Privacy Policy

Effective date: 22 May 2026 · Last updated: 23 August 2026

1. Who we are

Kliplet ("we", "us") is a browser extension that saves web pages and selections to knowledge tools that you control — Notion, Obsidian, Logseq, Joplin, Anytype, Bear on macOS, or a Markdown file downloaded to your computer. When you choose Screenshot mode, it can save a PNG of the active tab's visible viewport through the browser Downloads service or to your configured Obsidian endpoint. It stores page highlights locally and can sync their disclosed records after a separate paid opt-in. A paid custom template may explicitly insert those highlights into a destination clip with {{highlights}}; built-in clip modes do not. The extension is published to the Chrome Web Store. Kliplet-authored source code is proprietary; the package includes a LICENSE and THIRD_PARTY_NOTICES.txt for bundled components.

2. What stays on your device

Most of what Kliplet handles never leaves your browser:

• Web page content you clip — the title, body, selection, and metadata of the active tab when you press Save. The destination payload is sent directly from your browser to the destination you picked: Notion's API; the Obsidian / Logseq / Joplin / Anytype endpoint you configured (loopback on your own machine by default); Bear on macOS; or your Downloads folder. If you replace a local adapter's default with a LAN or remote HTTPS URL, the clip content and that adapter's credential go to the endpoint you chose. Full rendered clip bodies and extracted content may be stored locally in clip history and, only for eligible ordinary Obsidian text writes with a pre-resolved exact vault path, the local retry queue. Such rows receive up to four automatic attempts and are not uploaded to the Kliplet backend. If a paid user explicitly adds {{highlights}} to a custom template, matching locally stored page highlights become part of that destination payload. Separately enabled proxied AI sends the extracted clip text described in section 3, and separately enabled cross-device sync sends only the custom-template and highlight fields listed there.
• Editable materialized body preview (Kliplet 1.1.2). The popup can show the locally rendered text body for each selected destination. If you edit one, Kliplet uses that exact text for that destination after normal template validation and optional AI resolution. The edit cannot change routing, properties, frontmatter, or Screenshot bytes; it is limited to 1 MiB per destination and 4 MiB per request. The edited body stays in the browser until you save, then follows the same chosen-destination path as the unedited body. After save, only exact destination bodies you explicitly edited may be retained as target-keyed overrides in the owning Clip's local history. Search can index them and Privacy export can include them. Kliplet does not store a separate per-destination rendered snapshot for unedited output. The retained edits are deleted with the Clip or by Delete all data and are not sent to a new Kliplet backend route or optional sync. This is the same local clip-content category and does not change the 1.0.9 consent epoch.
• Custom-template selectors and filters (Kliplet 1.1.2). {{css:<selector>}} reads visible text from matching elements, while {{css-attr:<attribute>:<selector>}} can read only alt, aria-label, cite, content, datetime, href, name, poster, rel, role, src, or title. URL-valued attributes are normalized to credential-free HTTP(S) values; unsafe schemes and blocked attributes fail closed. Hidden content, form controls, executable/embed elements, and Kliplet-owned controls are not returned, and raw HTML is not exposed. The available deterministic filters are trim, collapse_ws, lower, upper, first, last, join, slice, and default; there is no regex, logic, loop, or prompt execution. Selectors and filters are rejected in database, folder, and filename routing fields. A selector snapshot must match the exact saved template, credential-free canonical page URL, and current document; it is not reused after navigation, reload, or a template change. Processing is capped at 128 selector/filter expressions, 24 selectors, 256 characters per selector, eight filters per expression, 32 matches per selector, 2 KiB per value, and 64 KiB aggregate selector output, plus a bounded DOM scan. The extracted values remain local until the user saves, when they become part of the ordinary chosen-destination payload. They are not sent to a new Kliplet backend route or optional AI. In Kliplet 1.1.2, a custom template that uses selectors or filters remains on this device and is excluded from optional cloud sync; ordinary custom templates keep the existing opt-in sync behavior. A genuine selector no-match is shown as a diagnostic and resolves to an empty value or an explicit default(...); invalid, blocked, truncated, stale, or unbound selector data is rejected before a destination write.
• Template auto-apply triggers (Kliplet 1.1.2). A custom template can match an HTTP(S) URL prefix after the page URL's credentials, query, and fragment are removed, or a bounded Schema.org JSON-LD path by presence or an exact scalar value. Trigger matching and JSON-LD traversal happen locally and support no regex, script, or fuzzy matching. Templates using a URL-prefix or Schema.org rule remain on this device and are excluded from optional cloud sync; ordinary exact-domain and wildcard-domain templates remain eligible under the existing sync consent.
• Target credentials and connection metadata. Access tokens/API keys are stored in the browser extension's local storage, together with connection details such as the Notion workspace/database name and IDs or a configured adapter endpoint. During the one-time Notion OAuth connection, the authorization code and Notion token/workspace response transit auth.kliplet.com so the backend can keep the integration secret out of the extension; Kliplet does not persist that exchange. After connection, the Notion token is sent only to Notion's API, and local-adapter credentials are sent only to the configured endpoint.
• Visible-tab screenshots. When you choose Screenshot mode, the browser captures the pixels currently visible in the active tab. In Kliplet 1.1.2, Screenshot is available for the Markdown-download and Obsidian destinations; text-only targets are hidden and rejected. Markdown saves the PNG to your computer. Obsidian sends it directly from your browser to the Local REST API endpoint you configured, then reads the vault file back and reports success only when its bytes match. Kliplet does not write the PNG to clip history, the offline queue, or Privacy exports, and releases its in-memory copy after the current save attempt. For Markdown downloads, the browser Downloads service may retain the PNG source in its own history if the best-effort cleanup described in section 5 cannot run or fails. If the browser cannot confirm a Markdown download or Obsidian write, Kliplet asks you to inspect the destination and disables automatic/manual replay to avoid a duplicate and indefinite Kliplet-owned storage. Screenshot pixels are not sent to the Kliplet backend, optional AI, or optional sync.
• Your preferences and Browser Sync. Custom templates are stored in the extension's local storage. Non-sensitive settings, consent flags, and last-used target/template IDs are written to WebExtension sync storage, so Chrome/Chromium or Firefox may transfer them through the browser account used for sync. Version 1.0.5 copies a valid custom-template value left by older releases into local storage. During the 1.0.5 compatibility window, that legacy template body remains read-only in browser sync storage so another browser still running 1.0.4 does not lose it; new template edits are written locally. This browser-managed flow is separate from Kliplet's optional paid sync.
• Pending checkout activation. When you start a checkout, the extension stores the selected product ID and a one-time activation nonce locally; after Polar redirects back, it may also store the checkout ID. This record expires after 48 hours and is automatically removed then, or on the next browser wake if the browser was closed; it is also cleared after successful activation. The nonce is sent to Polar in checkout metadata, and the checkout ID plus nonce are sent to the Kliplet backend to prove that the same browser may activate the purchase.
• Your clip history and highlights — stored locally in IndexedDB so the extension can show "already saved" badges and reapply highlights when you return to a page. It may include optional exact per-target body edits that you made in the 1.1.2 preview. Search indexes the retained edits and Privacy export includes them; unedited outputs do not gain separate per-destination rendered snapshots. Only eligible ordinary Obsidian text writes whose exact vault paths were resolved before their first requests can enter the local queue, with up to four automatic attempts. Screenshots and all other destinations are not durably replayed. Clip history is never uploaded to us.
• Existing Obsidian note update (Kliplet 1.1.2). For an existing Kliplet-created text note with a known safe vault-relative path, the dedup action can send a complete replacement Markdown body to the same configured Local REST API endpoint and verify exact read-back. An unconfirmed result is not retried. This action does not append, prepend, target a daily note, update a Screenshot, or enter the durable queue.

3. The Kliplet backend (auth.kliplet.com)

Kliplet runs a small backend. It is involved only in the features below, and only handles the data each feature needs:

• Notion authorization. The backend receives the short-lived authorization code and browser-extension redirect URI, exchanges them with Notion, and returns Notion's token/workspace response to the extension. It does not persist the code, token, workspace ID, or workspace name.
• Payments. Card data is collected and stored by Polar.sh (our merchant of record) on Polar-controlled infrastructure — Kliplet never sees or stores card details. For display pricing, the extension may derive a two-letter region from the browser locale (for example, DE from de-DE) and send that code to the Kliplet backend; it is not stored, is not forwarded to Polar, and no IP geolocation is performed. Kliplet sends Polar the product you selected, a one-time activation nonce, and an email only when one is available for checkout prefill. The purchase-activation request later sends the Polar checkout ID and matching nonce to Kliplet. When Polar reports billing events, the backend records your purchase email, tier, status and expiry together with Polar customer, product, subscription, order, webhook and event identifiers/timestamps needed to activate and manage the license, process refunds, open your customer portal, and reject duplicate or stale events.
• Licensing. The backend issues and re-verifies a short signed license token (/license/issue, /license/verify). It keeps a license record keyed by your purchase email. If you use Restore purchase, the email and Polar order ID you enter are sent to Kliplet; Kliplet uses the order ID with Polar to verify the paid status, email, and product before issuing a token. This does not create records beyond the license and purchase-provenance data described above. The token is stored locally on your device and re-checked online periodically, with a short offline grace window before the extension falls back to the free tier.
• Cross-device sync (optional, Pro / Lifetime). A paid license does not enable sync. After you explicitly confirm the disclosure in Options → Sync, ordinary custom templates that do not use selectors, filters, URL-prefix triggers, or Schema.org rules, plus highlight records (page URL, selected highlight text, anchor, note, and colour) are uploaded to and stored in a Kliplet database. Clip bodies, target credentials, and general browsing history are not synced. You can disable sync without losing your local data or paid license.
• AI features (optional). AI is off by default. When you explicitly enable it, “Summarize on clip” starts enabled and can be turned off. Each AI request contains up to 12,000 characters of extracted clip text: normally the extracted page/article body, or the chosen selection for a selection clip. Without your own provider key, that text is sent to the Kliplet backend and relayed to Gemini. A BYO Gemini, OpenAI, or Anthropic API key is stored in WebExtension local storage; the extension sends that key as authentication, together with the submitted text, directly to the provider you selected and bypasses the Kliplet backend for that AI request. For managed-AI daily quotas, Kliplet transiently processes the request IP for Free/unauthenticated use or the purchase email for paid use, stores only a SHA-256-derived quota key plus the tier/date/counter in Redis, and automatically expires it at the next UTC midnight. The raw IP is not stored or forwarded by the AI quota code.

Outside an explicitly enabled AI request or sync record, browsing history and clipped page content do not reach the Kliplet backend.

4. What we do not collect

• No extension analytics or remote telemetry. Kliplet ships zero extension usage analytics or error-reporting pings. If you opt in to local sync diagnostics, success/failure/conflict counters remain in WebExtension local storage and are not transmitted.
• No third-party analytics or advertising trackers. The website loads no Google Analytics, Segment, Mixpanel, Hotjar, PostHog, Plausible, advertising pixel, or session-replay script. It sets no analytics cookie and creates no local-storage identifier.
• Limited first-party website measurement. For allowlisted public content routes and the fixed browser-extension store redirects, nginx records only the UTC day, event type (page_view or store_cta_click), normalized public route, locale bucket, allowlisted campaign labels, a coarse known-referrer bucket, bot flag, and response status. It does not store the request IP, user-agent string, cookies, full referrer, raw query string, exact event time, session ID, fingerprint, form input, extension activity, clipped content, or checkout identifiers. Retention runs are intended to run daily. After each successful retention run, raw event rows are limited to the current UTC calendar date plus the previous 13 dates. A delayed or failed run can temporarily extend raw-row retention until a successful run completes. Aggregate campaign counts are retained for up to 90 days. These records are used only to evaluate public content and campaign performance, never for visitor profiles or advertising.
• No routine API or sensitive-route request log. Successful API requests and sensitive website routes such as checkout activation are not access-logged. Nginx processes IP addresses in memory to enforce short-window abuse rate limits, and a failed or blocked request may create a limited server error/security record containing technical request metadata such as IP address, time, route and status. Those records are used only to protect and troubleshoot the service.
• No passwords or advertising identifiers. You never set a password or sign in to a conventional Kliplet account. A paid license uses the purchase email and Polar transaction identifiers described above; optional sync is addressed by the same paid identity.

5. Third-party services you choose to connect

When you connect a target or use a paid feature, your data is governed by that service's privacy policy:

• Notion: your clip content, access token, and selected workspace/database metadata are handled per Notion's privacy policy. The extension stores the token and metadata locally; the OAuth exchange transits Kliplet once as described above.
• Obsidian / Logseq / Joplin / Anytype: destination requests go to the API endpoint you configure (loopback on your own machine by default, e.g. Obsidian Local REST API on https://127.0.0.1:27124). If you configure a LAN or remote HTTPS endpoint, its operator receives the clip content and credential. An Obsidian Screenshot request includes the visible-tab PNG bytes. Optional AI and sync are separate opt-in transfers described above.
• Bear (macOS): the clip is handed to the Bear app through its local bear:// URL scheme.
• Markdown download: the Markdown destination file or user-requested Screenshot PNG is saved locally by the browser to your Downloads folder. Both are handed to the browser as data: source URLs, which contain the generated Markdown/frontmatter or PNG bytes and may temporarily appear in browser download history. After every confirmed, interrupted, cancelled, or unconfirmed terminal result, Kliplet asks the browser to erase only that download-history row; this does not delete the saved file. Cleanup is best effort. If the browser or extension stops before cleanup runs, or if the erase API fails or is unavailable, the history row and source payload may remain until the browser or user removes them. Optional AI is a separate opt-in transfer described above.
• Polar.sh: hosted checkout, customer portal, payment processing, card data, and the billing/customer information you provide there, per Polar's privacy policy.
• AI provider: when AI is enabled, text is processed by Gemini through the Kliplet proxy, or directly by Gemini, OpenAI, or Anthropic when you configure your own provider key. A BYO key is stored locally and sent only to the provider you selected to authenticate that direct request.
• Browser Sync: when browser sync is enabled, Chrome/Chromium or Firefox may transfer the non-sensitive settings, consent flags, last-used IDs, and legacy 1.0.4 template value described above through the browser account used for sync, subject to the browser vendor's privacy policy.

6. Where data lives

• On your device / browser profile — WebExtension local storage (targets, access tokens/API keys including an optional BYO AI key, connection metadata, custom templates, license and AI settings, pending checkout activation, indexes and sync metadata), WebExtension sync storage (non-sensitive preferences, consent flags, last-used target/template IDs, and a read-only legacy template copy during the 1.0.5 migration window), two IndexedDB databases (full local clip history, extracted content, highlights, the eligible resolved-path Obsidian text queue and sync outbox), and WebExtension session storage where supported (short-lived UI state). Screenshot PNGs and writes to other destinations are excluded from that queue. The browser may transfer sync-storage values through the browser account used for sync as described in section 5.
• Legacy highlights created by Kliplet 1.0.4 or earlier — those versions accidentally stored highlight rows in the visited site's browser-origin IndexedDB. Version 1.0.5 only reads an exact legacy schema for the current page and shows the number of matching rows. It copies them into extension-owned storage only after you click Import; it does not inspect rows for other pages or change the legacy database.
• On the Kliplet backend — your license record (email, tier, status, expiry, and the Polar customer/product/subscription/order/event identifiers and timestamps described in section 3), replay-protection records for Polar webhooks, short-lived managed-AI quota keys, and, only after explicit sync opt-in, ordinary custom templates that do not use selectors, filters, URL-prefix triggers, or Schema.org rules, plus highlight URL/selected-text/anchor/note/colour records. Successful requests are not access-logged; failed or blocked requests may produce the limited error/security records described in section 4.
• With Polar — the checkout, customer, payment and card data handled on its hosted pages.

7. GDPR and similar rights

• Right to access / delete on your device — Options → Privacy exports both extension-owned IndexedDB databases and every WebExtension local, sync, and session storage value. The JSON therefore contains access/API keys and the signed license token, so it must be protected like a password backup. Screenshot PNGs are not part of this export because they are not persisted by Kliplet. Delete all data first disables sync, then clears those storage areas and both extension-owned IndexedDB databases. It also clears the browser's cached identity tokens where that browser API is available. Deletion of this extension-owned data is irreversible. Browser APIs do not let the Options page clear old 1.0.4 page-origin copies across every visited site; those can be removed through your browser's per-site data controls.
• Right to access / delete on the backend — to access or delete the license record or synced data held on auth.kliplet.com, email privacy@kliplet.com. Disabling sync stops future transfers but does not itself delete data already stored on the backend; request backend deletion separately.
• Right to revoke a target's access — disconnect the target in Options → Targets to remove its credential locally. Provider-side OAuth/API grants are not revoked by local deletion; revoke them directly at the provider (Notion: notion.so/my-integrations).

8. Permissions the extension requests

Each browser permission Kliplet asks for is used only for its narrow function:

• storage — store local/synced preferences, tokens and extension data.
• unlimitedStorage — allow a larger local clip/search index.
• scripting — inject a small selection/anchor capture function into the active tab only when you invoke Highlight (Alt+H); extraction and restoration run in the declarative content script.
• downloads — save Markdown clips and Screenshot PNGs, user-triggered .kliplet Backup exports, and user-triggered JSON Privacy exports.
• alarms — make up to four automatic attempts for eligible resolved-path Obsidian text queue rows, remove expired pending-checkout state, and run opted-in sync/license maintenance.
• contextMenus — add right-click clipping actions and an optional Open sidebar action.
• identity — open the Notion OAuth authorization flow and clear cached browser identity tokens during Delete all where supported.
• sidePanel / Firefox sidebar — provide the optional browser sidebar.
• <all_urls> and API host permissions — restore highlight UI on ordinary pages; prepare pages you choose to clip; locally read bounded visible text or allowlisted attributes when a custom template requests them; capture the active tab's visible pixels only when you choose Screenshot mode; reach Notion and Kliplet optional services; reach configured loopback or LAN/remote HTTPS adapter endpoints; and send direct BYO AI requests to the provider you selected.

9. Chrome Web Store Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Kliplet uses data accessed through Chrome only to provide or improve the user-facing clipping, highlighting, local storage, licensing, optional sync, and optional AI features described in this policy. We do not use or transfer it for advertising, user profiling, credit decisions, or data brokerage, and we do not allow humans to read it except with your explicit consent for support, when necessary for security, or when required by law.

10. Children's privacy

Kliplet is not designed for children under 13 and we do not knowingly collect data from them.

11. Changes to this policy

If we change anything material — for example, if we add a new data flow — we will update this page and its date, and post notice on kliplet.com and in the applicable browser-extension store release notes. Any new data flow will be opt-in.

12. Contact

Privacy questions, GDPR requests, or anything else: privacy@kliplet.com.