Privacy Policy

1. Information We Collect

1.1 Information You Provide

When you use the Extension, you may provide the following information:

• Account Information: Email address and password (for authentication via Supabase Auth)
• Bookmarked Content: URLs, page titles, notes, tags, and folder assignments
• Screenshots: Images you capture and save via the Extension
• Credentials: Usernames and passwords you choose to store (encrypted with your master password)
• Master Password: A password you create to encrypt your stored credentials (never sent to our servers in plain text)

1.2 Information Automatically Collected

• Extension Usage Data: Information about how you interact with the Extension (e.g., number of bookmarks saved, features used)
• Browser Session Data: Temporary authentication tokens stored in your browser's local storage to maintain your logged-in session
• Tab Metadata: When you save a page, we access the active tab's URL and title (only when you explicitly click the save button)
• Analytics Information (Only If You Accept): If you choose to accept analytics through Trezio's consent prompt, we collect pseudonymous product-analytics data as described in Section 4.4. We do not collect this unless you accept, and it never includes your bookmarks, notes, screenshots, or credentials.
• Website Statistics (No Cookies): Our host, Cloudflare, provides us with aggregate statistics about visits to our website — for example which pages are opened, which websites visitors arrive from, and how quickly pages load — without using cookies, as described in Section 4.6.

1.3 Information We Do NOT Collect

• Browsing History: We do not track or record your browsing history
• Full Page Content: We do not read or store the full content of web pages you visit
• Advertising Trackers: We do not use advertising networks, ad tracking pixels, or sell or share your data for advertising purposes
• Passwords in Plain Text: Your master password and stored credentials are encrypted on your device before being sent to our servers

2. How We Use Your Information

2.1 Core Functionality

• Authentication: To verify your identity and maintain your logged-in session
• Bookmark Management: To save, organize, and sync your bookmarks across devices
• AI Enhancement: To generate summaries and tags for your bookmarks, on demand, when you request one from the edit screen — never automatically when you save
• Credential Storage: To securely store your login credentials using AES-256-GCM encryption

2.2 Service Improvement

• Bug Fixes: To diagnose and resolve technical issues
• Feature Development: To understand which features are most valuable and improve the Extension

2.3 Security

• Encryption: To protect your credentials using industry-standard encryption (PBKDF2 key derivation with 600,000 iterations, AES-256-GCM encryption)
• Auto-Lock: To automatically lock your credential vault after a period of inactivity

2.4 Getting-Started Emails

If you create an account but haven't saved anything yet, we may send you a small number of short emails offering help to get started — at most two automatically, in your first two weeks, and occasionally a personal note from our founder. We send these based on our legitimate interest in helping you use the service. We use only your email address and whether you have saved anything, and the emails are sent through our email provider, Resend. Every one has an unsubscribe link, and unsubscribing stops them for good. Emails about your account and billing are not affected.

3. Data Storage and Security

3.1 Where Your Data is Stored

• Supabase (PostgreSQL): Your account information, bookmarks, folders, and encrypted credentials are stored in a Supabase-hosted PostgreSQL database
• Browser Local Storage: Your authentication token and temporary vault unlock status are stored in your browser's local storage
• Client-Side Only: Your master password is never sent to our servers; it exists only in your browser's memory during active sessions

3.2 Encryption

• Credentials: All usernames and passwords you store are encrypted using AES-256-GCM encryption with a key derived from your master password via PBKDF2 (600,000 iterations). This is a zero-knowledge encryption model—we cannot decrypt your credentials without your master password.
• Transport Security: All data transmitted between the Extension and our servers uses HTTPS/TLS encryption.

3.3 Access Controls

• Row-Level Security (RLS): Database policies ensure you can only access your own data
• Authentication: All API requests require a valid session token
• Vault Passwords: Folder vault passwords are hashed using bcrypt (cost factor 10) before storage

3.4 Data Retention

• Active Accounts: Data is retained as long as your account is active
• Deleted Items: Items moved to trash are soft-deleted and can be recovered for 30 days
• Account Deletion: If you delete your account, all associated data is permanently deleted from our servers within 30 days

4. Third-Party Services

4.1 Supabase (Database & Authentication)

• Purpose: Backend database, authentication, and API hosting
• Data Shared: Account information, bookmarks, folders, encrypted credentials
• Privacy Policy: https://supabase.com/privacy

4.2 OpenAI (AI Summarization & Tagging)

• Purpose: Generate AI-powered summaries and tags for bookmarked content, only when you request one
• Data Shared: Page titles, URLs, and extracted metadata — sent only when you explicitly request a summary, via our authenticated backend, never automatically when you save something and never directly from your browser
• Privacy Policy: https://openai.com/policies/privacy-policy
• Note: OpenAI does not use this data to train their models (as per their API data usage policy)

4.3 Google Fonts (UI Typography)

• Purpose: Load fonts for the Extension's user interface
• Data Shared: Browser type, font requests
• Privacy Policy: https://policies.google.com/privacy

4.4 PostHog (Product Analytics — Only With Your Consent)

• Purpose: Privacy-conscious product and acquisition analytics — understanding how visitors discover Trezio, how they move from the landing page to creating a free account, which features get used, and where people run into trouble, so we can improve the product
• Data Shared: Pseudonymous usage data such as page visits, interactions with website and product features, signup/conversion journey events, browser and device characteristics, referral source, and campaign/UTM information when present. If you're signed in, this may be linked to your account identifier so we can connect journey steps to your session. It never includes your bookmarks, notes, screenshots, credentials, or other content you've stored in Trezio.
• Consent: This data is only collected after you explicitly accept analytics through Trezio's consent prompt. Declining does not limit your access to Trezio in any way — every feature remains fully available.
• Hosting: We use PostHog Cloud, hosted in the EU region
• Privacy Policy: https://posthog.com/privacy

4.5 Resend (Email Delivery)

• Purpose: Sending the emails Trezio sends you: reminders you schedule, and the onboarding emails described in Section 2.4
• Data Shared: Your email address and the content of that email (for a reminder, the saved item's title and link)
• Hosting: Emails are sent from Resend's EU region (Ireland)
• Privacy Policy: https://resend.com/legal/privacy-policy

4.6 Cloudflare (Hosting, Security & Website Statistics)

• Hosting and Security: Cloudflare hosts and delivers trezio.app and app.trezio.app. Like any website host, it processes your IP address and standard request information (such as the page requested, your browser type and the time of the request) to deliver the site, keep it secure, and protect it from abuse.
• Website Statistics: We use Cloudflare Web Analytics to understand our website traffic in aggregate — for example the number of page views, which pages are opened, which websites refer visitors, and how quickly pages load. It does not use cookies or your browser's storage, and it is not used to build a profile of you or to follow you across websites. It records the page path (without the query string or anything after “#”), the referring website, browser, operating system and device type, an approximate country based on your connection, and page-load timing. We look at this information as aggregate reports, not as records of individual people.
• Consent and Coverage: Because these statistics don't use cookies or other storage on your device, they are collected independently of the analytics consent prompt. Browser privacy tools and ad blockers may stop them from loading, so they do not capture every visit.
• How This Differs From PostHog: PostHog (Section 4.4) is separate. It records individual interactions with our website and product, and only after you accept analytics. Declining analytics turns PostHog off; it does not affect Cloudflare's hosting or aggregate website statistics.
• Privacy Policy: https://www.cloudflare.com/privacypolicy/

We do not share your data with advertising networks, data brokers, or anyone building behavioral profiles for advertising. The only third parties we share data with are the service providers listed in this section, each limited to the specific purpose described — including PostHog, which only receives analytics data if you've accepted analytics.

5. Permissions Explained

The Extension requests the following browser permissions:

6. Your Privacy Rights

6.1 Access and Control

• View Your Data: Log in to your Trezio account at https://trezio.app to view all your stored bookmarks and folders
• Edit Your Data: You can edit, delete, or export your bookmarks at any time
• Download Your Data: Use the export feature to download a versioned JSON backup of your library, with HTML and CSV formats also available
• Change Your Analytics Decision: You can change your mind about analytics at any time. If you're signed in, open Settings > Analytics. If you're not signed in, use the "Privacy choices" link in the footer of this and other pages. Either way, your choice updates immediately.

6.2 Account Management

• Change Password: Update your account password in your profile settings
• Change Master Password: Reset your master password (note: this will require re-encrypting all stored credentials)
• Delete Account In-App: Open Settings > Danger Zone > Delete Account in the Trezio web or mobile app to permanently delete your account and associated data
• Delete Account by Request: If you no longer have app access, email support@trezio.app from your account email address with the subject "Trezio Account Deletion Request"

6.3 Regional Rights

Depending on your location, you may have additional rights under privacy laws:

• GDPR (EU/EEA): Right to access, rectification, erasure, data portability, and objection
• CCPA (California): Right to know, delete, and opt-out of data sales (note: we do not sell your data)
• Other Regions: We respect privacy rights globally and will honor reasonable requests

7. Children's Privacy

The Extension is not intended for users under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at support@trezio.app.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will:

1. Update the "Last Updated" date at the top of this document
2. Notify you via email (if you've provided an email address)
3. Display a prominent notice in the Extension or on our website

Your continued use of the Extension after changes take effect constitutes your acceptance of the updated Privacy Policy.

9. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your data, please contact us:

10. Technical Details for Security Researchers

For transparency, we provide the following technical details about our encryption implementation:

Credential Encryption Specifications

• Algorithm: AES-256-GCM (Galois/Counter Mode)
• Key Derivation: PBKDF2-SHA256 with 600,000 iterations
• Salt: 128-bit random salt (unique per user)
• IV: 96-bit random initialization vector (unique per encryption operation)
• Authentication Tag: 128-bit AEAD tag for integrity verification

Zero-Knowledge Architecture

1. Master Password Setup: User creates a master password in the browser
2. Key Derivation: Browser derives encryption key using PBKDF2 (never sent to server)
3. Encryption: Credentials are encrypted client-side before transmission
4. Storage: Only encrypted ciphertext is stored in the database
5. Decryption: Only the user's browser can decrypt credentials using the master password

11. Compliance

We aim to handle your personal data in accordance with applicable privacy and data-protection requirements, including frameworks such as the following where they apply to you:

• GDPR (General Data Protection Regulation - EU), for users in the EU/EEA
• CCPA (California Consumer Privacy Act), for California residents
• Chrome Web Store Developer Program Policies
• Mozilla Add-on Policies