Security at KeepIt
How KeepIt protects your tabs, your account and your payments.
The short version
Your tabs stay on your device unless you turn on sync or sharing. KeepIt never reads page contents, loads no remote code, and keeps account data behind per-user access rules. Payments are handled entirely by Lemon Squeezy.
Your data
On your device firstDefault
Sessions, spaces, notes and snapshots live in Chrome's extension storage. Nothing is uploaded until you sign in and turn on sync, cloud sessions or sharing.
Page contentsNever read
KeepIt uses only each tab's title, address and icon. It does not read page text, forms, passwords or what you type.
Account dataOpt-in
Synced spaces and sessions are stored with Supabase over encrypted connections (TLS). Row Level Security means only your signed-in account, people you share with, or holders of a link you made can read them.
Sign-inGoogle
Sign-in uses Google. We receive your basic profile and never see your password.
The extension
- No remote code. All code ships inside the extension package; nothing is downloaded and run.
- Minimal permissions. Each permission is used for one feature and explained on the privacy page. The only site access is KeepIt's own sync server.
- Safe handling of saved and shared data. Text is escaped before it is shown, only http(s) and file addresses are reopened, and addresses such as
javascript:ordata:are dropped. - Trusted messages only. The extension accepts messages only from itself and from this website for the import button, and you still confirm the import inside KeepIt.
- Strict content security policy on the extension's own pages.
Payments and plans
- Lemon Squeezy is the Merchant of Record. Card details go to them directly; we never see or store them.
- Payment events are checked with a signed webhook before a plan changes.
- Plan limits (such as the number of spaces) are enforced on the server as well as in the extension.
Your controls
- Turn sync off or delete any space or session at any time.
- Revoke a share or live link and it stops working.
- Ask us to delete your whole account and its data; we confirm within 30 days. See the privacy policy.
Report a vulnerability
If you find a security problem, please email contact.naveen.work@gmail.com with the steps to reproduce it. Please give us a reasonable chance to fix it before sharing details publicly, and do not access other people's data while testing.