This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady
User-Friendly Forces is a Chrome extension that reads, analyzes, and summarizes website privacy policies — so you never have to sit through walls of legalese again.
You know the drill: you click "I agree" without reading anything because nobody has time for 8,000 words of legal boilerplate at 2 AM. That agreement you just clicked through might allow the company to sell your browsing habits, share your data with 200+ "partners," retain your information indefinitely, or quietly opt you into targeted advertising.
User-Friendly Forces fixes that by doing the lazy thing smartly. Click the extension on any privacy policy page, and within minutes you get:
📊 A Privacy Score (0–100) — higher means more privacy-friendly
📝 A plain-English 3-sentence summary of what the policy actually says
🚩 Color-coded red flags (🔴 High / 🟡 Medium / 🟢 Low) with specific details like "Your data is sold to third parties" or "Retention period is indefinite"
The entire analysis runs on your machine using Ollama — no data sent to any server you don't control. If Ollama isn't available, it gracefully falls back to the Gemini API (with a key you provide).
Who gets to be lazier? Anyone who ever clicked "Accept" without reading — which is everyone. Now you can actually know what you agreed to, in 30 seconds instead of 30 minutes.
Video Demo:
Code Base:
A Chrome extension that analyzes website privacy policies and highlights suspicious patterns — using local AI (Ollama) with Gemini as a cloud fallback.
[Chrome Extension popup]
│ POST / (prompt + optional Gemini key)
▼
[Node.js server — index.mjs]
│
├─► Ollama (localhost:11434) ← primary (free, private)
│
└─► Gemini API ← fallback (if Ollama is offline)
npm install
The only runtime dependency is Node.js ≥18 (uses native fetch).
express and cors are installed via package.json.
ollama pull llama3
http://localhost:11434
You can change the model by setting the environment variable:
OLLAMA_MODEL=mistral node index.mjs
GEMINI_API_KEY=AIza… node index.mjs
Stack:
Chrome Extension (Manifest v3) — the user-facing popup, written in vanilla JS/HTML/CSS with a glassmorphism aesthetic
Node.js backend (index.mjs) — a tiny Express server running locally on localhost:5000
Ollama — primary AI inference, running completely locally on your machine
Gemini API — cloud fallback, only used if Ollama is unavailable
The open-source AI layer:
The extension sends the privacy policy URL to the local Node server. The server uses Ollama's chat API (/api/chat) to run the analysis with whatever open-weight model you have installed — tested with llama3.2, llama2, and mistral. It also handles older Ollama versions by falling back to /api/generate.
The model is given a strict structured prompt that forces JSON output with a privacy score, plain-English summary, and a list of flags with severity levels. A robust JSON extractor strips any markdown fences or preamble text the model might add before parsing.
The Gemini fallback tries 5 model names in sequence, skipping any that return 404 (some models aren't available in all regions):
const GEMINI_MODELS = [
'gemini-2.0-flash',
'gemini-1.5-flash',
'gemini-1.5-flash-latest',
'gemini-pro',
'gemini-1.0-pro',
];
The health endpoint (GET /health) lets the popup check provider availability at startup and show a live status badge — green for Ollama ready, yellow for Gemini fallback, red if nothing is available.
Privacy tools need to be private themselves. That's the core tension with a closed-API approach.
If I had built this with a hosted OpenAI or Anthropic API, every privacy policy you analyze would pass through their servers. You'd be trusting a third party with the URLs of every privacy page you visit, potentially leaking which services you use, when you use them, and what concerns you enough to check. A tool meant to protect your privacy shouldn't compromise it in the process of doing so.
With Ollama:
✅ Runs entirely offline — once the model is downloaded, no internet connection required
✅ Zero data leaves your machine — the policy URL, the AI prompt, and the analysis result never touch an external server
✅ Costs exactly $0 to run — indefinitely, for any number of policies
✅ Model-agnostic — swap llama3.2 for mistral, phi3, gemma2, or any future open-weight model that fits your hardware, with no code changes
✅ No API key, no rate limits, no usage quotas — analyze 500 privacy policies in a day if you want
A closed API would have introduced a monthly bill, rate limits, and the irony of sending your privacy-checking queries to a company whose own privacy policy you haven't read. Open inference removes all three problems at once.
The open approach also lets the community improve it: you could fine-tune a small model specifically on privacy policy datasets (there are several on Hugging Face) to get better, more consistent analysis than a general-purpose model provides. That's simply not possible with a closed API.
The average privacy policy is 2,500 words and takes ~10 minutes to read properly.
Most people spend 0 minutes reading it and just click "Accept."
User-Friendly Forces gets you from "0 minutes of knowledge" to "actually informed" in under 2 minutes, without reading a word.
In one week of testing across a dozen popular websites:
🔴 3 out of 4 had at least one high-severity flag
The most common flag: "Data shared with unspecified third parties"
Worst score seen: 18/100 (a popular fitness tracking app)
Best score seen: 71/100 (a small open-source developer tool)
The sloth doesn't read the privacy policy. The sloth makes the AI read it, hangs upside down, and waits for the summary. That's the energy.
Best Use of Gemma — The extension works with Google's open-weight gemma2 model running locally through Ollama, giving users a Google-quality model without any API calls
Best Use of GitHub Copilot — Development workflow used Copilot for iterating on the structured prompt engineering and the JSON extraction logic