Privacy Policy

1. Introduction

Savebase Labs LLP, India, operates Savebase. We take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service, including our website and Chrome Browser Extension. By using Savebase, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We collect information that you provide directly to us, including:

• Account information (email address, password)
• Google account information (name, email address, profile picture) when you sign in with Google
• Google Sheets access tokens (encrypted) when you connect the Google Sheets integration
• Saved content, URLs, and bookmarks you explicitly choose to sync to our platform
• Media files (images, videos) from posts you save — by default, media is displayed using the original platform's temporary URLs and is not stored on our servers. If you are a paid subscriber and explicitly enable the Permanent Media Backup feature in your settings, media files are then fetched from the original platform and stored permanently in our secure cloud storage. This consent-based backup ensures your saved content remains accessible even if the original source removes it. Free users and paid users who have not enabled backup are not affected — no media is stored on our servers for these users.
• Usage data and preferences
• Referral-program data, including your opaque referral code, link clicks represented by a random browser token, referral attribution, masked referred-user email, qualifying purchase and commission status, and fraud-review status
• Payout information only after commission is earned, including the payout email or approved alternate destination, recipient type, parent or guardian name where applicable, verification status, payout amount, provider reference, and payment date
• Session-security data, including a device identifier and label, app or extension version, session identifier, last-active time, IP address, and approximate city and country inferred from network information. We use this data to show and revoke active sessions, detect new-device or country changes, and send security alerts.

3. Browser Extension Specific Data

To provide our unified bookmarking service, the Savebase browser extension interacts with specific websites you visit. Supported platforms currently include Instagram, Facebook, Threads, X (Twitter), Reddit, LinkedIn, TikTok, and others.

• Authentication & Session Data: The extension securely captures limited request credentials, such as CSRF tokens and authorization headers, from supported platforms and stores them in Chrome extension storage on your device. The extension uses these values in your browser only to fetch metadata for posts you choose to save or import. They are not added to saved-post records or intentionally sent to Savebase servers. Savebase does not send social-platform session cookies to its servers.
• Website Content: When you explicitly save a post or page, or when the extension detects you natively bookmarking a post on a supported platform, we collect the content of that specific post (text, media, URL) to store in your Savebase account.
• User Activity on Supported Platforms: On the supported social-media sites listed in the extension, the extension observes matching network requests so it can detect actions such as saving, unsaving, bookmarking, or liking a post and perform the Savebase action you enabled. It does not use this access to build a general browsing-history profile.
• Media Permanence: Social media platforms often serve media via temporary URLs that expire. If you are a paid subscriber and explicitly enable Permanent Media Backup, our service fetches and stores a copy of media from saved posts in Backblaze B2 cloud storage. Otherwise, Savebase keeps the original platform media URLs and does not create a permanent server-side copy.
• Browser Bookmarks: If you use the "Import Bookmarks" feature, the extension will read your browser's bookmarks strictly to import them into Savebase.

We do not track your general web browsing history, and we only capture the content of pages or posts you actively choose to save.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Authenticate your identity via Google Sign-In
• Export and sync your saved posts to Google Sheets on your behalf
• Sync, display, and organize your saved web content
• Permanently store media from saved posts when you are a paid subscriber and have explicitly enabled the Permanent Media Backup feature — this keeps your library accessible even if the original content is removed
• Send you technical notices and support messages
• Attribute eligible referrals, calculate and administer commission, verify payout recipients, prevent referral fraud, and maintain financial records

5. Chrome Web Store & Data Disclosure

In compliance with the Chrome Web Store User Data Policy:

Savebase's use and transfer of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

• We do not sell your personal information or user data to third parties.
• We do not share your data for advertising purposes.
• We only transfer or disclose user data to third parties as necessary to provide the core features of the Savebase service, or to comply with applicable laws.
• We do not use your data to determine creditworthiness or for lending purposes.

6. Google API Data — Sharing, Transfer & Disclosure

Savebase uses Google APIs to provide Sign-In with Google and the Google Sheets export integration. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• Google Sheets access is used solely to create, read, and update spreadsheets that you explicitly designate for your Savebase library export. We do not read, access, or modify any other Google Sheets files in your account.
• Sign-In with Google data is used solely for account authentication within Savebase.
• All Google OAuth tokens are encrypted at rest using industry-standard encryption and are never shared, sold, or disclosed.

7. MCP Server & AI Assistant Connections

Savebase Pro users can connect Savebase to AI assistants such as Claude and ChatGPT through our MCP (Model Context Protocol) server at mcp.savebase.space. The connection is read-only: a connected assistant cannot create, edit, move, or delete anything in your account, and cannot post anywhere on your behalf.

When you ask a connected assistant a question that it answers using Savebase, that assistant receives the parts of your library needed to answer. Depending on the question, this may include:

• Post titles and post content
• Author or creator names, post URLs, and the source platform
• Notes you have written on a saved post
• Image and video URLs attached to a saved post
• The transcript of any video you have chosen to transcribe in Savebase
• Your folder and tag names, and how many posts are in them

Nothing is sent unless a question causes the assistant to query Savebase. We do not send your library to any AI provider in the background, and we do not use your library to train any model.

Access is granted per user through OAuth 2.1. We store the access and refresh tokens issued to the connected application, the identity of that application, and the time each token was last used. We do not receive or store your credentials for that assistant, and we do not receive your conversations with it. You can revoke a connection at any time from Settings → MCP Server → Connected apps, which invalidates its tokens immediately.

Once data reaches a connected assistant it is handled under that provider's privacy policy, not ours. Review the privacy terms of any AI assistant before connecting it.

8. Third-Party Infrastructure & Sub-Processors

To deliver Savebase, we rely on the following third-party services. Each is contractually bound to handle your data securely and only for the purposes described:

• Supabase (Singapore): Our primary database and authentication provider. Your account data, saved posts, and metadata are stored on Supabase infrastructure located in the Singapore (ap-southeast-1) region. We have a signed Data Processing Agreement (DPA) with Supabase. Learn more at supabase.com/privacy.
• Backblaze B2 (Cloud Storage): If you are a paid subscriber and have enabled the Permanent Media Backup feature, media files (images and videos) from your saved posts are stored as permanent copies in Backblaze B2 object storage. This ensures your saved media remains accessible even if the original platform removes it. No media is stored in Backblaze B2 for free users or paid users who have not enabled this feature. Learn more at backblaze.com/privacy.
• Coolify (Self-Hosted): We use Coolify to self-host parts of our backend infrastructure, including the media processing pipeline responsible for fetching and uploading media to Backblaze B2.
• Cloudflare: Our website and certain services are delivered via Cloudflare, which provides DNS, CDN, and DDoS protection. Cloudflare may process request metadata (such as IP addresses) as part of this service. Learn more at cloudflare.com/privacypolicy.
• PayPal and approved payout providers: After you earn referral commission and provide payout details, the selected provider receives the information needed to deliver and document the payment. Because PayPal does not support domestic India-to-India payments, those payouts may instead use a verified bank account or UPI address on request.

9. Cookies and Analytics

We use a small number of cookies and analytics services to understand how Savebase is used so we can improve it. When you first visit, we ask for your consent before any analytics or advertising storage is used. Until you make a choice, only strictly necessary storage is active.

What we use

• Google Analytics 4 — aggregate usage statistics such as which pages are visited, which features are used, and where visitors arrive from. If you decline, Google Analytics runs in a restricted mode that sets no cookies and stores no identifiers on your device. See Google's Privacy Policy.
• Microsoft Clarity — anonymised session analytics that help us find broken or confusing parts of the interface. Clarity is only loaded if you accept analytics cookies; if you decline, it is never loaded at all. See Microsoft's Privacy Statement.
• Strictly necessary storage — remembers your consent choice, your light/dark theme preference, and keeps you signed in. This is always active because Savebase cannot function without it, and it is never used for advertising.
• Referral attribution storage — when you open a valid referral link, Savebase stores the referral code, a random browser token, and its expiry in first-party browser storage. A matching server record expires after 30 days. The token is not based on hardware characteristics and is not used to build a browsing profile.

Your consent choice

Your choice is stored in a cookie named site_consent for 180 days. We also keep a record of the decision — the categories you selected and when — so that we can demonstrate consent was obtained, as required under GDPR.

Changing or withdrawing consent

You can change or withdraw your consent at any time using the Cookie Settings link in the footer of any page. This re-opens the consent banner so you can make a new choice. Withdrawing consent is as easy as giving it, and does not affect the lawfulness of any processing carried out before you withdrew it.

10. International Data Transfers

Your personal data is stored and processed on servers located in Singapore (via Supabase) and in Backblaze B2 data centers. If you are accessing Savebase from outside Singapore, your data will be transferred to and maintained on servers in a different jurisdiction. By using Savebase, you consent to this transfer. We take appropriate measures to ensure your data is handled securely and in accordance with this Privacy Policy regardless of where it is processed.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal information. Data sent between the extension, website, and our services is encrypted in transit using HTTPS. Sensitive server-side credentials, including Google OAuth tokens, are encrypted at rest. Some extension preferences and temporary platform request values are stored locally through Chrome's extension storage and are protected by your browser profile and operating-system controls; we do not describe that local storage as independently encrypted by Savebase. Media files stored in Backblaze B2 (only for paid subscribers who have enabled Permanent Media Backup) are accessible through access-controlled delivery URLs. While we strive to protect your data, no method of transmission over the Internet or electronic storage is 100% secure.

12. Data Retention & Deletion

We retain your information for as long as your account is active or as needed to provide you services. Active-session records include the technical and location information described above. Full IP addresses in session records are reduced to a network prefix after 30 days. Session records are removed when they are no longer associated with an active authentication session. You can request the deletion of your data at any time through your account settings. Upon account deletion, saved bookmarks, configurations, associated OAuth tokens, and stored media files (in Backblaze B2) are permanently removed from our active systems. Referral click records expire after 30 days. Commission, payout, refund, fraud-review, and related transaction records may be retained after account deletion where reasonably necessary for tax, accounting, dispute, fraud-prevention, or other legal obligations; identifiers not needed for those purposes are deleted or de-linked.

13. Children's Privacy

Savebase is not directed to anyone under the age of 13. We do not knowingly collect personally identifiable information from children under 13. A participant who cannot legally control a payout account must use a parent or guardian-owned payout account. We collect the guardian name, payout email, verification, and consent only after referral commission exists and only to administer the payout. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@savebase.space and we will promptly delete such information from our systems.

14. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Revoke Google OAuth access at any time via your Google Account Permissions page or through your Savebase Settings

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, where the changes are material, notify you via email or a prominent notice within the Savebase dashboard. We encourage you to review this policy periodically. Continued use of Savebase after changes are posted constitutes your acceptance of the updated policy.

16. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at support@savebase.space.