WebStash — Effective May 22, 2026 · Last updated May 22, 2026
WebStash ("we", "our", "us") is a personal bookmark manager that lets you save web pages and text highlights, then search them later using natural language. This policy explains what data the WebStash browser extension and web application collect, how we use it, and what rights you have.
chrome.storage.local, accessible only to the WebStash extension.| Purpose | Data Used |
|---|---|
| Store and organize your bookmarks | URLs, titles, page content, tags |
| Generate searchable embeddings and summaries | Page content (processed server-side by AI) |
| Provide natural-language search | Search queries matched against your saved content |
| Authenticate your account | OAuth tokens, email |
| Sync across devices | All saved data via our API |
| Maintain and improve the service | Aggregated, anonymized usage metrics |
We use your data only to provide and improve the bookmark management features described in our Chrome Web Store listing. We do not use your data for any other purpose.
WebStash uses AI on both Cloudflare's infrastructure (Workers AI) and Anthropic's API (Claude family). Each provider receives only the data needed for the specific feature:
Cloudflare Workers AI and Anthropic both contract with us not to retain your data for model training. The derived data (embeddings, summaries, tags, chat answers) is stored with your account and deleted when you delete the associated bookmark, conversation, or account.
When the operator has configured an observability backend, request traces — including your account user ID, internal bookmark identifiers (page IDs), your query (and any AI-rewritten form of it), the assistant's answer, URLs and titles of retrieved bookmarks, and short text snippets from those bookmarks — may be forwarded to Langfuse for debugging and quality monitoring. If you submit thumbs-up or thumbs-down feedback on an AI answer, that rating is also forwarded as a score linked to the same trace. Telemetry is processed under our legitimate interest in maintaining and improving the service; it is not used for advertising or sold to third parties. EU/EEA residents may object to this processing at any time under GDPR Article 21 by emailing privacy@webstashai.com with the subject “Object to telemetry”.
| Provider | Purpose | Data Accessed |
|---|---|---|
| Cloudflare | API hosting, database, file storage, vector index, queue, edge cache, Workers AI (embeddings and OCR) | All saved content (encrypted in transit and at rest) |
| Anthropic | Claude API used for chat/search answers, page classification, content summaries, and conversational query rewriting | Page content snippets, your search query, conversation history, and tag/category hints |
| Jina Reader | Fallback content extraction when a saved page blocks the standard fetch (feature-gated) | The saved page URL, which Jina then fetches and converts to clean text on demand |
| Langfuse | Observability and quality monitoring for AI features (only when the operator has configured a backend) | Account user ID, internal bookmark identifiers (page IDs), your query (and any AI-rewritten form of it), the assistant's answer, URLs and titles of retrieved bookmarks, short text snippets from those bookmarks, and thumbs-up/thumbs-down feedback ratings you submit on an answer |
| OAuth authentication for “Sign in with Google” | Email, name, profile picture (during login only) | |
| GitHub | OAuth authentication for “Sign in with GitHub” | Primary verified email and basic profile (during login only) |
| Apple | OAuth authentication for “Sign in with Apple” | Apple-relayed email (which may be a private relay address) and name on first sign-in |
| X (Twitter) | Optional X integration for users who connect an X account — pulls bookmarks/tweets you have saved on X into your WebStash library | X bookmarks and tweet metadata for the connected account; access tokens stored encrypted at rest |
| Resend | Transactional email delivery (verification, password reset, account notices) | Email address and message body |
Anthropic, Langfuse, and Resend each contract with us not to retain your data for model training or for purposes unrelated to providing their service to WebStash. Jina Reader is accessed through a key-gated public API rather than a signed data-processing agreement; we minimize our use of it to the fallback case described in Section 3, and we send it only the URL of the saved page on demand.
chrome.storage.local, which is sandboxed per-extension and inaccessible to other extensions or websites.Under the General Data Protection Regulation, you have the right to:
Our legal basis for processing is consent (you choose to save each page) and legitimate interest (account management, service operation). You may lodge a complaint with your local data protection supervisory authority.
Your data is processed by Cloudflare and may also be forwarded to our other processors — including Anthropic, Jina Reader, Langfuse, and Resend, plus the OAuth provider you choose to sign in with (Google, GitHub, or Apple) and the optional X (Twitter) integration if you connect it. Several of these processors are US-based and their infrastructure may include servers outside the EU/EEA. Each processor maintains appropriate safeguards (such as Standard Contractual Clauses) for international data transfers.
The WebStash extension includes a content script that runs on web pages you visit. This script:
WebStash is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.
We may update this privacy policy from time to time. If we make material changes, we will notify you via the extension or email. The "Last updated" date at the top of this page indicates when the policy was last revised.
If you have questions about this privacy policy or want to exercise your data rights, contact us at: