Thank you for using Leafovers (“the Extension”, “we”, “our”, or “us”).
This Privacy Policy explains how we collect, use, and protect your information when you use the Leafovers Chrome Extension and related services available at leafovers.com.
1. Information We Collect
We collect only the minimum data necessary to provide core functionality of the Extension:
User Content: Sticky notes you create on webpages.
Account Information: Your Google account user ID and email address when you sign in.
Authentication Data: Secure authentication tokens provided by Google OAuth.
Anonymous Usage Analytics: Limited, predefined product usage events (see Section 3) to help us understand whether the Extension works well and which features are used.
Subscription Information: If you purchase Leafovers Premium, payments are processed by Stripe (stripe.com). We store only your subscription status (e.g. free or premium), the billing interval, and a Stripe customer reference. Your full payment details (such as card numbers) are collected and stored by Stripe, never by us.
We do not collect browsing history, personally sensitive browsing data, or unrelated webpage content.
2. How We Use Information
We use collected data strictly to:
Provide core functionality (creating and displaying notes)
Authenticate users via Google sign-in
Create and manage user accounts
Sync notes securely across devices
Store and retrieve notes from our backend
Provide customer support
Improve the Extension’s performance and reliability
Understand, in aggregate, how the Extension is used (for example, whether note creation succeeds and how releases compare)
We do not sell, rent, or use your data for advertising or profiling.
3. Product Analytics
We use PostHog (posthog.com) to collect a small set of privacy-friendly usage events. Analytics are designed so that they cannot contain your notes or information about the websites you visit.
What is collected:
Events: when the Extension is installed or opened; when a note is started, created, viewed, updated or deleted, or fails to be created; when sign-in starts and completes; and when the uninstall feedback page is shown or submitted.
Event details, from fixed lists only: the Extension version, whether you are signed in, a general page category (for example “normal webpage”, “PDF” or “new tab” — never the address), a general failure category, a coarse operating system and browser type (for example “mac” / “chrome”) at installation, and the uninstall reason you select.
Identifiers: a random anonymous analytics ID and session ID generated by the Extension. If you sign in, your events are linked to your internal Leafovers account ID — a random identifier that does not contain your email or name.
What is never collected by analytics: webpage addresses (URLs), page titles or content, note content or titles, anything you type, clipboard contents, screenshots, cookies, authentication tokens, your email address or name, browsing history, or the free-text feedback and email you may enter on the uninstall page.
We have disabled IP-based location lookup and configured PostHog to discard IP addresses. We do not use analytics for advertising, and analytics data is not combined with information from other websites.
To have analytics data linked to your account deleted, contact us at info@leafovers.com.
4. Data Storage and Security
Notes are stored locally on your device and/or securely on our servers when sync is enabled
User account data (user ID and email) is stored securely
All data is transmitted over encrypted connections (HTTPS)
We implement appropriate technical and organizational measures to protect your data.
5. Chrome Extension Permissions
Leafovers only requests permissions necessary for its functionality, such as displaying and saving notes on webpages.
We do not use permissions to collect or track browsing activity beyond what is required to attach notes to specific pages.
6. Data Sharing
We do not share your personal data with third parties, except:
With Google for authentication (OAuth)
With PostHog, our analytics provider, which processes the limited anonymous usage events described in Section 3 on our behalf
With Stripe for subscription payment processing. When you start a checkout, Stripe receives the information needed to process your payment (such as your email address and payment details you enter on Stripe's checkout page). Stripe processes this data as described in the Stripe Privacy Policy.
When required by law or legal obligation
7. Data Retention
We retain your data only as long as necessary to provide the service:
Your notes and account data are stored until you delete them
When you delete your account, all associated data is permanently removed
Analytics events are kept for as long as they are useful for understanding usage trends, and are deleted on request as described in Section 3
Billing records related to your subscription may be retained by Stripe and by us where required for accounting, tax, or other legal obligations
8. Your Rights (GDPR)
If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):
Right to access your personal data
Right to correct inaccurate data
Right to delete your data (“right to be forgotten”)
We process your data under the following legal bases:
Contractual necessity: To provide the core functionality of the Extension
Legitimate interests: To improve and maintain the service, including the limited product analytics described in Section 3. You may object to this processing by contacting us.
Consent: When you choose to sign in and enable syncing
10. International Data Transfers
Your data may be processed on servers located outside your country. We ensure appropriate safeguards are in place to protect your data in accordance with GDPR.