Gray Hole
隐私政策
逐项技术清单——扩展申请的每个浏览器权限对应什么功能、可能发起哪些网络请求、云同步会写入哪些字段——见 权限与联网说明。本页只讲数据本身。
一、一句话摘要
Gray Hole 默认是纯本地工具。摘录存在你自己浏览器的 IndexedDB 里，不经过我们的服务器——因为我们没有用来收集摘录的服务器。云同步是可选的：只有你在账户页主动注册并登录之后，摘录才会被镜像到云端。
我们不投放广告，不抓取你的浏览历史，也不训练任何模型。扩展端没有任何遥测。官网同时使用自建的匿名流程统计与 Google Analytics 4（见第五节）；两者只覆盖官网，不采摘录内容。
二、我们收集哪些数据
| 数据 | 何时产生 | 内容 |
|---|---|---|
| 摘录内容 | 始终，但只在你本机 | 正文与 Markdown 副本、标题、来源信息、标签、收藏夹、你保存的图片字节。全部存储在你的浏览器里，我们不接收 |
| 邮箱地址 | 仅当你注册账号 | 用于登录、找回密码与必要的账号通知 |
| 密码哈希 | 仅当你注册账号 | 由 Supabase Auth 以不可逆方式派生后存储。我们以及任何能读到数据库的人都无法看到明文，也无法从哈希反推 |
| 用户 ID | 仅当你注册账号 | 一个随机 UUID，作为云端各表中数据行归属与隔离的依据 |
| 注册时间与显示名 | 仅当你注册账号 | 显示名由邮箱前缀自动生成 |
| 摘录的云端镜像 | 仅当你注册账号并开启云同步 | 逐字段清单见 权限与联网说明 第三节 |
| 官网流程统计 | 仅当你访问本站 | 自建统计记录事件名、时间戳、页面路径、站点语言、随机 ID、IP + User-Agent 的单向去重键和爬虫标记；启用 GA4 时，Google 处理页面与浏览器/设备统计信息。两者均不发送摘录内容，详见第五节 |
我们不要求也不接收手机号、真实姓名、身份证件、头像或任何社交账号授权。
来源地址可能包含私密信息。为了让摘录能回到原文，我们保留原始页面地址；如果那个地址里带着会话 ID、查询参数或一次性令牌，它们也会被一起保存。导出的 JSON 备份与云端镜像都请当作不适合公开分享的内容对待。
三、数据存放在哪里
| 数据 | 存放位置 | 前提 |
|---|---|---|
| 摘录正文、标题、标签、收藏夹、图片字节 | 你浏览器的 IndexedDB（库名 tata-clipper-v1） | 默认，始终 |
| 邮箱、密码哈希、用户 ID、摘录镜像 | Supabase 托管数据库，位于美国西部（俄勒冈） | 仅当你注册账号 |
| 登录凭证（访问令牌） | 扩展：chrome.storage.local；网页：该站点的 localStorage | 仅当你注册账号 |
官网静态页面由 Cloudflare 的全球边缘网络分发，不存储你的账号数据。
注册账号意味着数据出境。如果你不在美国，注册即表示你的邮箱地址与摘录镜像会被传输并存储到美国的服务器上。我们选择这个区域是为了保证服务可用性，但你需要知道这一点——尤其当你打算摘录涉及个人信息、商业秘密或受本地法规约束的内容时。
不想跨境传数据，就不要注册账号。不注册时 Gray Hole 的全部功能（采集、整理、搜索、导出）都在你本机完成，没有任何数据离开你的设备。本地优先是默认档，不是降级选项。
四、我们不做的事
- 不自动保存整页，不遍历你的历史对话，不读取输入框，不监听键盘输入；
- 不采集你访问了哪些网站、停留多久、点击了什么——扩展端从不发送任何统计；官网只统计自己页面的打开与站内关键按钮的点击（边界见第五节）；
- 扩展不嵌入分析统计 SDK、广告 SDK、行为追踪像素或第三方字体；官网只使用第五节披露的 Google Analytics 4，不加载广告 SDK；
- 不把摘录内容用于训练模型，也不提供给任何第三方做模型训练；
- 不出售、出租或以任何形式向广告商提供你的任何数据；
- 不在收藏库里自动加载外部图片当缩略图——否则你每次翻看收藏都会向原作者服务器暴露一次请求。
五、官网的匿名流程统计
官网——且只有官网——会记录「哪一步页面被打开、站内哪个关键按钮被点击」，用来知道漏斗卡在哪里。自建统计记录只有：事件名、时间戳、页面路径、站点语言，以及一个存在你浏览器里的随机 ID；登录后会附带用户 ID，以便把多台设备上的同一个人对齐。
为排除爬虫，数据库会从该次请求的 IP 与 User-Agent 即时生成一个单向匿名键，并记录该 UA 是否命中常见爬虫/自动化标识。原始 IP 和原始 User-Agent 都不会写入表；该键只用于在看板中按「IP + UA」去重。官网也使用 Google Analytics 4 记录页面浏览和同一套短事件名（例如 get_started_view）；GA4 不接收摘录正文、标题、来源地址、搜索词或账号资料。浏览器开启「请勿追踪（DNT）」时，官网不加载 GA4，也不发送自建流程事件。扩展端不存在这一项。
保留 180 天后自动清理；想提前删掉与你关联的记录，见第七节。
六、第三方服务
| 服务 | 用途 | 接触到的数据 |
|---|---|---|
| Supabase | 账号认证、云同步数据库托管，以及官网匿名流程统计的存储 | 仅在你注册后：邮箱、密码哈希、用户 ID、摘录镜像；流程统计含事件级匿名数据、IP + UA 的单向匿名键与爬虫标记，不含原始 IP 或 UA。数据库区域为美国西部（俄勒冈） |
| Cloudflare | 承载 grayhole.tech 静态站点 | 访问本站时的常规请求日志（IP、User-Agent） |
| Google Analytics 4 | 官网页面与流程事件的聚合分析 | 页面路径、短事件名及浏览器/设备统计数据；不发送摘录内容、来源地址或账号资料。DNT 开启时不加载 |
| Resend | 发送账号验证与密码重置邮件 | 你的邮箱地址，以及邮件投递所需的元数据 |
这些服务商都按需处理数据，不因我们的业务获得对你的数据的使用权。
七、保留与删除
- 本地数据由你完全控制。在收藏库设置里可以清空，卸载扩展并清除站点数据也会一并删除。我们碰不到这部分。
- 云端镜像在你主动删除摘录后，以软删除标记传播到其他设备。永久删除需要在你本地再确认一次。
- 账号可以在账户页退出登录，也可以随时写信要求删除账号。收到请求后我们会在 30 天内删除你的账号记录及全部云端摘录，并回复确认。
- 流程统计记录保留 180 天后自动清理。想提前删掉与你关联的记录（含那个随机 ID），写信到 [email protected] 即可；清除浏览器站点数据也会让随机 ID 失效重置。
- 备份：导出功能随时可用，包含回收站记录与本地图片字节。我们不会用「导出墙」来挽留你。
八、安全
- 云端所有表都启用了行级安全（Row Level Security），策略为
user_id = auth.uid()。隔离在数据库层强制执行，不依赖应用代码是否写对。 - 进入扩展与站点的只有 anon 公开密钥——它只能触达登录用户自己的数据行。绕过 RLS 的
service_role密钥从不进入任何前端代码。 - 登录凭证存在
chrome.storage.local（扩展）与该站点的localStorage（网页），内容脚本被限制为无法读取它。GA4 只在不含登录凭证的公开页面加载；账户与云端工作台不加载第三方分析脚本。 - 所有通信走 HTTPS。密码在服务端以不可逆方式派生后存储。
需要说明的是：我们无法承诺绝对安全。任何系统都可能被攻破。我们能做到的是把攻击面压到最小——没有多余的数据、没有多余的依赖、没有多余的权限。
九、未成年人
Gray Hole 不面向 13 岁以下儿童，也不会主动收集儿童的个人信息。如果你是家长或监护人，发现孩子未经你同意注册了账号，请写信给我们，我们会删除该账号及其数据。
十、变更与联系
本政策如有实质性变更，我们会更新页面顶部的生效日期，并在站点首页公告至少 14 天。涉及数据收集范围扩大的变更，会在生效前通过账号邮箱另行通知。
隐私相关问题、数据访问与删除请求：[email protected]
一般支持与故障反馈：[email protected]
Privacy Policy
The itemised technical list — what each browser permission is for, every network request the extension can make, and which fields cloud sync writes — is in Permissions & network. This page covers the data itself.
1. The short version
Gray Hole is a local-first tool by default. Your clips live in your own browser's IndexedDB and never pass through our servers — because we do not run servers that collect them. Cloud sync is optional: clips are mirrored to the cloud only after you register and sign in on the account page.
We run no ads, do not read your browsing history, and do not train any models. The extension contains no telemetry at all. The website uses a small self-built funnel counter and Google Analytics 4 (Section 5); both cover the website only and never collect clip content.
2. What we collect
| Data | When it exists | What it contains |
|---|---|---|
| Your clips | Always, but only on your machine | Text and Markdown copy, title, source information, tags, collections, and the bytes of any image you saved. All of it stays in your browser; we never receive it |
| Email address | Only if you register | Used to sign in, to reset your password, and for essential account notices |
| Password hash | Only if you register | Derived irreversibly by Supabase Auth before storage. Neither we nor anyone who can read the database can see the plaintext, and it cannot be recovered from the hash |
| User ID | Only if you register | A random UUID that scopes and isolates your rows in the cloud tables |
| Registration time and display name | Only if you register | The display name is generated from the local part of your email address |
| Cloud mirror of your clips | Only if you register and turn on cloud sync | Field-by-field list in Section 3 of Permissions & network |
| Website analytics | Only when you visit this site | The self-built counter records event name, timestamp, page path, site language, a random ID, a one-way IP + User-Agent key and a crawler flag. GA4 processes page and browser/device analytics. Neither receives clip content — see Section 5 |
We never ask for, and never accept, a phone number, real name, identity document, avatar, or any social account authorization.
Source URLs can contain private information. So that a clip can find its way back to the original page, we keep the page URL. If that URL carries a session ID, query parameters or a one-time token, those are stored along with it. Treat exported JSON backups and the cloud mirror as content that is not safe to share publicly.
3. Where your data lives
| Data | Location | Condition |
|---|---|---|
| Clip text, titles, tags, collections, image bytes | IndexedDB in your browser (database tata-clipper-v1) | Default, always |
| Email, password hash, user ID, clip mirror | A Supabase-managed database in the western United States (Oregon) | Only if you register |
| Access token | Extension: chrome.storage.local; website: this site's localStorage | Only if you register |
The static pages of this website are distributed through Cloudflare's global edge network and do not store your account data.
Registering sends your data across borders. If you are not in the United States, registering means your email address and clip mirror are transferred to and stored on servers in the United States. We chose that region for service availability, but you should know this — especially if you plan to clip material involving personal information, trade secrets, or content governed by local regulations.
If you don't want data to leave your region, don't register. Without an account, every feature of Gray Hole — capturing, organising, searching, exporting — runs entirely on your machine, and nothing leaves your device. Local-first is the default here, not a downgraded mode.
4. What we don't do
- We don't save whole pages automatically, walk through your past conversations, read input fields, or listen for keystrokes;
- We don't record which sites you visited, how long you stayed or what you clicked — the extension sends no statistics at all; the website only counts views of its own pages and clicks on its own key buttons (boundaries in Section 5);
- The extension embeds no analytics SDKs, ad SDKs, behavioural tracking pixels or third-party fonts. The website uses only the Google Analytics 4 integration disclosed in Section 5 and no ad SDK;
- We don't use clip content to train models, and we don't hand it to anyone else for model training;
- We don't sell, rent, or otherwise provide your data to advertisers;
- We don't auto-load remote images as thumbnails in the library — that would fire a request at the original author's server every time you browse your clips.
5. The website's anonymous funnel counter
The website — and only the website — records which page step was opened and which key button was clicked, so we can see where the funnel gets stuck. The self-built counter records only: event name, timestamp, page path, site language, and a random ID kept in your browser; if you are signed in, the user ID is attached so the same person can be aligned across devices.
To exclude crawlers, the database derives a one-way anonymous key from that request's IP address and User-Agent and records whether the UA matches common crawler or automation markers. Neither the raw IP address nor the raw User-Agent is stored; the key is used only to deduplicate the dashboard by IP + UA. The website also uses Google Analytics 4 to record page views and the same bounded event names, such as get_started_view; GA4 never receives clip text, titles, source URLs, search terms or account details. With Do Not Track enabled, the website neither loads GA4 nor sends its self-built funnel event. The extension has nothing of the kind.
Rows are deleted automatically after 180 days; to remove the ones tied to you sooner, see Section 7.
6. Third-party services
| Service | Purpose | Data it touches |
|---|---|---|
| Supabase | Account authentication, cloud sync database hosting, and storage for the anonymous funnel events | Only after you register: email, password hash, user ID, clip mirror; funnel events include anonymous event-level data, a one-way IP + UA key and a crawler flag, but not raw IP or UA. Database region: western United States (Oregon) |
| Cloudflare | Hosting the grayhole.tech static site | Ordinary request logs from visits to this site (IP, User-Agent) |
| Google Analytics 4 | Aggregate analysis of website pages and funnel events | Page paths, bounded event names and browser/device analytics. It receives no clip content, source URLs or account details, and is not loaded when Do Not Track is enabled |
| Resend | Sending account verification and password reset emails | Your email address, plus the metadata needed to deliver the message |
These providers process data only as needed and gain no rights to your data through our business.
7. Retention and deletion
- Local data is entirely under your control. You can clear it from the library settings, and uninstalling the extension plus clearing site data removes it too. We never touch this part.
- Cloud mirror: when you delete a clip, a soft-delete marker propagates to your other devices. Permanent deletion takes one more confirmation on your side.
- Account: you can sign out on the account page at any time, or write to us to have the account deleted. Within 30 days of a request we delete the account record and all cloud clips, and confirm by reply.
- Funnel events are deleted automatically after 180 days. To remove the rows tied to you sooner — including that random ID — write to [email protected]; clearing your browser's site data also invalidates and resets the random ID.
- Backups: the export function is always available and includes trashed clips and local image bytes. We won't hold your data behind an export wall.
8. Security
- Every cloud table has Row Level Security enabled, with policies of
user_id = auth.uid(). Isolation is enforced at the database layer, not by whether application code happens to be written correctly. - Only the anon public key ships in the extension and the site — it can reach only the signed-in user's own rows. The
service_rolekey, which bypasses RLS, never enters any front-end code. - Access tokens live in
chrome.storage.local(extension) and this site'slocalStorage(website), and content scripts are restricted from reading them. GA4 loads only on public pages without access tokens; the account and cloud workspace never load third-party analytics scripts. - All traffic uses HTTPS. Passwords are derived irreversibly on the server before storage.
One thing we should say plainly: we cannot promise absolute security. Any system can be breached. What we can do is keep the attack surface as small as possible — no surplus data, no surplus dependencies, no surplus permissions.
9. Minors
Gray Hole is not directed at children under 13 and does not knowingly collect personal information from children. If you are a parent or guardian and find that your child registered an account without your consent, write to us and we will delete the account and its data.
10. Changes and contact
If this policy changes materially, we will update the effective date at the top of the page and post a notice on the site's home page for at least 14 days. Changes that widen what we collect will additionally be announced by email to account holders before they take effect.
Privacy questions, data access and deletion requests: [email protected]
General support and bug reports: [email protected]
Related documents: Permissions & network (technical annex), Terms of Service.