Privacy Policy

Texthyper is a read-it-later service run by Killbridge Ventures Pte. Ltd., a company registered in Singapore ("we", "us"). This policy covers texthyper.com, app.texthyper.com, the Texthyper browser extension, the iPhone, iPad and Android apps, and the API. It says what we store, why, and what you can do about it.

The short version

• We store the pages you save, your highlights and notes, and the email address you log in with. That is what the service is.
• We don't sell your data, show ads, or use analytics or advertising trackers.
• The browser extension only sends a page when you ask it to save that page. It cannot read other tabs or your browsing history.
• You can export your library at any time and delete your account yourself in Settings.

What we store

Your account

• Your email address, which is how you log in. There are no passwords.
• Your reading preferences, such as theme, font and text size, so they follow you between devices.

Your library

• For every page you save: its address, title, author, site name and excerpt; the article text and a cleaned-up copy of it; the original page as it was sent or fetched; and copies of its images and the site's icon. Keeping that copy is what lets you read the article after the source changes or disappears.
• What you do with it: folders, tags, likes, archive state and how far you've read.
• Your highlights: the text you highlighted, where it sits in the article, its color and any note you added.
• Imports and exports. A file you import (from Pocket, Instapaper, Kindle and others) is deleted once it has been processed; the articles and highlights in it are kept like anything else you save. An export we build for you is kept until you delete it.

Logging in

• Login codes we email you. We keep only a scrambled form of each code (a cryptographic digest), and a code stops working after 10 minutes.
• For each browser you log in from, the IP address and browser name and version (the user agent) at the time you logged in, so you can stay logged in and we can spot misuse.
• API tokens, which the browser extension, the iPhone, iPad and Android apps and your own scripts use to reach your account. We keep only a digest of each token, with the device name it was created for. You can revoke any token in Settings.

Running the service

• Server logs: IP address, the address requested, user agent and time. We use them to fix problems and stop abuse, and keep them for a limited period.
• If an email to you bounces or is marked as spam, we record the address and the reason so we stop sending to it.

How pages reach us

When you save a link by its address (on the web, with the bookmarklet, by sharing it to the Android app, or through an import), our server fetches the page from the site. The site sees our server, not you.

When you save with the browser extension or the iPhone and iPad share sheet, your device sends us the page as it appears on your screen. That is how pages behind a login or a paywall come through whole. It also means that anything visible on that page, such as your name in a site's menu, is part of what we store. You decide what gets saved; nothing is sent in the background.

The browser extension

The extension acts only when you click its toolbar button, press its keyboard shortcut or choose "Save page to Texthyper" or "Save link to Texthyper" from the right-click menu. It talks only to app.texthyper.com. It asks for these permissions, and no others:

• activeTab: access to the tab you're looking at, only at the moment you save it, to read that one page.
• scripting: to run the small script that collects the page you're saving and shows the "Saved" confirmation in that tab.
• contextMenus: to add the two save items to the right-click menu.
• storage: to keep your API token and email address on your device so you stay logged in.

It has no host permissions, so it cannot read any site you haven't asked it to save, and it never sees your browsing history. Texthyper's use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

The iPhone, iPad and Android apps

The apps use the same account and the same data as the website. They keep a copy of your library on your device so you can read offline. They contain no analytics or advertising code and do not track you across other apps or websites.

How we use it

• To run Texthyper: save and clean up pages, keep their archive, search them, sync them to your devices and send your login emails.
• To keep the service secure and stop spam and abuse.
• To answer you when you write to us.
• To tell you about important changes, such as changes to these policies, a paid plan, or the service shutting down. We don't send newsletters or marketing email unless you ask for them.

We don't read your library. We look at the data of a specific account only when you ask us to help with a problem, when we need to investigate abuse or keep the service running, or when the law requires it.

Who helps us run it

We share data only with the companies that run parts of Texthyper for us, and only what each one needs:

• Hetzner hosts our servers and database, in Hillsboro, Oregon, in the United States.
• Cloudflare carries all traffic to texthyper.com and app.texthyper.com, provides Turnstile (below), and stores our encrypted backups.
• Amazon Web Services sends our emails through Amazon SES, from its Ireland region. It handles your email address and the content of the emails we send you.
• Google Fonts serves some of the typefaces on our pages, so Google receives your IP address and browser details when they load.

To stop bots from creating accounts and sending login emails, the login form uses Cloudflare Turnstile, which checks signals from your browser and device. Cloudflare describes what it collects in its Turnstile Privacy Addendum.

We may also disclose data when the law requires it, or to protect the rights and safety of our users or of us. If Texthyper is ever sold or merged, your data would move with it under this policy, and we would tell you first.

Where your data is

Your data is stored in the United States, and we are based in Singapore. If you use Texthyper from elsewhere, including the European Union or the United Kingdom, your data is transferred to and processed in those countries.

Legal basis

If you are in the European Union or the United Kingdom: we process your account and library to provide the service you signed up for (performance of a contract), and we keep logs and run Turnstile to keep the service secure (our legitimate interest in preventing abuse). Where the law requires us to keep or disclose something, we do so to meet that legal obligation.

Cookies

We use one cookie to keep you logged in. It is set for texthyper.com and app.texthyper.com, so the homepage can show "Open app" when you're logged in. The site also uses a session cookie for the login form and to protect forms against forgery, and Turnstile may set its own cookie while it checks your browser. We don't use analytics or advertising cookies.

How long we keep it

• Your account and library stay until you delete them.
• When you delete an article, it is removed along with its images. We keep a small record that it was deleted (its ID and when), so your other devices can remove it too.
• When you delete your account, we delete your library, highlights, folders, tags, sessions, tokens, imports and exports straight away, and the stored files soon after.
• Deleted data can remain in our encrypted backups until those backups expire.
• Records of addresses that bounced or complained are kept so we never email them again.

Your choices and rights

• Get a copy: export your library from Settings, or read all of it through the API.
• Correct it: change your email address in Settings and edit your articles' titles in the app.
• Delete it: delete articles one by one or in bulk, or delete your whole account in Settings.
• Log out devices: revoke API tokens in Settings.

Depending on where you live, you may also have the right to ask what we hold about you, to object to or restrict how we use it, and to complain to your data protection authority. Email [email protected] and we'll answer within 30 days.

Security

All traffic is encrypted with HTTPS. Login codes and API tokens are stored only as digests, backups are encrypted, and access to production systems is limited. No service can promise perfect security, and if a breach affects your data we will tell you.

Children

Texthyper is not meant for children under 13, and we don't knowingly collect their data. If you believe a child has an account, write to us and we'll delete it.

Changes to this policy

If we change this policy, we'll post the new version here and update the date at the top. If a change affects how we use the data you've already given us, we'll email you before it takes effect.

Contact

Killbridge Ventures Pte. Ltd., Singapore. Email [email protected].

See also the Terms of Service.