Privacy policy

A capture happens only when you take an explicit action — clicking an element with the picker or pressing the full-page capture button. Nothing is ever captured in the background.

When you capture, Grabby stores:

• the selected element's HTML structure, text and styles (or the whole page in page mode);
• images and fonts that element references, so the capture renders faithfully;
• the page URL and title, so you can tell your captures apart;
• your viewport size, so the editor can reproduce the layout context;
• a small screenshot cropped to the area you selected, taken at the moment you capture. It becomes the preview on your dashboard and the link preview when a capture is shared. It is a picture of that part of the page as it looked on your screen, so whatever was visible there is in it.

Captured content is sanitized on our server before storage: scripts, event handlers and executable URLs are stripped. Password fields are excluded from form-state capture.

Signing in uses Google via Supabase Auth — there is no Grabby password. We store the basic profile Google shares: your email address, display name, and avatar URL. Your captures are linked to your account so you can revisit them from your dashboard. An essential session cookie keeps you signed in; it is not used for tracking.

Grabby Pro subscriptions are processed by Stripe. Your card details go directly to Stripe and never touch our servers — we store only your subscription status and a Stripe customer reference so the app knows you're on Pro. Manage or cancel anytime from the billing portal on your dashboard.

• No browsing history — the extension does nothing until you activate it.
• No keystrokes, no passwords, no clipboard.
• No analytics or tracking SDKs, in the extension or the editor.
• No card numbers — payment details live with Stripe, not us.

Captures are stored with Supabase in Canada (region ca-central-1). The capture document is stored in a private bucket and served only through short-lived signed URLs. Referenced images and fonts, and the preview screenshot, live in a public bucket under unguessable, content-addressed paths — reachable only by someone who already has the exact path.

Every capture gets a public page, and it is on by default. The address uses an unguessable random ID, so nobody can browse, search or guess their way to it — but anyone you give the link to can open it, see the component, and take their own copy into their own account. Their copy is independent and cannot change yours.

You can turn this off for any capture: open it in the editor and choose Share → Make it private. The public page stops working for everyone immediately.

Editing always requires more than the link — either the secret edit token that only your browser holds (we store just its hash) or a signed-in session that owns the capture. Having the link is never enough to change your work.

Because sharing starts on, treat anything you grab from an internal tool, a staging site, or a logged-in screen as something to make private right after you capture it — or don't capture it at all.

Captures on the free plan expire 30 days after creation; a scheduled cleanup permanently deletes the database record, the capture document, and all stored assets. Grabby Pro captures are kept until you delete them. If a Pro subscription ends, your captures fall back to the free 30-day rule, counted from that day — never deleted instantly. You can delete any capture immediately from your dashboard, and account deletion requests are honored by email.

To keep the free service alive we store a salted hash of the capturing IP address (never the address itself) alongside each capture, and we rate-limit the API per IP. The hash is used only to throttle abuse and bulk-revoke abusive uploads.

The extension keeps your settings and a list of your recent captures (including their edit tokens) in Chrome's local extension storage. The editor keeps edit tokens in your browser's local storage so autosave works. Both stay on your device and are removed when you uninstall the extension or clear site data.

Chrome shows a "read and change all your data on all websites" warning because Grabby requests access to all sites. It needs that access for exactly one reason: fetching the stylesheets, fonts and images of the page you are capturing — including cross-origin ones — so the capture is pixel-faithful. The extension's content script stays inert until you activate it, and captures only ever start from your explicit click.

We don't sell, rent, or hand your data to anyone. Data is processed only by our infrastructure providers (Supabase for storage and database, Vercel for hosting) as needed to run the service. Share links are the one exception, and they are yours to control — see Who can see a capture above.

If this policy changes materially we'll update this page and the effective date above. Questions or deletion requests: contact@webprojectsolutions.com.