Skip to main content
Deft Foundry
Login

Privacy policy

Last updated: October 21, 2026

The short version

Deft Foundry stores your account and your billing records, anything you deliberately send us — a newsletter signup, a message through the contact form — a log line for each request to our API, and the anonymous, cookie-free website analytics, both described below. That is the list, and it is all about this website. The extensions are local-first and are covered one page each, linked below: each one does its work inside your own browser and keeps what it stores in your browser's own storage rather than on a server of ours. We never collect your browsing history, and we do not sell or share your data with advertisers.

What we collect

Account information

When you create an account we store your email address, your name and avatar if your sign-in method supplies them (Google does; a magic link doesn't), when the account was created, and which of our own surfaces you started the signup from — this website, or the sign-in button inside one of the extensions. That last one is a single word recorded once, so we can tell whether people find us through the site or through an extension they already use; it is not a tracker, it says nothing about where you were before you got here, and it is never shared. Sign-in uses Google OAuth or an emailed magic link — we never see or store a password.

Billing

Payments are processed by Stripe. We store which extensions you have bought and your Stripe customer ID; your card details go to Stripe and never touch our servers. Stripe's handling of them is governed by Stripe's own privacy policy.

Metered features

Where an extension has a feature that costs us money each time it runs, our server keeps a running count of how much of it your account has used — one number per extension, plus the month it is counted in. That is all it is: the count exists so a free allowance and a fair-use ceiling can be measured, and nothing about what was processed is stored beside it. The free allowance is also counted against your inbox rather than your account alone: against a one-way fingerprint of your address, lowercased and with any +tag and Gmail's dots taken out, so that a second account on the same inbox, or a new one after this one is deleted, carries on from what was used instead of starting again. The fingerprint cannot be turned back into your address. Both counts are included in your data export; the account's own count goes when the account goes, and the fingerprint's count stays (below).

Waitlist and newsletter

If you ask to be told when an extension ships, we store the email address you gave us, which page you gave it on, the IP address the request came from (the record that you consented, and when), and whether you have confirmed. It is double opt-in: nothing is sent to an address that hasn't clicked the confirmation link, and every mail after it carries a one-click unsubscribe. We use the list for product news about Deft Foundry and nothing else, and we never sell or rent it.

Messages you send us

The contact form sends your name, email address and message to our support inbox, so we can answer you; we keep the thread as long as it is useful for support. The uninstall survey is the opposite — it is anonymous by default and not tied to your account or to any identifier: the reason you pick and the optional note are the whole message. The one exception is yours to make: if you pick “I ran into a bug or problem”, an optional email field appears, and an address you type there travels with your answer to our support inbox so that we can reply about that problem. It is used for nothing else, nothing is sent to it unless we write back, and leaving it empty keeps the answer anonymous.

Feedback

The feedback form — the Feedback button in the header, the error page, “Report a broken link” on a missing page, the /feedback page, and Send feedback inside an extension — sends us only what you see in it before you press Send: what you write and the kind of message you picked; your email address, only if you give one, used only to reply to you and never added to any list (if you are signed in, we reply to your account's address instead, and the form says so); and the details listed under “Sent along” — the page you were on (its path, never its query string), which button you used, your browser and operating system (name and major version), and where there is one the error ID of a failed page or, from an extension, which part of it you wrote from and its version number. Review shows the exact values, each with a box to untick, and an unticked one is not sent. Nothing from an extension's library — no saved post, video, title or address of a tab — is ever part of it. The report goes from our server (Hetzner in the EU, behind Cloudflare) through our own self-hosted email service and Amazon SES to our support inbox, which is hosted by Google (Gmail); we store nothing of it ourselves beyond the server log line every request leaves. We keep the message as long as we need it to deal with it; email support@deftfoundry.com at any time to have it deleted.

Server logs

Our API records one line per request so we can keep the service secure and debug it. Each line holds the time, the HTTP method, the API path (never the query string), the response status — and, when a request is refused, the short reason why — how long it took, a random request identifier, your IP address and browser user-agent string, and — if you were signed in — your user id and email address. It also records where the request came from: the origin it was sent from and the page it was made from, again without its query string — or, for a request an extension makes, that it came from an extension and, for the sign-in checks and signing out, which part of it made the request: its popup, side panel or full-page view opening, a background check that you are still signed in, or signing out. These logs are kept for up to 90 days on the same EU infrastructure as the rest of the service, and that clock runs on its own: a log line outlives the account it names, and deleting the account does not reach back into it. We also look at them in aggregate to understand how the site and the extensions are used; they are not used to build a profile of you or shared with anyone.

Website analytics

This website — not the extensions — counts page views with Umami, an analytics tool we host ourselves. It sets no cookies, stores nothing in your browser, and does not fingerprint you, so there is no banner asking you to agree to it and nothing to opt out of. It records which pages get read, which calls-to-action get pressed, roughly where in the world the visit came from and what kind of device it was — never who you are. Because we run it, your visit is not handed to an analytics company at all; the request does not even leave our own domain. We used Google Analytics until August 2026 and removed it. The extensions themselves send no analytics of any kind.

Cookies

Reading this site sets no cookies. When you sign in we set a session cookie; it is what keeps you signed in, and the site does not work without it. Signing in also uses two cookies that last only until you close your browser — a security token that proves the sign-in request came from this site, and the page to bring you back to afterwards — and, if you continue with Google, one that matches Google's answer to your request and expires within 15 minutes. Your browser also stores your theme and similar interface choices, which neither identify you nor leave your browser. That is the whole list — no analytics cookies, no advertising cookies, and no ad networks. It is also why this site has no cookie banner: every cookie we set is there to sign you in.

What the extensions see — one page each

Each extension has its own privacy policy, because they do genuinely different things and a document written to cover all of them at once would describe none of them accurately. Each one lists what that extension collects, what leaves your device, who else sees it, and what every permission it asks for is used for:

What is true of all of them today: they carry no analytics and no telemetry, and none of them records where you browse or uploads a page you merely visited. None of them can write anything to your Deft Foundry account — where an extension changes something, it is a change you asked for, in your own account on the site that extension works alongside, and its own policy says which. Every one of them asks us the same one question — whether you are signed in and what you have bought — sent with your session cookie so the extension can show your account. Uninstalling opens a farewell page in a normal browser tab; the survey there is anonymous unless you choose to leave a reply address (see “Messages you send us”), and closing the tab sends nothing.

Beyond that one question, Redkeep, Tubekeep and Extgroups send something further, and only for a feature you turn on. What crosses is listed field by field on each one's own policy — that is the document, and this page does not summarise it.

YouTube videos

When an extension plays a YouTube video, it plays it through a small page on this site, because YouTube's embedded player will not run inside an extension page. That page uses YouTube API Services — YouTube's own embedded player, served from youtube-nocookie.com — and nothing of ours: it loads no analytics, sets no cookie of ours and stores nothing in your browser. It is only opened when you press play.

The player is YouTube's, and so is what it stores. youtube-nocookie.com is YouTube's privacy-enhanced mode, which is not the same as storing nothing: the player writes to your browser's local storage as soon as it loads and sets YouTube's cookies once a video plays, exactly as a YouTube video embedded on any other website does. They are YouTube's rather than ours — this site cannot read them — which is why they are not in the cookie list above. What Google does with them, and with the video you watch, is governed by the Google Privacy Policy, not by this one.

Email

Account email is transactional only: magic links you asked for, a welcome note, a receipt for a purchase, and a warning if a charge does not go through. The one non-transactional list is the waitlist above, which you have to confirm before it can reach you and can leave from any mail it sends. Delivery runs through our own mail service, which hands the message to Amazon SES for the last hop — so SES processes the recipient address and the message on our behalf. Bounce and complaint notices come back to us so we stop sending to dead addresses.

Your rights

From the Privacy tab in your settings you can export everything we hold about your account, or delete the account outright — both run immediately, with no request queue. The export is one JSON file covering your account details, how you sign in, which extensions you have bought and their billing records, any metered-feature counts described above, and your waitlist entry if you have one; deleting the account removes all of it, the waitlist row included. There is no recovery window, and we never bring a deleted account back. Three things do outlive the account, and none is ours to delete on request: the server logs above, until their 90 days are up; backups of the database, in Cloudflare R2 in Europe, which keep a copy of the deleted rows until they age out, at most 56 days later; and Stripe's own record of any payment — it retains what payment regulations require it to retain. Two more are kept on purpose: if mail to your address ever bounced or drew a complaint, our mail service keeps a one-way hash of the address so it is never mailed again, and Amazon SES keeps its own list of such addresses; and the free allowance an extension's metered feature has used stays counted against the one-way fingerprint of your inbox described above, so deleting the account and signing up again does not refill it. If you have no account — you only joined the waitlist, or wrote to support — the unsubscribe link handles the first, and one line to the address below handles either.

If you are in the EU/EEA or UK, these are your GDPR rights to access, portability and erasure; the rest (rectification, restriction, objection, withdrawal of consent) work by writing to us. Our grounds for processing are the contract with you (your account, what you have bought), your consent (the waitlist — withdrawable at any time, without affecting what was done before), and our legitimate interest in keeping the service secure and working, and in understanding in aggregate how it is used (server logs).

Where data lives

Our servers, database and logs are hosted in Germany, in the EU. Backups of that database, encrypted at rest, are kept in Cloudflare R2 object storage in Europe (its Western Europe location), each for at most 56 days. Other companies handle data on our behalf, under their own safeguards: Cloudflare carries the traffic between your browser and us and stores the encrypted backups of our database in Cloudflare R2, Stripe takes payments, Google provides OAuth sign-in, and Amazon SES delivers our email from the US. Analytics is no longer on that list — we host it ourselves, on the same servers, in Germany. Where a feature sends something to us for an AI model to answer, OpenRouter is who we pass it to, and what crosses is listed field by field on the policy linked above for the extension that does it.

The typefaces this site is set in are served from our own servers, not from Google's — reading a page here asks Google for nothing at all.

Changes and contact

If this policy changes materially we will note it here and move the date at the top. Questions, requests, complaints: support@deftfoundry.com.