Privacy Policy

Information the product handles

• URLs, titles, selected text, visible page snippets, and page metadata that you choose to summarize.
• Rows, prompts, formats, settings, usage estimates, export state, and logs saved in the local app, browser, or extension storage.
• Account identity and referral attribution when you create a hosted account or use an invite link.
• Server-derived aggregate account activity, such as successful or failed enrichments, model route, workflow type, plan mix, and Achievement adoption. This internal operational view is Owner-only, suppresses small cohorts, and excludes URLs, resource content, Prompts, model payloads, credentials, emails, and account identifiers.
• Google authorization data and export rows when you connect Google and choose Google Sheets export.
• A bounded history of Google files created through New Sheet or New Doc. It contains only file type, title, Google URL, and creation time so you can find the file again.
• Provider configuration and API keys that you enter. Raw keys are intended to remain in local storage and are not included in account snapshots.
• When you explicitly enable Screenshot fallback, one bounded image of the visible tab may be sent to the active model provider only when normal current-tab text is too thin.
• When you click Check for update, the app requests YourStasis's public release manifest. It sends no provider key, account snapshot, prompt, row, page content, or background telemetry, and it does not poll for updates automatically. Any download link is accepted only when it points back to this project's GitHub Releases path.

Optional screenshot fallback

Screenshot fallback is off by default. After an explicit current-tab capture, the Chrome extension may create one low-detail image only when selected text, visible snippets, headings, and metadata do not provide enough context. The image is bounded to reduce data and model cost, sent once to the configured model provider, and then discarded.

Google export history

After a successful New Sheet or New Doc action, YourStasis keeps up to 20 recent created-file links. Signed-in users can include this non-secret history in their account settings snapshot so the same destinations are available on another surface.

Optional Google Workspace reading

Google Workspace reading is off by default. When you enable it and explicitly capture an open Google Doc or Google Sheet, the Chrome extension asks Google for a bounded excerpt from that exact file: at most 1,200 characters from the Doc, or the first 20 rows and 26 columns from the Sheet. Existing Google file permissions still apply.

Internal platform analytics

The hosted service may calculate day-level aggregate adoption, usage, and reliability metrics from existing server records. These metrics help the product Owner understand whether enrichment works, which model routes are used, and where errors occur. They are not a customer-facing analytics product and are not available to normal, Support, or Admin accounts.

How data moves

Outbound delivery to your endpoints

Push to API, managed webhooks, and the ApplyOS connector send the enriched rows you choose to the exact endpoint you configure and nowhere else. These outbound paths are opt-in and default-off.

Account sync

Account snapshots are designed for cross-surface continuity. They can include sanitized settings, prompt presets, workspace rows, usage, logs, copy/export state, and provider-key status.

Loading a snapshot can merge account history into local history, replace local history, or be canceled when both surfaces already contain rows. An invite code may also be retained in local browser storage long enough to carry onboarding into account signup.

Google APIs and Drive export

Google Sheets export, Google Doc creation, and Google Workspace reading are user initiated. Export runs after you choose to append to a Sheet, create a Sheet, or create a Doc from the selected rows. Workspace reading runs only after you enable it and explicitly capture the open Doc or Sheet. Neither workflow bypasses file permissions or scans arbitrary Drive content. Google API information is used only to provide the requested workflow and is handled under the Chrome Web Store User Data Policy, including Limited Use requirements.

Storage, retention, and deletion

• Local workspace data remains in the browser, extension storage, local app storage, or local SQLite used by the local API until you clear it or remove it.
• Hosted account snapshots are stored for account continuity under the account service's retention rules; the account layer keeps a bounded recent history.
• Referral attribution records the referring profile and referred profile when a valid invite code is used during signup. Reward and credit logic is not active in this release.
• If signup or referral rewards are later tested, the hosted Worker can retain one bounded anti-abuse marker for a server-verified email or confirmed phone. The marker is a keyed, non-reversible digest and contains no raw email, phone, account ID, referral code, IP address, or device fingerprint. It may remain for up to 365 days after account deletion so deleting and recreating an account cannot repeat a grant. This control is not active unless its separate Worker secret is configured.
• For account deletion, data deletion, or privacy questions, use Support and include the account email only through a private support channel.

What we do not do

• We do not sell user data.
• We do not use summarized content for personalized advertising.
• We do not intentionally collect browsing history beyond pages you ask the extension or app to capture.
• We do not ask users to upload raw provider keys into account snapshots.
• We do not run background release checks or attach workspace data to update requests.

Who is responsible, and how to reach us

The data controller for personal data processed through the Service is GrowthNodes ApS (Denmark), operating as YourStasis. For all privacy matters — questions, rights requests, or complaints — contact info@yourstasis.com. We respond to verified requests within the timelines described below.

Enrichment samples and service improvement

To improve enrichment quality, the hosted service retains bounded enrichment signals and the rows you accept or edit at copy/export time, linked to your account tenant. These samples exclude provider keys, passwords, sessions, and encrypted secrets. They are used solely to tune enrichment behavior — for example, learning which model routes produce rows you keep versus rows you correct — and never for advertising.

Legal bases for processing (GDPR)

We process personal data under the EU GDPR on these bases:

• Performance of a contract (Art. 6(1)(b)) — operating the Service you signed up for: authentication, enrichment you request, sync, export, and support.
• Legitimate interests (Art. 6(1)(f)) — securing the Service, preventing abuse and fraud, rate limiting, aggregate reliability metrics with small-cohort suppression, and improving enrichment quality using the minimized samples described above. We balance these interests against your rights, and you may object (see below).
• Consent (Art. 6(1)(a)) — optional features that you switch on: Google authorization and Workspace reading, screenshot fallback, and marketing email you subscribe to. Withdrawing consent is as easy as giving it: turn the feature off, disconnect Google, or use the unsubscribe link in any marketing email.
• Legal obligation (Art. 6(1)(c)) — where retention or disclosure is required by law.

Your rights and how to exercise them

Depending on your location, you may have rights to access, correct, delete, restrict, or receive a portable copy of your personal data, to object to processing based on legitimate interests, to withdraw consent, and to lodge a complaint with a supervisory authority — in Denmark, Datatilsynet, or the authority of your place of residence.

Use the built-in tools first — they are faster than a formal request:

• Access and portability: your rows, prompts, settings, usage, and logs live in the app and export directly to TSV, CSV, Excel, Markdown, JSON, and NDJSON at any time, without asking us.
• Deletion: Account → Delete account removes hosted account data and immediately revokes access. Local and extension data is cleared from Settings or by uninstalling.
• Correction: every enriched row and setting is directly editable in place.

For anything the built-in tools do not cover, email info@yourstasis.com. So that we never disclose personal data to the wrong person, the following applies to formal requests:

• Identity verification is required. We will ask you to demonstrate control of the account email (and, where proportionate to the sensitivity of the request, additional confirmation) before acting. We cannot act on requests we cannot verify.
• Scope information may be requested. Where an account holds little or no server-side data — which is the design default — we may ask you to specify what you are looking for so we can respond accurately.
• Timelines: we respond within one month of a verified request. For complex or numerous requests we may extend by up to two further months, as GDPR permits, and will tell you within the first month if so.
• Manifestly unfounded or excessive requests — in particular repetitive requests for the same data — may be refused or charged a reasonable administrative fee, as GDPR Art. 12(5) permits. If we refuse, we will explain why and inform you of your right to complain to a supervisory authority.
• Agent requests must include verifiable proof of your authorization.

California privacy rights (CCPA/CPRA)

• We collect the categories described on this page: identifiers (account email), content you submit for enrichment, configuration, and aggregate usage records. Sources: you and your devices. Purposes: operating and securing the Service.
• We do not sell personal information and we do not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months. We use no third-party advertising or analytics trackers on this site or in the apps.
• California residents may exercise rights to know, delete, and correct via the same channels and verification process described above, and will not be discriminated against for doing so.

Storage, transfers, and subprocessors

• Hosted data is processed on infrastructure operated by Supabase (authentication and database) and Cloudflare (hosting, edge network, and storage), which may process data in the United States and other countries. Where GDPR applies to a transfer, it relies on appropriate safeguards such as Standard Contractual Clauses maintained by these providers.
• Content you submit for enrichment is sent to the model provider active in your configuration — the hosted provider (OpenAI or OpenRouter), your own BYOK provider, or your local runtime. In local mode, content does not leave your machine.
• Google processes data only when you connect Google and invoke a Google feature, under your Google account’s own agreements.
• Transactional and subscribed marketing email is delivered through email service providers; unsubscribe links are honored immediately for marketing mail.

Retention

• Local and extension data: retained on your device until you clear it or uninstall.
• Account data and snapshots: retained until you delete your account.
• Webhook delivery receipts and background job records: up to 30 days.
• Credit and capability observation records: up to 90 days.
• Referral and reward identity records used for abuse prevention: up to 365 days.
• Enrichment samples: retained while used for quality tuning, removable on request, and covered by account deletion for account-scoped data.
• Routine encrypted backups age out on a rolling basis.

Security and breach notification

Data in transit is protected with TLS. Provider keys stay in local storage by design, and optional key sync is end-to-end encrypted on your device with a passphrase we never receive. Access tokens are scoped, and hosted observability excludes content and identifiers. No system is perfectly secure; if a breach affects your personal data, we will notify you and the competent authorities as applicable law requires.

Cookies and site data

This website sets no advertising or analytics cookies and loads no third-party trackers. The only site storage used is a short-lived local record of a referral code you arrived with, which is validated, carried into signup on this origin only, and cleared after account creation.

Children

The Service is not directed to children under 13 (or the higher local age of digital consent), and we do not knowingly collect their data. If you believe a child has provided us personal data, contact info@yourstasis.com and we will delete it.

Changes to this policy

We will update this page as the Service evolves and give reasonable notice of material changes on this site or by email. The “Last updated” date above always reflects the current version. Liability for the Service is governed by the Terms of Service.