Privacy policy
What the extension holds, what it sends, and what it is structurally unable to do.
The short version
The extension exists to send a page you are reading, or text you have selected on it, to your own Slate vault. It does that and nothing else. There are no accounts, no analytics, no tracking pixels, no advertising, and no third parties. Nothing is sold, rented, or shared.
What it stores on your device
When you connect the extension, it saves four things in Chrome's local extension storage, on that computer only:
- Your vault id — an opaque identifier.
- That vault's public capture key — the half of a key pair that can only seal, never open.
- The endpoint URL clips are posted to.
- The folder you chose for clips, if you chose one.
That is the complete list. No note content, no browsing history, no credentials. Removing the extension, or clicking Disconnect, deletes all of it.
What leaves your browser when you clip
Only when you explicitly clip — by clicking the toolbar button, choosing the right-click item, or pressing the keyboard shortcut — the extension reads the current page's title, URL, and text, or your selection. It then builds a clip and seals it in your browser, before any network request is made, to your vault's public key.
| Field | How it travels |
|---|---|
| Clipped text | Encrypted. Unreadable to the server. |
| Page title | Encrypted. Unreadable to the server. |
| Source URL | Encrypted. Unreadable to the server. |
| Destination folder | Encrypted — a plaintext folder name would leak the shape of your vault. |
| Vault id | In the clear. Says which mailbox the sealed clip belongs in. |
| Public capture key | In the clear. Checked against that vault's keyring. |
The sealed clip is held on the Slate sync server until a signed-in copy of Slate pulls it down and opens it with the private half of the key — which lives only in your vault, wrapped under your vault password, and never in this extension. The operator of the server cannot read your clips.
What it never does
- Runs on pages you have not asked it to clip. It declares no host permissions; access is granted by your click and ends with the clip.
- Reads, searches, lists, or deletes anything already in your vault.
- Records browsing history, page visits, or which sites you use it on.
- Sends anything to any analytics, advertising, or third-party service.
- Loads or evaluates remote code. Everything it runs ships in the package.
Permissions, and why each one is there
| Permission | Why |
|---|---|
| activeTab | To read the tab you are clipping, at the moment you clip it — chosen over broad site access on purpose. |
| scripting | To extract the article text and your selection, only in response to a clip you started. |
| contextMenus | To put “Clip selection to Slate” in the right-click menu. |
| storage | To keep the four connection settings listed above, on your device. |
Retention and deletion
A sealed clip sits on the sync server only until your Slate pulls it down, after which it is removed. Clips that are never collected can be deleted by disconnecting the vault. To remove everything the extension holds, click Disconnect in its popup or uninstall it.
Children
Slate Clipper is not directed at children under 13 and collects no information from them.
Changes
If this policy changes in a way that affects what is collected or how it is handled, the date at the top will change and the new version will be published here before the change ships.
Verifying any of this
The extension is open source. The sealing step described above is
sendClip in extension/src/capture.ts, and the
stored settings are extension/src/settings.ts —
github.com/adamgdvs/slate.
Contact
Questions, or a privacy report: open an issue on the repository.