ClipDesk Privacy Policy

Support and privacy contact: clipdesksupport@gmail.com

This page is intended to be publicly accessible without login, Clerk auth, extension installation, or dashboard access.

ClipDesk is a local-first Chrome extension for clipping, organizing, searching, understanding, and exporting research from webpages and PDFs.

Developer and support contact: clipdesksupport@gmail.com

ClipDesk is designed so the signed-out local core works on the user's device. Local capture, local library, notes, tags, search, exports, settings, diagnostics, on-device AI, and on-device OCR can all work without an account. Some optional features send specific data to a named service, but only when the user uses that feature or turns on the setting that does so. Each is described below.

Account features are optional. Local ClipDesk capture, save, search, backup, and export workflows still work without an account. The extension does not silently upload the existing local library after sign-in. Sync is opt-in, off by default, and requires a signed-in Clerk/ClipDesk account plus a backend-confirmed entitlement. Clip content sync requires separate explicit consent. ClipDesk's use of information received from Chrome extension APIs and Google APIs adheres to the Chrome Web Store User Data Policy and the Google API Services User Data Policy, including the Limited Use requirements.

ClipDesk may handle the following data depending on which features the user chooses to use:

• User-created research content: clipped webpage text, selected text, PDF text, OCR text, highlights, clip titles, source URLs, page titles, timestamps, notes, tags, collections, favorites, saved filters, comments, research sessions, synthesis matrices, extraction tables, review schedules, AI summaries, and export metadata.
• Browser and local extension data: extension settings, onboarding state, local database records, export preferences, the on-device search index, local diagnostics summaries, permission state, sync queue state, and local error or status codes.
• Credentials the user adds: API keys for AI providers or OpenAlex, and access tokens for Readwise or Notion. These stay in chrome.storage.local on the device.
• Account data: email address, account ID, profile name or label, authentication state, session status, subscription plan, entitlement status, and connected-device metadata shown by account features.
• Optional sync data: sync manifests, object metadata, clip metadata, selected sync scopes, cursors, conflict records, and synced clip content only if the user separately enables the relevant clip-content sync scope.
• Billing data: Stripe customer ID, subscription ID and status, plan or tier, billing interval, price ID, entitlement status, checkout or billing-portal status, and related billing metadata needed to provide paid features. ClipDesk does not collect or store full card numbers, CVC values, or raw card data.
• Support data: user-submitted support request content, contact email, issue category, safe diagnostic summaries, app version, browser version information, and non-secret technical metadata needed to investigate a report.

ClipDesk stores the local library in the user's Chrome profile using browser-managed storage such as IndexedDB and extension storage.

Saved clips and everything created from them remain on the user's device unless the user takes an action that moves them, such as exporting, copying, enabling sync, sending a clip to a connected app, using an AI feature with a provider, or requesting support.

The on-device AI model (all-MiniLM-L6-v2), the on-device transcription model (Whisper tiny), the OCR engine (Tesseract), and the PDF reader (PDF.js) are packaged inside the extension and run locally. They do not download code or send data.

Uninstalling the extension or clearing browser data may delete local data depending on Chrome behavior. Users can back up and restore their data with the local backup controls.

AI features are optional. The user chooses where each one runs.

• On this device ("Local AI", on-device summaries, Local Whisper): processing happens on the user's computer with the packaged models. Nothing is sent anywhere.
• With the user's AI provider: the user connects their own provider in Settings, either by signing in with Google for Gemini or by pasting an API key for Google Gemini, Anthropic, or OpenAI. Requests go directly from the extension to that provider, never through ClipDesk servers.
• Ask your library: the question and up to eight relevant passages from the user's saved clips, when the user asks.
• Summaries: a clip's title, source site, and up to the first 12,000 characters of its text. This happens when the user clicks "Summarize", runs "Summarize existing clips" (which first shows how many clips will be sent), or has turned on "Summaries when you save → With your AI provider". That setting is off by default.
• Extraction table: each selected source's text, one request per source, when the user runs it.
• Research draft expansion: the draft ClipDesk built from the selected clips (their titles, excerpts, and citation markers), when the user runs it.

What is sent to the provider, and when:

The provider's own terms and privacy policy govern what it does with requests. ClipDesk sends only what is listed here, and never sends account identifiers, other clips, or the user's API keys for other services.

These run only when the user clicks the corresponding button on a clip:

• Source check sends the clip's DOI to Crossref to look for retractions and preprint status.
• Find related work sends the DOI and related OpenAlex work ids to OpenAlex, with the user's own OpenAlex key if they added one.
• Save to Wayback Machine sends the clip's source URL to the Internet Archive, which then fetches and publicly archives that page. The button says so.

No clip text, notes, or account information is sent by these lookups.

When the user sends a clip to a connected app, ClipDesk sends it directly to that app with the user's own credentials:

• Readwise: the clip's URL, title, author, captured HTML, note, and tags, using the user's Readwise access token.
• Notion: the clip's title, note, text, and source URL, using the user's Notion integration token and chosen database.
• Google Docs: the clip's title, note, text, and source URL, creating a new document in the user's Google account after the user signs in with Google.

The user picks a transcription engine each time:

• Local Whisper: audio from a tab, video, or file is transcribed on the device. Nothing is sent.
• Local mic: uses the browser's built-in speech recognition. In Chrome this may send microphone audio to Google's speech service to produce the text.
• OpenAI Whisper: audio from a tab, video, or file is sent to OpenAI with the user's own OpenAI API key.

Tab audio is captured only for the tab the user is on, only while the user is recording. Transcripts are saved locally; audio is not kept.

Signing in with Google is optional. It uses Chrome's identity API. Google access tokens are held by Chrome, and ClipDesk stores only the fact that the user signed in.

• For Gemini, the token is used only to send the user's AI requests to Google's Gemini API.
• For Google Docs, the token is used only to create the document the user asked for.

ClipDesk's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the feature the user requested. It is not sent to ClipDesk servers, not used for advertising, not sold, not used to train AI models, and not read by people. Signing out in Settings drops the token Chrome holds for ClipDesk.

Users can use the local-first core without signing in.

Signing in is optional for account-based features such as entitlement display, connected-device views, billing status, cloud deletion requests, OCR allowances, and sync eligibility.

ClipDesk uses Clerk for authentication and account identity. Clerk may process account identity and session data needed for sign-in, sign-out, and session handling.

Signing in does not automatically upload an existing local library.

Product analytics is off by default. When the user turns on "Share anonymous product analytics", ClipDesk sends content-free usage events and error reports to the ClipDesk backend, which forwards them to Google Analytics 4. Turning it off stops sending and clears anything waiting to be sent.

Events contain only approved event names, coarse categories, counts, plan type, success or failure, error codes, the extension version, and a random device-scoped analytics id that is not linked to the user's account. Error reports contain only an error category and a hash of where in ClipDesk's code the error happened.

These events never contain clip text, notes, URLs, domains, page titles, tags, search terms, email addresses, account ids, tokens, or payment details. Advertising features and ad personalization are disabled.

Sync is optional and user-controlled.

Sync is off by default.

Sync requires a signed-in account and backend-confirmed entitlement.

Free accounts cannot enable cloud sync.

If the user enables sync, ClipDesk may transmit selected data to ClipDesk backend services only for the scopes the user enables. Metadata-only defaults include settings, collections, saved filters, and clip metadata. Optional clip content—including captured webpage text, saved PDF text, OCR text, and HTML—requires a separate content-upload confirmation. AI summaries are never synced.

Clip content sync requires separate explicit confirmation.

Existing local clips are not uploaded automatically on sign-in.

ClipDesk uses HTTPS for backend communications. ClipDesk does not claim end-to-end encryption for synced content.

ClipDesk uses Stripe for checkout, billing portal, subscription management, and payment processing.

Billing is handled by Stripe on Stripe-hosted pages. The extension opens backend-created Stripe Checkout or billing portal URLs in a browser tab. The extension does not store card numbers, CVC values, or other payment form data. The extension does not embed card or payment collection inside the extension UI.

ClipDesk backend services may store Stripe customer IDs, subscription IDs, plan or tier information, billing interval, subscription status, entitlement status, and related billing metadata needed to provide paid features.

Users may voluntarily submit support requests.

Support requests may include contact details, issue descriptions, ClipDesk version information, browser version information, and safe diagnostics.

Safe diagnostics are designed to exclude private clip bodies, note contents, raw PDF text, sanitized HTML bodies, full backup payloads, API keys, tokens, secrets, and payment card data.

If a user manually pastes private content into a support request, ClipDesk may receive what the user voluntarily submits.

ClipDesk shares data only as needed to provide user-requested features, operate the service, process billing, respond to support requests, comply with law, or protect users and service security.

Services that may receive data, each only as described above:

• AI providers chosen by the user: Google (Gemini), Anthropic, OpenAI.
• Research services: Crossref, OpenAlex, the Internet Archive.
• Connected apps chosen by the user: Readwise, Notion, Google Docs.
• Speech recognition: the browser's speech service (Local mic) or OpenAI (OpenAI Whisper).
• Clerk: authentication, account identity, and session handling.
• Stripe: checkout, billing portal, subscription handling, and payment processing. Payment card details are processed by Stripe on Stripe-hosted pages, not stored by ClipDesk.
• Google Analytics 4: optional, content-free product analytics, only if the user turns it on.
• Hosting, backend, and database providers used to operate ClipDesk account, sync, OCR allowance, deletion, and billing-support services.
• Chrome and Google platform services: extension distribution, browser-managed storage, and extension APIs.
• Email and support providers, if a user contacts clipdesksupport@gmail.com.

ClipDesk does not sell user data.

ClipDesk does not share clipped research content with advertisers.

ClipDesk does not use user data for advertising or behavioral ad targeting.

Local data remains in the user's browser profile until the user deletes clips, resets ClipDesk data, clears diagnostics, replaces data through import, uninstalls the extension, or clears browser data.

Data sent to an AI provider, research service, or connected app is retained according to that service's policies. ClipDesk keeps no copy of it on its servers.

Account and backend records may be retained while the account, subscription, sync, or support relationship exists and afterward as needed for legal, billing, security, fraud-prevention, operational, and compliance purposes.

Synced data, if enabled, remains until the user disables sync, deletes cloud data, deletes the account if that workflow is supported, or requests deletion through available account or support channels.

Billing records may be retained as required for accounting, tax, fraud prevention, legal, and compliance obligations.

Users can:

• export, copy, or download clips locally;
• back up and restore their library;
• delete individual clips, remove AI summaries and the tags they added, or reset local data;
• choose where AI features run, or not use them at all;
• remove saved API keys and tokens, and sign out of Google;
• turn product analytics on or off;
• clear local diagnostics;
• disable sync;
• request cloud data deletion for backend-stored sync data where supported;
• manage billing through Stripe-hosted billing controls where supported;
• contact support for privacy, access, export, or deletion requests; and
• uninstall the extension or clear browser data through browser-level controls.

Cloud deletion does not automatically delete local data.

ClipDesk uses HTTPS for all network communication.

Secret keys for ClipDesk's own services are not stored in source code or client bundles shipped to users. API keys the user adds stay in chrome.storage.local on their device and are sent only to the service they belong to.

Payment details are handled by Stripe-hosted pages rather than inside the extension UI.

Diagnostics are designed to exclude private content and secrets.

No method of storage, software, or transmission is absolutely secure, and ClipDesk does not promise absolute security.

ClipDesk's privacy behavior is tied to the extension permissions declared in manifest.json:

• activeTab: read the current page only when the user triggers capture.
• alarms: a periodic wake-up that sends queued analytics events. It sends nothing unless the user has turned analytics on.
• contextMenus: explicit right-click capture actions.
• cookies: optional Clerk authentication flows and session continuity with clipdesk.io.
• scripting: inject the packaged capture and highlight code into the page at user request.
• storage: local settings, credentials the user adds, session-safe state, and diagnostics summaries.
• sidePanel: the primary ClipDesk interface runs in Chrome's side panel.
• tabCapture: record audio from the current tab only when the user starts a tab transcription.
• identity (with the oauth2 client in the manifest): optional "Sign in with Google" for Gemini and for creating Google Docs.
• offscreen: run the packaged transcription and on-device AI models in an extension-owned page so they do not block the side panel.
• host_permissions: limited to https://clipdesk.io/* and https://clerk.clipdesk.io/* for account-connected website and sign-in flows.
• optional_host_permissions (http://*/*, https://*/*): requested at the moment of use, never at install, so ClipDesk can capture the page the user chooses and reach the specific service a feature calls (an AI provider, Crossref, OpenAlex, the Internet Archive, Readwise, Notion, or Google).
• externally_connectable: limited to https://clipdesk.io/* and https://www.clipdesk.io/* so the ClipDesk website can complete account connection.

ClipDesk does not request identity.email and does not read the user's Google profile or email through Chrome.

ClipDesk is not intended for children under 13 or for users below the minimum age required in their jurisdiction. ClipDesk does not knowingly collect children's personal information. If a parent or guardian believes a child provided personal information, they can contact clipdesksupport@gmail.com.

Data may be processed in the United States or other countries where ClipDesk or its service providers operate.

Depending on the user's location, the user may have rights such as access, correction, export, deletion, or objection or restriction rights. Users can contact support to make a request, and ClipDesk will review the request in light of applicable law and technical or legal obligations.

ClipDesk may update this policy from time to time. When material updates are made, the effective date will be changed. Users should review this policy when the extension or connected services change.

For support, privacy, export, deletion, or data-handling questions, contact clipdesksupport@gmail.com.

The clipdesk.io website uses Clerk for sign-in and Stripe for checkout, as described above.

The website loads Google Analytics with analytics storage denied by default. Google Analytics sets cookies only if you choose Accept in the cookie banner. A browser Global Privacy Control signal is treated as a decline. To change your choice later, clear this site's data in your browser and choose again. Advertising storage, ad user data, and ad personalization stay denied.

Website analytics is separate from the extension's optional product analytics in section 11.