source-lm

Legal

Privacy Policy

Last updated 2026-08-21

Summary

source-lm (“the extension”) adds sources to your Gemini Notebook (NotebookLM) — from a JSON file you select, from YouTube videos on the page you are viewing, or from a link or the current page. It has no backend. Your data goes to the Google servers you are already signed into, and nowhere else, with one exception: a licence key check that goes to the payment provider. There is no telemetry, no analytics, and no crash reporting.

This page describes what the extension reads, where it goes, and what is stored. It covers the extension and this website, source-lm.com.

Who is responsible

Mikhail Konkov, an individual sole trader (autónomo) established in Spain, is the data controller, reachable at [email protected].

This project is not affiliated with, endorsed by, or connected to Google. NotebookLM and Gemini are Google trademarks.

What the extension reads

The JSON file you select in the extension popup. It is parsed and converted into Markdown entirely inside the popup, in your browser. It is never written to disk and never sent anywhere except the notebook you chose.

The text of the active tab, and only when you click “Add page as .md” on the popup’s Link tab. The page’s text is read once via chrome.scripting.executeScript — the <article> or <main> element when the page has one, otherwise <body> — turned into a Markdown file in the popup, and uploaded to your notebook. Access to that tab comes from the activeTab permission, granted by your click. The extension holds no standing permission to read arbitrary sites and reads nothing in the background.

Video links and titles visible on the current YouTube tab, collected only when you click one of the extension’s “Add to notebook” buttons or “Collect videos on page” in the popup. Only links and titles are read; video content is not downloaded or processed.

Your Google session cookies for notebooklm.google.com and notebook.google.com are used implicitly by your browser for the same-origin requests the extension makes to those domains. The extension’s own code never reads, stores, or transmits cookie values; the browser attaches them automatically to credentials: 'include' requests, exactly as it would for any page interaction you perform by hand.

Where it goes

To Google, on your behalf. Sources are uploaded to notebooklm.google.com / notebook.google.com and the Google upload host those origins hand back — the same servers the NotebookLM / Gemini Notebook web app itself talks to, in the session you are already signed into. There is no extension backend, no proxy, and no third-party server in this project. JSON parsing and Markdown generation happen entirely in the popup’s local memory, and nothing is uploaded until you explicitly click “Add to notebook”.

To the payment provider, only for a Pro licence. If you activate a licence, the popup sends to Lemon Squeezy’s public License API (api.lemonsqueezy.com), over HTTPS and with cookies explicitly omitted:

  • your licence key;
  • an instance name identifying the activation, of the form “Source LM — Chrome on X”, where X is macOS, Windows, Linux, or unknown OS — the operating-system family and nothing else, matched from your browser’s user agent string;
  • on later checks and on deactivation, the instance id Lemon Squeezy returned when you activated.

That is all. Re-validation runs roughly every seven days from the popup. No notebook content, no source URLs, no page text, no usage statistics, and no Google session data are ever sent to Lemon Squeezy or to anyone else.

To us: nothing. There is no server run by the author of this extension, so no data reaches the author at all.

What is not collected

  • No telemetry, no analytics, no crash or error reporting.
  • No user accounts, no profiles, no advertising identifiers, no tracking across sites, no profiling, no automated decision-making.
  • No remote code is loaded or executed. All code ships inside the extension package, and bundles are published unminified, so the submitted code matches what runs.
  • This website sets no cookies and loads no third-party scripts, fonts, or analytics. Fonts are served from the site’s own domain.

What is stored, and where

Everything the extension stores is stored by your browser, on your side. There is no database anywhere else.

In chrome.storage.sync:

  • Settings — words per file, filename pattern, field mappings, and the other chunking options.
  • license — your licence key, the per-device instance id, whether the last check succeeded, when it last ran, and the email address Lemon Squeezy associates with the key. No payment details are ever stored: Lemon Squeezy’s checkout page handles those and never shares them with the extension.
  • trial — the free plan’s counter: the current calendar month and how many of that month’s bulk actions you have used. No content, and it is never sent anywhere.

In chrome.storage.local:

  • A short-lived job handoff — the links and titles you selected and, for “Add page as .md”, the captured page text, held only to pass work from the popup to a notebook tab. It is deleted as soon as that tab reads it, and expires after five minutes if it never does. It never contains credentials.
  • A notebook list cache — the ids, titles, and emoji of your notebooks, plus the notebook origin, written by the notebook tab so the popup’s dropdown can render before a tab answers. Refreshed on each notebook page load.
  • The outcome of the last bulk run — how many sources were added, failed, or skipped, and the error text if any, so the popup can show it. Counts and a message; no source content.
  • A technical flag recording which version of the notebook’s internal interface was detected, so detection does not rerun every time. No personal data.

One honest caveat: chrome.storage.sync is synced by Chrome to your own Google account, as it is for any extension that uses it. That is Chrome’s sync, under Google’s terms, not a transfer to us — but it means the phrase “nothing ever leaves your browser” would be untrue, so we do not use it.

Permissions, and why each one exists

The extension requests three permissions:

  • activeTab — read the current tab, and only in response to your click.
  • storage — keep the settings, licence state, and trial counter described above.
  • scripting — used for exactly one thing: reading the active tab’s text for the “Add page as .md” button. It grants no access on its own; the access comes from activeTab when you click.

Standing host access is limited to four domains: https://notebooklm.google.com/*, https://notebook.google.com/*, https://www.youtube.com/*, and https://api.lemonsqueezy.com/*.

There is no tabs permission, no <all_urls>, and no background service worker.

Under the GDPR:

  • Performance of a contract (Art. 6(1)(b)) — validating your licence key with Lemon Squeezy, which is what delivers the paid features you bought.
  • Legitimate interests (Art. 6(1)(f)) — keeping your settings and the free plan’s counter in your own browser so the extension works as configured and the free tier can be metered without a server.

Notebook content, page text, and video lists are processed only inside your browser and transmitted only to Google in your own session. The author never receives them and does not act as a processor for them.

Retention

Data stored in your browser stays until you delete it — clear the extension’s storage, deactivate the licence, or remove the extension, and it is gone. The job handoff in chrome.storage.local deletes itself within five minutes.

Lemon Squeezy retains the purchase and licence records for the transaction under its own policy and its own retention rules, including for tax and accounting obligations.

Your rights

You have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data.

In practice, the author holds no data about you: there is no server and no database. Almost everything is on your machine, under your control. The exception is your purchase, which is held by Lemon Squeezy as the seller of record — for a request that concerns the purchase or licence record, write to us at [email protected] and we will pass it on, or contact Lemon Squeezy directly.

If you are in the EU and you believe your data has been mishandled, you may lodge a complaint with your national supervisory authority — in Spain, the Agencia Española de Protección de Datos (https://www.aepd.es/">aepd.es).

Third parties

  • Google — NotebookLM / Gemini Notebook, where your sources go, under Google’s privacy policy.
  • Lemon Squeezy — payment and licence keys, under Lemon Squeezy’s privacy policy. Lemon Squeezy is the merchant of record and may transfer data outside the EEA under its own safeguards.

No other third party is involved, and no data is sold or shared for advertising.

Children

The extension is not directed at children under 16 and is not designed for them.

Changes to this policy

Material changes will be posted on this page with a new date at the top. The version you are reading is the current one.

Contact

[email protected]

Back to source-lm