拾物簿Scroll & Keep

Scroll & Keep App Privacy Policy

Applies to the Scroll & Keep (拾物簿) Chrome extension’s account-based local beta. Policy date and version: November 1, 2026 (2026-11-01).

This policy describes data handling within the app. Browsing the product website or this policy page is covered separately by the Website Privacy Policy.

Operator: 陳澤雄 (individual operator). Privacy contact: snk-privacy@giagia.net.

For general support and usage questions, contact snk-support@giagia.net. Privacy and account-data requests use the privacy address above.

1. Features currently provided

Scroll & Keep helps organize products and source records from social platforms. The beta supports Google sign-in, session restoration and sign-out. With an available account and valid platform access, you can add, edit and organize your own products on your device. Hints on visible Facebook pages require your confirmation to save; there is no background crawling or automatic product saving. You can view, export and explicitly delete or clear data.

The product currently follows a free-use and voluntary-support direction, not a promise that every future version or plan will always be free. Contributions do not buy features or limits. Sign-in and feature-access checks remain; test/gift accounts may have different limits. No contribution or payment service is connected, and free use does not create payment records.

Local backup and separately authorized, user-operated manual Drive backup and restore are available. There is no automatic sync, usage reporting or cloud AI. Sign-in does not authorize Drive access or automatically upload, move or change ownership of existing records.

2. Data processed for sign-in

On first use or important Terms updates, the product provides fixed-version Terms and Privacy Policy links for active confirmation. Confirmation stores only the Terms/policy versions, content digests, confirmation-interface version and device time in the current Chrome profile’s local installation. It includes no Google account, email, IP, product content or extra device identifier and is not uploaded to Supabase, Drive, logs or analytics. It determines locally whether another prompt is needed, not trusted server time or proof of a specific account’s consent. Clearing extension data, reinstalling or changing devices may require confirmation again. The record remains until replaced by confirmation of a new version or extension-data removal. Sign-out retains it; product backups exclude it. External policy-page browsing follows the Website Privacy Policy.

When you initiate Google sign-in, Google provides basic account identifiers, email, name and profile-photo URL to Supabase Auth to verify identity, create a product account and maintain sign-in. Supabase stores these account/authentication details and account creation, update and sign-in times. You can cancel sign-in. This product does not receive your Google password.

Account initialization stores an account identifier, status, access version and creation/update times in Supabase for setup and access control. This product-account record does not separately copy email, name or photo and contains no product content. Initialization does not itself grant usable free feature access. Adding, editing and monitoring require valid account-bound platform access; routine product operations do not require Drive.

For test/gift grants, Supabase stores the account, platform, grant source, creation/expiry/revocation times and necessary grant, adjustment or revocation audit records for access decisions and checks. They contain no product content and do not indicate payment. Base free access comes from shared plan configuration; a purchase or test record is not created for every free account.

Without required identity information, account sign-in and session restoration are unavailable. Legacy local data not assigned to an account can still be viewed, exported and cleared. Account databases open only when the original account can be verified.

The extension locally stores Supabase session credentials, expiry times, verified account identifiers and email to restore and refresh sign-in after reopening the browser. Session credentials may themselves include basic identity details such as name and profile-photo URL; those fields are not stored separately. Google sign-in provider tokens are not separately persisted, and sign-in credentials are excluded from product exports. Section 4 explains separate Drive credentials and Chrome caching.

On obtaining valid feature access, the extension locally caches the complete signed access credential: product-account identifier, plan/platform access, limits, versions and validity times. It includes no email, product content or Google access credentials and is not included in product exports. Queries check only the current account’s access, without sending product or usage records. Previously signed-in accounts that have not signed out can continue local additions, edits and monitoring temporarily offline within the original credential validity period, without extending it. On expiry, those operations stop. Viewing, exporting, deleting and clearing your data remain possible if the original account can be verified; otherwise the account database is not opened. Sign-out, account switching or confirmed identity rejection immediately withdraws old operational access without deleting product data.

Product sign-in requests only basic identity access, not Gmail, contacts or Drive files. Optional Drive backup needs separate authorization for this app’s dedicated data area. Identity data is not used for product-content analysis, advertising or sale.

3. Products, settings and local data

Product text, source URLs, prices, images, categories, notes, monitoring conditions and history are stored on your device. Sign-in and routine use do not send them to Supabase, Drive or this website. Account data uses separate databases based on trusted account identity. Signing out retains data; signing in with the same account restores access to its data. Switching accounts does not display or modify the previous account’s data. A separate “Legacy local data” entry supports viewing, export and explicit deletion/clearing only. It does not automatically migrate or assign legacy data, or use it for new saves or monitoring.

Data management can export the selected database. Clearing an account database deletes only that account’s targets, products, images, related history and drafts, preserving other accounts, legacy data and device preferences. Clearing legacy data also resets device hint colors and the image limit; the confirmation dialog states the scope. Product clearing does not remove theme, language, AI preferences or sign-in. Sign-out is separate. You manage exported files, which may include private products, sources and images; deletion inside the extension does not delete exported copies. Earlier product JSON/CSV exports are not complete restorable backups.

“Backup and restore” also offers local backups of all current-account targets, products, images and history, excluding sign-in credentials, access grants and device preferences. These unencrypted files contain account identifiers and private content; store them securely. They are not automatically uploaded. Import reads a local file, validates it fully, shows a preview, and replaces current-account data only with your explicit confirmation. Cancellation or validation failure changes no data. The source account identifier must match the current account, but an editable file is not cryptographic proof of identity. Other accounts, legacy data and device preferences are not replaced.

“Show current post images” may open a temporary photo tab to read that post’s gallery and image candidates. Source sites receive page, preview and image-download requests. WebP conversion, resizing and quality adjustment occur on your device, and you can keep the original image. Only image versions you confirm are added to a product. Images are not sent to the developer’s backend. Theme, language, AI preferences, hint colors and image limits are device settings, not automatically moved or assigned when switching accounts.

With optional local AI, selected form text and necessary target information are processed by Chrome’s on-device model; Chrome may need to download the model. There is no cloud AI fallback. You choose whether to apply or save results. If you copy content, the system clipboard is managed by you and your device; closing the form does not clear it.

The app currently has no usage analytics, interaction tracking, advertising tracking, device fingerprinting or usage reporting. Automatic sync, contribution processing or statistics would require updated disclosures and necessary notice and authorization before introduction. Website measurement follows the separate Website Privacy Policy.

4. Optional manual Google Drive backup

You can separately connect Drive in “Backup and restore”. The extension uses basic Google identity and the drive.appdata scope to verify the same Google account as product sign-in, and operates only in this app’s hidden data area. It receives no permission to browse arbitrary Drive files. The area does not appear as a normal folder in Drive’s file list. Account-based local features and local backups work without Drive.

Connecting or restoring a connection does not upload products. When you initiate backup, the extension sends the current account’s targets, products, images, history, account identifier and necessary backup information to your Drive. Backups exclude sign-in credentials, feature access and device preferences. They are compressed and split into parts but not encrypted by this product. Retrieval and restore download this content for validation, preview and your confirmation before replacing current-account data. They do not automatically merge other accounts or legacy data, or continuously sync everyday changes.

The persisted connection marker contains only a version and product-account identifier. Active Drive access credentials remain in extension runtime memory; Chrome Identity separately manages its credential cache. Credentials may be reacquired from Google and verified after restart. The extension does not separately persist Drive access/refresh tokens or put them in backups, products or logs.

Disconnecting Drive clears the extension’s connection state and attempts to remove known cached Chrome credentials. It does not revoke all Google-account authorizations or delete remote backups. Sign-out, local product clearing and local restore likewise do not delete Drive copies. Manage authorizations in your Google account and hidden app data through Drive’s app-management features. Backup processing may clean up unneeded backup objects under its version-retention rules.

5. Service providers

Sign-in providers may process connection information and security records for authentication, abuse prevention and service security. No app analytics does not mean sign-in services process no connection data.

6. Retention and security

You control local product records, which remain until explicitly deleted or removed through browser controls. Sessions remain until sign-out, account switching, confirmed session invalidation or removal of extension data. Near or after credential expiry, the extension may refresh sign-in with Supabase. If network failure prevents identity verification, signed-in identity display pauses while the local session is retained for retry.

Backup, retrieval and restore create unencrypted working data on the device, potentially including product text and images and persisting across browser restarts. Working data can be used for 24 hours from creation and is no longer used after expiry. Completion, cancellation, sign-out and account switching also schedule cleanup. Browser closure or cleanup failure may delay physical removal until a later startup or operation and retry; removal from disk within 24 hours is not guaranteed. This expiry does not delete the product database.

To avoid duplicate submissions or incorrect deletion of remote backups, the device also retains necessary backup-operation records, such as account and Google identity, backup identifiers, digests and completed/pending-verification status. These exclude product bodies, images and credentials. They do not use the working-data expiry above; retention follows operation-verification and cleanup processes. Cancellation cannot recall data already sent to Drive.

The extension restricts sign-in storage to trusted extension environments and uses HTTPS. This is not a promise of device-disk encryption. Protect your device.

Supabase account data is retained while account services are provided. There is currently no automatic idle-account deletion schedule. You may request deletion using the contact below. Provider security records and backups follow service arrangements and applicable obligations. Account deletion does not instantly remove all provider security records and backups or automatically delete device products and exports.

7. Sign-out, withdrawal and data requests

“Sign out of this device” removes this device’s session and attempts to revoke it with Supabase. If the network fails, the extension tells you remote revocation could not be confirmed. Account switching removes the old account’s local sign-in access and does not treat old results as new-account data.

Supabase session revocation stops further sign-in refresh for that session, but already issued short-lived sign-in credentials may remain valid until expiry. Signing out of this device does not sign out other devices; account switching does not guarantee immediate invalidation of old remote credentials.

You may also revoke authorization through Google account third-party connections. Google authorization withdrawal, sign-out, local deletion and product-account deletion are separate actions. Withdrawal or sign-out does not automatically delete the Supabase account.

To request access to or review of, a copy of, supplementation/correction of, stopping collection/processing/use of, or deletion of account data held by this product, contact the privacy address above. The extension currently has no self-service account-deletion button. We process requests after necessary identity checks, and explain results and data legally required to be retained. Do not send passwords, sign-in credentials or product-database files as identity evidence.

Contact-email purposes, provider types and retention are described in the Website Privacy Policy. Contact handling does not automatically import your product database or serve as app analytics.

8. Policy updates

This policy describes currently provided features. Before a future sale or operator change, we will assess whether personal data such as accounts needs transfer and its legal basis, identify the new operator, necessary data scope, purposes, recipients, regions and user rights, and provide legally required notices and obtain consent where required. Selling code or a brand does not authorize collecting or delivering local products or private Drive backups, or pre-consent to expanded data purposes. Any data needed for future charges and the payment service providers involved must also be disclosed before integration. New data types, purposes, recipients or features such as sync require updating this page’s date and explanation first and providing notice in the relevant product flow. Features needing new authorization are enabled only after it is obtained.