Privacy policy

A capture happens only when you take an explicit action — clicking an element with the picker or pressing the full-page capture button. Nothing is ever captured in the background.

When you capture, Grabby stores:

• the selected element's HTML structure, text and styles (or the whole page in page mode);
• images and fonts that element references, so the capture renders faithfully;
• the page URL and title, so you can tell your captures apart;
• your viewport size, so the editor can reproduce the layout context.

Captured content is sanitized on our server before storage: scripts, event handlers and executable URLs are stripped. Password fields are excluded from form-state capture.

Signing in uses Google via Supabase Auth — there is no Grabby password. We store the basic profile Google shares: your email address, display name, and avatar URL. Your captures are linked to your account so you can revisit them from your dashboard. An essential session cookie keeps you signed in; it is not used for tracking.

Grabby Pro subscriptions are processed by Stripe. Your card details go directly to Stripe and never touch our servers — we store only your subscription status and a Stripe customer reference so the app knows you're on Pro. Manage or cancel anytime from the billing portal on your dashboard.

• No browsing history — the extension does nothing until you activate it.
• No keystrokes, no passwords, no clipboard.
• No analytics or tracking SDKs, in the extension or the editor.
• No card numbers — payment details live with Stripe, not us.

Captures are stored with Supabase in Canada (region ca-central-1). The capture document is stored in a private bucket and served only through short-lived signed URLs. Referenced images and fonts are stored under content-addressed, unguessable paths.

A capture is identified by an unguessable random ID, and its editor link works for anyone who has it — like an unlisted link. Editing additionally requires a secret edit token that only your browser holds (we store only its hash). Don't capture confidential screens if you plan to share the link.

Captures on the free plan expire 30 days after creation; a scheduled cleanup permanently deletes the database record, the capture document, and all stored assets. Grabby Pro captures are kept until you delete them. If a Pro subscription ends, your captures fall back to the free 30-day rule, counted from that day — never deleted instantly. You can delete any capture immediately from your dashboard, and account deletion requests are honored by email.

To keep the free service alive we store a salted hash of the capturing IP address (never the address itself) alongside each capture, and we rate-limit the API per IP. The hash is used only to throttle abuse and bulk-revoke abusive uploads.

The extension keeps your settings and a list of your recent captures (including their edit tokens) in Chrome's local extension storage. The editor keeps edit tokens in your browser's local storage so autosave works. Both stay on your device and are removed when you uninstall the extension or clear site data.

Chrome shows a "read and change all your data on all websites" warning because Grabby requests access to all sites. It needs that access for exactly one reason: fetching the stylesheets, fonts and images of the page you are capturing — including cross-origin ones — so the capture is pixel-faithful. The extension's content script stays inert until you activate it, and captures only ever start from your explicit click.

We don't sell, rent, or share your data with anyone. Data is processed only by our infrastructure providers (Supabase for storage and database, Vercel for hosting) as needed to run the service.

If this policy changes materially we'll update this page and the effective date above. Questions or deletion requests: contact@webprojectsolutions.com.