Privacy Policy

• Account: your name, email address and password (stored only as a secure hash), or your name, email address and profile picture from Google if you sign in with Google.
• Your library: the links you save, the text we retrieve from those pages, and the summaries and tags generated for them.
• Credits and purchases: your credit balance, what you spent credits on, and records of your purchases. Card details go to our payment provider, never to us.
• Settings and messages: your email preferences, and anything you send through the contact form (your name, email address and message).
• Technical data: sign-in sessions, IP address, browser and device information, and error reports, used to run, secure and fix the service.

• To provide GistBrief (your account, saving and summarizing pages, credits and purchases, account emails such as verification and password resets): this is necessary to perform our contract with you.
• To keep it secure and working (bot checks, request limits, preventing abuse of free credits, error monitoring): our legitimate interest in a safe, reliable service.
• To send the weekly digest of what you saved: our legitimate interest in helping you use your library. It's on by default; turn it off in Account or with the link in any digest.
• To meet legal obligations, such as keeping tax and payment records, which our payment provider holds.

We don't use your data for advertising, don't sell it, and don't make decisions about you based solely on automated processing.

The GistBrief browser extension reads the address and title of the page you're on only when you click its button, use its keyboard shortcut or choose "Save to GistBrief" from the right-click menu. It then opens GistBrief's Save page with that address, where you're signed in as usual, and the page is saved to your library like any link you add yourself.

The extension doesn't collect, store or send anything else. It has no analytics or tracking, doesn't read page content, and can't see your browsing history or other tabs. The data it handles is used only to save the page you asked to save, and is never sold, used for advertising, or shared except as described in this policy. Its use of information complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

We share only the data needed for providers to perform services on our behalf, under their own terms and privacy practices:

• Vercel hosts the application and processes requests to it.
• Polar sells credits as our merchant of record and handles payment, tax and receipts. It holds a customer profile (your name, email address and account ID) from when you sign up, and a record of how many credits each action used, not what you saved. We never see or store your card details.
• Unosend delivers our emails: verification, password resets, the weekly digest, and contact-form messages.
• OpenRouter passes the page text you choose to summarize to the AI model you select, and that model's provider generates the summary and tags.
• Neon hosts the database that stores your account, saved content and credit history.
• Inngest runs background jobs, such as importing the links you save. It receives your account and item identifiers and the links themselves, not the saved pages or summaries.
• Sentry receives error reports and performance data so we can fix problems. Reports include technical details such as your browser and the page where an error happened, not your saved content, summaries, passwords or cookies. When an error occurs, a replay of the moments before it may be recorded with all text, inputs and images hidden.
• Cloudflare Turnstile checks that sign-ups, sign-ins and password resets come from a person rather than a bot. It processes technical signals from your browser, such as your IP address, and doesn't use them for advertising.
• A web-content retrieval provider fetches the pages you save. It receives the links, not your account details.
• Google, if you choose "Continue with Google", shares your name, email address and profile picture with us so you can sign in.

We use one essential cookie that keeps you signed in; it expires if you don't use GistBrief for a while or when you sign out. Your browser also stores two preferences on your device: your color theme and whether "Generate a summary" is ticked. We use no advertising or analytics cookies. Cloudflare Turnstile may use strictly necessary cookies or signals for its bot check.

• Your account, library and credit history are kept while your account is open. You can delete any saved item, or your whole account, from within GistBrief at any time.
• Deleting your account removes your saved items, summaries and credit history from our database right away, and deletes your customer profile at our payment provider. Copies in database backups are overwritten on a rolling basis.
• Payment and tax records are kept by our payment provider for as long as the law requires.
• Error reports are kept by our error monitoring provider for a limited period, then deleted automatically.

We use reasonable technical and organizational safeguards, including encrypted connections, hashed passwords, access controls, bot checks and request limits. No online service can guarantee absolute security.

Depending on where you live (for example in the EU, the UK or California), you may have the right to access, correct, delete or receive a copy of your personal data, and to object to or restrict some processing. Much of this you can do yourself: edit your name and preferences in Account, download your library there as CSV or Markdown, and delete items or your account. For anything else, reach us through the contact page; we'll answer within the time the law allows. You also have the right to complain to your local data protection authority.

GistBrief isn't meant for anyone under 16, and we don't knowingly collect data from them. If you believe a child has an account, contact us and we'll delete it.

Our providers operate internationally, so your data may be processed outside your country, including in the United States. Where the law requires it, these transfers rely on recognised safeguards, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

We may update this policy as the service changes. We'll publish the new policy here with a new effective date, and tell you by email or in the app before significant changes take effect.

Questions about your privacy or this policy? Reach us through the contact page.