Privacy policy
Last updated: August 24, 2026
The short version
Deft Foundry stores your account and your billing records, anything you deliberately send us — a newsletter signup, a message through the contact form — and the anonymous, cookie-free website analytics described below. That is the list, and it is all about this website. The extensions are local-first and are covered one page each, linked below: each one does its work inside your own browser and keeps what it stores in your browser's own storage rather than on a server of ours. We never collect your browsing history, and we do not sell or share your data with advertisers.
What we collect
Account information
When you create an account we store your email address, your name and avatar if your sign-in method supplies them (Google does; a magic link doesn't), when the account was created, and which of our own surfaces you started the signup from — this website, or the sign-in button inside one of the extensions. That last one is a single word recorded once, so we can tell whether people find us through the site or through an extension they already use; it is not a tracker, it says nothing about where you were before you got here, and it is never shared. Sign-in uses Google OAuth or an emailed magic link — we never see or store a password.
Billing
Payments are processed by Stripe. We store which extensions you have bought and your Stripe customer ID; your card details go to Stripe and never touch our servers. Stripe's handling of them is governed by Stripe's own privacy policy.
Metered features
Where an extension has a feature that costs us money each time it runs, our server keeps a running count of how much of it your account has used — one number per extension, plus the month it is counted in. That is all it is: the count exists so a free allowance and a fair-use ceiling can be measured, and nothing about what was processed is stored beside it. It is included in your data export, and it goes when the account goes.
Waitlist and newsletter
If you ask to be told when an extension ships, we store the email address you gave us, which page you gave it on, the IP address the request came from (the record that you consented, and when), and whether you have confirmed. It is double opt-in: nothing is sent to an address that hasn't clicked the confirmation link, and every mail after it carries a one-click unsubscribe. We use the list for product news about Deft Foundry and nothing else, and we never sell or rent it.
Messages you send us
The contact form sends your name, email address and message to our support inbox, so we can answer you; we keep the thread as long as it is useful for support. The uninstall survey is the opposite — it has no email field and is not tied to your account or to any identifier: the reason you pick and the optional note are the whole message.
Server logs
Like every website, our servers keep ordinary request logs — IP address, user agent, path, timestamp, and, on requests made while you are signed in, the account they belong to. They exist for security and debugging, are kept for up to 90 days on the same EU infrastructure as the rest of the service, and are not used to build profiles.
Website analytics
This website — not the extensions — counts page views with Umami, an analytics tool we host ourselves. It sets no cookies, stores nothing in your browser, and does not fingerprint you, so there is no banner asking you to agree to it and nothing to opt out of. It records which pages get read, which calls-to-action get pressed, roughly where in the world the visit came from and what kind of device it was — never who you are. Because we run it, your visit is not handed to an analytics company at all; the request does not even leave our own domain. We used Google Analytics until August 2026 and removed it. The extensions themselves send no analytics of any kind.
Cookies
When you sign in we set a session cookie; it is what keeps you signed in, and the site does not work without it. Your browser also stores your theme and similar interface choices, which neither identify you nor leave your browser. That is the whole list — no analytics cookies, no advertising cookies, and no ad networks. It is also why this site has no cookie banner: the only cookie we set is the one that signs you in.
What the extensions see — one page each
Each extension has its own privacy policy, because they do genuinely different things and a document written to cover all of them at once would describe none of them accurately. Each one lists what that extension collects, what leaves your device, who else sees it, and what every permission it asks for is used for:
- Redkeep privacy policy — last updated August 24, 2026
- Tubekeep privacy policy — last updated August 24, 2026
What is true of all of them today: they carry no analytics and no telemetry, and none of them records where you browse or uploads a page you merely visited. None of them can write anything to your Deft Foundry account — where an extension changes something, it is a change you asked for, in your own account on the site that extension works alongside, and its own policy says which. Every one of them asks us the same one question — whether you are signed in and what you have bought — sent with your session cookie so the extension can show your account. Uninstalling opens a farewell page in a normal browser tab; the survey there is anonymous, and closing the tab sends nothing.
Beyond that one question, Redkeep and Tubekeep send something further, and only for a feature you turn on. What crosses is listed field by field on each one's own policy — that is the document, and this page does not summarise it.
Account email is transactional only: magic links you asked for, a welcome note, a receipt for a purchase, and a warning if a charge does not go through. The one non-transactional list is the waitlist above, which you have to confirm before it can reach you and can leave from any mail it sends. Delivery runs through our own mail service, which hands the message to Amazon SES for the last hop — so SES processes the recipient address and the message on our behalf. Bounce and complaint notices come back to us so we stop sending to dead addresses.
Your rights
From the Privacy tab in your settings you can export everything we hold about your account, or delete the account outright — both run immediately, with no request queue. The export is one JSON file covering your account details, how you sign in, which extensions you have bought and their billing records, any metered-feature counts described above, and your waitlist entry if you have one; deleting the account removes all of it, the waitlist row included. There is no recovery window and no archived copy; Stripe retains what payment regulations require it to retain. If you have no account — you only joined the waitlist, or wrote to support — the unsubscribe link handles the first, and one line to the address below handles either.
If you are in the EU/EEA or UK, these are your GDPR rights to access, portability and erasure; the rest (rectification, restriction, objection, withdrawal of consent) work by writing to us. Our grounds for processing are the contract with you (your account, what you have bought), your consent (the waitlist — withdrawable at any time, without affecting what was done before), and our legitimate interest in keeping the service secure and working (server logs).
Where data lives
Our servers, database and logs are hosted in Germany, in the EU. Other companies handle data on our behalf, under their own safeguards: Cloudflare carries the traffic between your browser and us, Stripe takes payments, Google provides OAuth sign-in, and Amazon SES delivers our email from the US. Analytics is no longer on that list — we host it ourselves, on the same servers, in Germany. Where a feature sends something to us for an AI model to answer, OpenRouter is who we pass it to, and what crosses is listed field by field on the policy linked above for the extension that does it.
The typefaces this site is set in are served from our own servers, not from Google's — reading a page here asks Google for nothing at all.
Changes and contact
If this policy changes materially we will note it here and move the date at the top. Questions, requests, complaints: [email protected].