.
Images leave your device only when the extension translates them. That happens when you ask for it — the popup button, the context menu (whole page or a single image), a keyboard shortcut, or by translating a page and then scrolling images into view — or when the page’s site is on the auto-translate list you control from the popup.
The auto-translate list is empty by default, so enabling the extension does not by itself cause any image to be uploaded. Nothing is ever sent from a site you have not chosen to translate.
The extension ships the Tesseract worker script and the SIMD WASM core locally
in the bundle, so the OCR engine itself needs no download. When the OCR fallback
path is used — that is, when the configured vision model returns no text, and
only for providers other than Ollama — Tesseract downloads the language model
(.traineddata) for the languages it is set up to recognize (Korean, Japanese,
English, Simplified Chinese) from the official @tesseract.js-data package on
jsdelivr.
The extension makes outbound requests to exactly three kinds of destination. No others exist; there is no analytics endpoint, no update ping, and no developer-operated server.
<img> element is
often CORS-restricted, downscaled, or lazy-loaded, so drawing it onto a
canvas in the page cannot reliably produce the full-resolution bytes a vision
model needs. The background worker therefore fetches the image URL directly
from that site’s own content-delivery host. This is a plain GET of an asset
the page was already loading, sent with credentials: 'omit' so your cookies
for that host are never forwarded. It happens only for images you have asked
to translate (or that an allowlisted site auto-translates), never during
browsing. The extension operates no proxy of its own — the request goes from
your browser to that host.The first is directed at a service you chose. The second and third are requests
to third-party hosts you did not explicitly configure, which is why they are
called out here. On the second path the scheme is restricted to http/https,
and localhost, *.localhost, metadata.google.internal and private/loopback
IPv4 and IPv6 literals are refused, so a page cannot aim the extension at an
internal service by address. The same check is applied to the URL the response
finally came from: a host can answer with a redirect to an internal address,
and the browser follows that redirect before the extension sees it, so the
request to the internal address has already happened by then. What the extension
can still do is refuse to hand the body back — a response that ended up
somewhere the address policy rejects is dropped unread, so its contents never
reach the page or the provider. A domain that resolves to a private address is
not caught by these checks — resolving it happens in the browser, after this
validation — so the sender check in the worker remains the primary control on
who may request a fetch.
This extension contains no analytics, no tracking scripts, no telemetry, and no crash reporting. There are no third-party SDKs for analytics or advertising. The extension does not use cookies or any form of user tracking.
The developer collects nothing: no identifiers, no usage data, no diagnostics. The only data that moves is the page content you asked to have translated, going to the provider you configured.
All data (configuration, API keys, translation cache) is stored locally in your browser. Uninstalling the extension removes all stored data. You can also clear the data at any time through Chrome’s extension settings.
Data that reaches a third-party provider is retained according to that provider’s own policy, not this extension’s.
This extension is not directed at children and does not knowingly collect personal information from anyone.
If this privacy policy changes, the updated version will be included with extension updates. Significant changes will be noted in the extension’s Chrome Web Store listing.
If you have questions about this privacy policy, you can open an issue on the extension’s GitHub repository or contact the developer through the Chrome Web Store support channel.
Key takeaway: Images go only to the API provider you configure and to the image host of the page you asked to translate. The extension developer never sees your images, your API keys, or your browsing activity, and operates no server that receives any of them.
This means the extension does transfer website content — the comic images you ask it to translate — to the third-party provider you configured. That provider’s handling of those images is governed by its own policy. If you want the images to stay on your machine, configure a local provider (Ollama or LM Studio).