Privacy Policy

Information the product handles

• URLs, titles, selected text, visible page snippets, and page metadata that you choose to summarize.
• Rows, prompts, formats, settings, usage estimates, export state, and logs saved in the local app, browser, or extension storage.
• Account identity and referral attribution when you create a hosted account or use an invite link.
• Server-derived aggregate account activity, such as successful or failed enrichments, model route, workflow type, plan mix, and Achievement adoption. This internal operational view is Owner-only, suppresses small cohorts, and excludes URLs, resource content, Prompts, model payloads, credentials, emails, and account identifiers.
• Google authorization data and export rows when you connect Google and choose Google Sheets export.
• A bounded history of Google files created through New Sheet or New Doc. It contains only file type, title, Google URL, and creation time so you can find the file again.
• Provider configuration and API keys that you enter. Your key is saved on your device and sent through our service with each request so we can call your provider; we do not store it. Only optional encrypted account secrets (Account > Integrations) copies it into your account.
• When you explicitly enable Screenshot fallback, one bounded image of the visible tab may be sent to the active model provider only when normal current-tab text is too thin.
• When you click Check for update, the app requests YourStasis's public release manifest. It sends no provider key, account snapshot, prompt, row, page content, or background telemetry, and it does not poll for updates automatically. Any download link is accepted only when it points back to this project's release path.

Optional screenshot fallback

Screenshot fallback is off by default. After an explicit current-tab capture, the Chrome extension may create one low-detail image only when selected text, visible snippets, headings, and metadata do not provide enough context. The image is bounded to reduce data and model cost. It is sent with the enrichment request to the model provider (through our service when you use hosted enrichment). YourStasis does not store it.

Google export history

After a successful New Sheet or New Doc action, YourStasis keeps up to 20 recent created-file links. Signed-in users can include this non-secret history in their account settings snapshot so the same destinations are available on another surface.

Optional Google Workspace reading

Google Workspace reading is off by default. When you enable it and explicitly capture an open Google Doc or Google Sheet, the Chrome extension asks Google for a short excerpt of that exact file: up to about 2,000 characters of a Doc, or up to about 2,500 characters of cell text from a Sheet's first four tabs. Existing Google file permissions still apply.

Internal platform analytics

The hosted service may calculate day-level aggregate adoption, usage, and reliability metrics from existing server records. These metrics help the product Owner understand whether enrichment works, which model routes are used, and where errors occur. They are not a customer-facing analytics product and are not available to normal, Support, or Admin accounts.

How data moves

Outbound delivery to your endpoints

Push to API sends the rows you choose. ApplyOS sends only the URLs by default, or full rows or a custom payload if you change that setting. Managed webhooks are currently switched off in the hosted service.

Account sync

Account sync lets you use your workspace across devices. It can include settings, prompt presets, rows, usage, logs, copy/export state, and provider-key status.

When you sign in and this device has rows, you choose whether to add them to your account, replace them with your account's copy, or keep them on this device with sync off. After pressing Load account snapshot, you may be asked to choose Merge, Replace or Cancel. An invite code may also be kept in your browser until you create an account with email or clear your site data.

Google APIs and Drive export

Google Sheets export, Google Doc creation, and Google Workspace reading are user initiated. Export runs after you choose to append to a Sheet, create a Sheet, or create a Doc from the selected rows. Workspace reading runs only after you enable it and explicitly capture the open Doc or Sheet. Neither workflow bypasses file permissions or scans arbitrary Drive content. Google API information is used only to provide the requested workflow and is handled under the Chrome Web Store User Data Policy, including Limited Use requirements.

Storage, retention, and deletion

• Local workspace data remains in the browser, extension storage, local app storage, or local SQLite used by the local API until you clear it or remove it.
• Hosted account snapshots are stored for account continuity under the account service's retention rules; the account layer keeps a bounded recent history.
• Referral attribution records the referring profile and referred profile when a valid invite code is used during signup. Reward and credit logic is not active in this release.
• If signup or referral rewards are later tested, the hosted Worker can retain one bounded anti-abuse marker for a server-verified email or confirmed phone. The marker is a keyed, non-reversible digest and contains no raw email, phone, account ID, referral code, IP address, or device fingerprint. It may remain for up to 365 days after account deletion so deleting and recreating an account cannot repeat a grant. This control is not active unless its separate Worker secret is configured.
• To erase your account and its data yourself, sign in to the web app or the extension and open Account > My Account > Erase account and data. For other privacy questions, use Support and include the account email only through a private support channel.

What we do not do

• We do not sell user data.
• We do not use summarized content for personalized advertising.
• We do not intentionally collect browsing history beyond pages you ask the extension or app to capture.
• We do not ask users to upload raw provider keys into account snapshots.
• We do not run background release checks or attach workspace data to update requests.

Who is responsible, and how to reach us

The data controller for personal data processed through the Service is GrowthNodes ApS (Denmark), operating as YourStasis. For all privacy matters — questions, rights requests, or complaints — contact [email protected]. We respond to verified requests within the timelines described below.

Enrichment samples and service improvement

To improve enrichment quality, the hosted service keeps a sample of each hosted enrichment: the signals read from the page and the row the model wrote, linked to your account. When you copy or export a row, your edited copy is added. Samples exclude provider keys, passwords, sessions, and encrypted secrets. For Google Docs, Sheets and Slides, a sample keeps the file's address and title, not the text read from the file; the row the model wrote, and your edited copy of it, are kept as they are. They are used solely to tune enrichment behavior — for example, learning which model routes produce rows you keep versus rows you correct — and never for advertising. Samples are deleted after 30 days.

Legal bases for processing (GDPR)

We process personal data under the EU GDPR on these bases:

• Performance of a contract (Art. 6(1)(b)) — operating the Service you signed up for: authentication, enrichment you request, sync, export, and support.
• Legitimate interests (Art. 6(1)(f)) — securing the Service, preventing abuse and fraud, rate limiting, aggregate reliability metrics with small-cohort suppression, and improving enrichment quality using the minimized samples described above. We balance these interests against your rights, and you may object (see below).
• Consent (Art. 6(1)(a)) — optional features that you switch on: Google authorization and Workspace reading, screenshot fallback, and marketing email you subscribe to. Withdrawing consent is as easy as giving it: turn the feature off, remove access on your Google Account's permissions page, or use the unsubscribe link in any marketing email.
• Legal obligation (Art. 6(1)(c)) — where retention or disclosure is required by law.

Your rights and how to exercise them

Depending on your location, you may have rights to access, correct, delete, restrict, or receive a portable copy of your personal data, to object to processing based on legitimate interests, to withdraw consent, and to lodge a complaint with a supervisory authority — in Denmark, Datatilsynet, or the authority of your place of residence.

Use the built-in tools first — they are faster than a formal request:

• Access and portability: in the web app, sign in, open the menu > Account > My Account > Your data > Download my data. You get a JSON file of what our service holds about your account and a TSV file of the rows on that device. It leaves out provider keys and other secrets. You can also export rows to TSV, CSV, Excel, Markdown, JSON or NDJSON from the toolbar at any time.
• Deletion: Account → My Account → Erase account and data erases your account and the account data our service keeps, after you confirm it is you by signing in again within the last 10 minutes. You get a receipt that holds no personal data and shows any step that did not run. Rows you edited in other people's shared lists stay, with your name removed; saved copies of public videos stay, unlinked from you; billing records stay, unlinked from your account, and our payment provider keeps its own record; the anti-abuse marker described above keeps its own 365-day limit. Your address in our email tool is not yet removed automatically: email [email protected] and we remove it. Ticking “Also remove the rows saved on this device” removes the rows the app keeps on that device; to remove everything else stored there, uninstall the extension or the app, or clear the site data for the web app.
• Correction: every enriched row and setting is directly editable in place.

For anything the built-in tools do not cover, email [email protected]. So that we never disclose personal data to the wrong person, the following applies to formal requests:

• Identity verification is required. We will ask you to demonstrate control of the account email (and, where proportionate to the sensitivity of the request, additional confirmation) before acting. We cannot act on requests we cannot verify.
• Scope information may be requested. How much we hold depends on how you use hosted enrichment, sync, phone captures and sharing. We may ask you to specify what you are looking for so we can respond accurately.
• Timelines: we respond within one month of a verified request. For complex or numerous requests we may extend by up to two further months, as GDPR permits, and will tell you within the first month if so.
• Manifestly unfounded or excessive requests — in particular repetitive requests for the same data — may be refused or charged a reasonable administrative fee, as GDPR Art. 12(5) permits. If we refuse, we will explain why and inform you of your right to complain to a supervisory authority.
• Agent requests must include verifiable proof of your authorization.

California privacy rights (CCPA/CPRA)

• We collect the categories described on this page: identifiers (account email), content you submit for enrichment, configuration, and aggregate usage records. Sources: you, your devices, and the pages you ask us to enrich. Purposes: operating and securing the Service and improving enrichment quality.
• We do not sell personal information and we do not share it for cross-context behavioral advertising. We have not done so in the preceding 12 months. We use no third-party advertising or analytics trackers on this site or in the apps.
• California residents may exercise rights to know, delete, and correct via the same channels and verification process described above, and will not be discriminated against for doing so.

Storage, transfers, and subprocessors

• Hosted data is processed on infrastructure operated by Supabase (authentication and database) and Cloudflare (hosting, edge network, and storage), which may process data in the United States and other countries. Where GDPR applies to a transfer, it relies on appropriate safeguards such as Standard Contractual Clauses maintained by these providers.
• Content you submit for enrichment, and the rows you star-copy with a prompt together with that prompt, are sent to the model provider active in your configuration — the hosted provider (currently OpenAI), the provider of your own key (OpenAI or OpenRouter), or your local runtime. In local mode the model runs on your machine, so what you submit is not sent to a hosted model provider. Fetching a page you ask about, account sync, and any export or push you turn on still use the network.
• Google receives data when you sign in with Google, when you connect Google and use a Google feature, and when you ask our service to open a Google link.
• Supadata provides transcripts for video links.
• Transactional and subscribed marketing email is delivered through email service providers; unsubscribe links are honored immediately for marketing mail. When you send the contact form, your email address, any first name you give and the time are recorded with our email service. When you ask for setup tips by email, your email address, the time, the page you asked from and the download version are recorded there.

Retention

• Local and extension data: retained on your device until you clear it or uninstall.
• Account data and snapshots: retained until you erase your account.
• Webhook delivery receipts and background job records: up to 30 days.
• Credit and capability observation records: up to 90 days.
• Referral and reward identity records used for abuse prevention: up to 365 days.
• Enrichment samples and error logs: up to 30 days.
• Database backups held by our hosting providers: they expire within 30 days.
• Erasure receipts: kept as a record that an erase happened; they hold no personal data.

Security and breach notification

Data in transit is protected with TLS. Your key is saved on your device and sent through our service with each request so we can call your provider; we do not store it. It is not copied into your account unless you turn on encrypted account secrets (Account > Integrations). Optional key storage is encrypted on your device with a passphrase we never receive. Our aggregate platform analytics exclude content and identifiers. Troubleshooting logs, such as a diagnostic report sent from the phone app, can include your account identifier and error text. No system is perfectly secure; if a breach affects your personal data, we will notify you and the competent authorities as applicable law requires.

Cookies and site data

This website sets no advertising or analytics cookies and loads no third-party trackers. Our public pages store only the referral code you arrived with, in your browser's local storage, until you create an account with email or clear your site data. The web app stores your settings and workspace in your browser, as described above.

Children

The Service is not directed to children under 13 (or the higher local age of digital consent), and we do not knowingly collect their data. If you believe a child has provided us personal data, contact [email protected] and we will delete it.

Changes to this policy

We will update this page as the Service evolves and give reasonable notice of material changes on this site or by email. The “Last updated” date above always reflects the current version. Liability for the Service is governed by the Terms of Service.