Resave

Privacy Policy

Last updated: October 2, 2026

What data we collect

Resave collects the data needed to save, organize, search, and sync your personal intake library across the iOS app, share extension, web app, and browser extension:

• Account information — email address, optional phone number if you choose to use phone sign-in, name or display name when provided, username, user ID, authentication sessions, and account status.
• Saved content — titles, URLs, notes, markdown, search text you submit, bucket/facet assignments, tags, threads, and related metadata.
• Uploaded media — screenshots, photos, videos, thumbnails, dimensions, file size, MIME type, and storage path when you attach media to an item, share media into the app, or opt in to useful-screenshot auto-save. With auto-save enabled, the iOS app considers only new assets Apple identifies as screenshots; ordinary photos and screenshots from before enablement are not uploaded by that feature.
• URL preview metadata — page title, description, image URL, site name, and other public metadata retrieved from links you save.
• User-initiated browser captures — the active page URL and title when you choose Save this page; the first HTTP(S) URL in clipboard text when you choose Save copied link; or eligible tab titles, URLs, favicons, and positions when you choose Collapse tabs. The full menu is the default; an optional favorite toolbar action runs only after you configure it and click the Resave icon. Clipboard text is read once after that explicit action, only the extracted link is transmitted, and the remaining clipboard text is not logged or stored.
• AI-generated metadata — classifications, summaries, entities, tags, themes, and chat responses generated from your saved content.
• Operational data — request metadata, rate-limit counters, server logs, and error diagnostics used to keep the service secure and reliable.
• Product interaction analytics — privacy-minimized Collections, album, pin, and album-picker events used to understand whether organization features work. These events include event type, album origin and semantic kind, aggregate counts, timestamps, and account/album identifiers needed for deduplication. They never include album names, search text, save titles or IDs, URLs, handles, notes, or classifier content. Raw events are deleted after 90 days; only content-free daily aggregate metrics are retained.
• Product feedback — the Problem or Idea message and up to three visual attachments you explicitly choose to send, including screenshots and at most one screen recording, plus app version, build, iOS version, device model, current app screen name, locale, time zone, display size, and connection type. Selected recordings are trimmed to 30 seconds, compressed, and submitted without audio; Resave does not record in the background or run session replay. TestFlight screenshot and crash feedback submitted through Apple may also include Apple-provided device/build diagnostics, crash logs, and tester contact information. In-app feedback never includes saved URLs, titles, notes, clipboard contents, authentication data, or arbitrary console logs.
• Shared-save data — the relationship and timestamp created when you share an item, recipient-copy provenance, and abuse reports. Capability URLs are not included in account exports or application telemetry.
• Social conversations — when you use Social: the messages you send in groups and save chats, including the opening thought you add when you share a save, quoted replies, reactions, and edits; who you invite and chat with; which messages you have read and when you were last active; the reports you file; and the invitation links you create or publish. Your display name appears with your messages.

What data we do NOT collect

• We do not sell your data.
• We do not use advertising tracking, tracking pixels, or cross-app tracking.
• We do not collect your full browsing history; browser capture only saves pages you explicitly choose to add.
• We do not run background capture of clipboard, ordinary photos, videos, or browser tabs. Useful-screenshot auto-save is optional, checks only new Apple-identified screenshots while the iOS app is active or when it next opens, and can be turned off in Settings.
• We do not place OpenAI, Anthropic, Iframely, Google YouTube Data API, Supabase service-role, Stream, or Clerk secret keys in client apps.
• We do not read your address book. You invite people from your recent Resave conversations or by sharing a link.
• We do not use Social messages for AI classification, Search, Ask, or any other AI processing.

How data is stored

• Locally: The iOS app stores preferences, Resave session state, pending share uploads, a protected per-account screenshot-intake ledger, and local chat transcripts on your device. Authentication tokens are stored using the platform keychain where available. After you save in the App Clip and choose Get the full app, a one-time, expiring sign-in ticket and pending destination are stored in Apple-supported shared Keychain/App Group storage for installation handoff. The Chrome extension stores its session, local-only toolbar preference and onboarding state, and a local-first copy of collapsed Old Tabs in Chrome extension storage so the chosen behavior persists, tabs are recoverable before originals close, and failed sync can be retried. The toolbar preference is not transmitted to Resave or Sentry. Failed page/link saves retain the selected URL, title, account ID, and capture ID locally until successfully retried; only the original account can retry them. Active Chrome connections renew during use and expire after 90 days of inactivity or server revocation. Explicit extension sign-out revokes that connection; website sign-out is independent.
• Server-side: Account records, directly saved Library items, collapsed Old Tabs, notes, buckets, attachment metadata, and AI metadata are stored in Supabase Postgres and associated with your authenticated user ID.
• Analytics retention: Privacy-minimized product interaction events are stored in Supabase Postgres for up to 90 days, then deleted after a daily content-free aggregate is produced. These analytics are used only for product improvement, never advertising or cross-app tracking.
• Feedback retention: In-app feedback and its attachments are included in account export and deleted with the account. TestFlight reporter email is removed after 30 days. Resolved or closed feedback and its attachments are deleted 180 days after disposition; new, triaged, or planned feedback remains until disposition.
• Media storage: Uploaded screenshots, photos, videos, and thumbnails are stored in Supabase Storage and linked to the owning item and account. Auto-save screenshot candidates use private temporary storage and appear as private processing saves after upload verification; accepted screenshots are enriched in place, while rejected, cancelled, and expired processing saves and candidate media are deleted.
• Public sharing: Saved content and albums are private by default. When you create a Resave share link, anyone with that unlisted link can view the shared item or the album snapshot presented by the link until you revoke it, hard-delete the underlying content/account, or Resave blocks it for safety. Shared albums include their title, caption, theme, ordered public item previews, item count, and—unless you choose anonymous sharing—creator attribution. Personal notes, classifications, raw database identifiers, and private owner data are excluded. An authenticated visitor may remix a shared album into an independent copy; later source edits or revocation do not alter a remix already accepted. Short-lived media URLs are issued only after the capability is validated. Public surfaces include a report action.
• Social messages: Message text, reactions, edits, and read state are stored by Stream, our chat provider, which delivers them to the people in the chat. Resave's database stores groups and chats, who is in them, invitation links, a sanitized copy of each shared save (its title, link, and preview media, never your private notes), moderation records, and a preview of up to 280 characters of each chat's latest message for your inbox. Resave holds a message that is waiting to send only until Stream accepts it. The iOS and web apps keep recent history, drafts, and unsent messages for your account on your device; signing out or deleting your account clears them. Messages are kept until their author deletes them, a moderator removes them, the chat is deleted, or the author's account is deleted.
• Link-readable chats: Save chats are private to the people in them. A member can choose to publish a chat's link. Everyone in the chat sees a notice before any new message becomes readable. From then on, anyone who has the link, including people without a Resave account, can read the messages sent in that chat after the link was published. They cannot read earlier messages, see who is in the chat, or post without signing in and joining. Reading stops when the link expires (after 30 days unless renewed), is revoked, or the shared save is withdrawn. Existing chats and links never become readable on their own. Anyone who joins a chat, from any link, can read its full history.
• Save guests: If someone replies from a link to a save shared in a group, they join only that save's chat, as a guest. A guest can read that chat's full history and the shared save, and the chat's members see the guest's name and messages. Guests cannot see the group's other chats, its other saves, or its member list.

AI processing

Resave uses AI services to classify saved items, screen and describe opted-in screenshots, and answer questions over your saved library. Screenshot auto-save sends a metadata-stripped, lower-resolution derivative to OpenAI for one screening and metadata pass; if Resave configures Google Gemini as a backup and OpenAI is unavailable, the same derivative may be screened by Gemini instead. Uncertain screenshots are saved, and clearly unusable rejected screenshots are deleted. Depending on the feature, other content sent to AI providers may include titles, URLs, notes, URL metadata, screenshot image URLs, retrieved page context, bucket names, and compact search results from your library. AI provider API keys are stored only on our server.

Social safety and moderation

You can report a message or a chat, and block a person, in the iOS app or on the web. A report sends Resave your written reason and the identifiers of the chat, group, and message you reported. It does not copy the conversation, but to decide on a report our moderators may view the reported message and the messages around it. We review reports and aim to act within 24 hours. We may remove messages and ban accounts from Social; a ban removes the account from every group and chat. We keep records of reports and of the actions we take, with identifiers and no message text; resolved reports and their actions are deleted 365 days after they are resolved, and open reports are kept until they are resolved.

Blocking someone stops them from inviting you. In a group, blocking someone also means you leave that group.

Messages are checked by automated filtering, run by Stream, which stops objectionable content before it is posted.

Third-party services

• Clerk (clerk.com) — account authentication and session management. See Clerk Privacy Policy.
• Supabase (supabase.com) — database and media storage. See Supabase Privacy Policy.
• Vercel (vercel.com) — API hosting. See Vercel Privacy Policy.
• OpenAI (openai.com) — AI classification and image description. See OpenAI Privacy Policy.
• Anthropic (anthropic.com) — AI chat and retrieval over saved library content. See Anthropic Privacy Policy.
• Sentry (sentry.io) — privacy-scrubbed error monitoring and reliability diagnostics. Extension diagnostics omit saved URLs, clipboard contents, authentication headers, and request bodies. See Sentry Privacy Policy.
• Iframely (iframely.com) — optional URL preview enrichment for saved links when public page metadata is incomplete. See Iframely Privacy Policy.
• Stream (getstream.io, Stream.io, Inc.) — stores and delivers Social messages, reactions, read state, and typing indicators, sends Social message notifications, and provides moderation tools. Stream receives your Resave account ID, your display name, and your device's notification token. It does not receive your library, your private notes, or invitation links. Stream processes this data on our behalf. See Stream Privacy Policy.
• YouTube API Services (google.com / youtube.com) — public YouTube title, player-dimension, and embeddability metadata for links you choose to save. Resave stores this metadata with the saved item so the Reader can choose the correct public player and aspect. See Google Privacy Policy and YouTube Terms of Service.

Security

Requests to private data require authentication. Server-side API routes verify the authenticated user before reading, updating, or deleting account data. Secrets for Clerk, Supabase, OpenAI, Anthropic, Iframely, Google YouTube Data API, Stream, Sentry, and other infrastructure providers are stored in server-side environment variables, not in the iOS app, web frontend, or browser extension.

Resave and Stream can read Social messages: they are stored where both can access them, so the service can run, stay secure, and be moderated.

Data deletion

You can export a portable copy of your saved account data from the web or iOS app settings, including account identity fields, share relationships and timestamps, in-app product feedback and its temporary attachment download links, and user-keyed operational counters, but not capability URLs, session tokens, or password material. Importing an export does not republish its shares. You can delete individual saved items from Resave; hard deletion removes their public share while independent recipient copies remain. You can also delete your account from the web or iOS app settings. Account deletion removes your profile, saved items, shares, notes, buckets, AI metadata, in-app feedback and feedback attachments, other attachment records, uploaded media, user-keyed rate-limit counters, and authentication account from our active systems, except where retention is required by law, security, fraud prevention, or backup integrity.

Your export also includes your Social memberships (including chats you joined as a guest), the groups you created, your messages and reactions, the links you created (when, for which chat, and whether they were published, expired or revoked, but not the links themselves), the reports you filed, whether you were banned, the people you blocked, which version of the chat rules you agreed to and when, and the saves you shared. It does not include other people's messages or other people's information, including who blocked you.

Leaving a chat or group removes your access; your messages stay for the people still in it. Deleting one of your messages removes its text for everyone in the chat. Deleting your account removes your Social messages and reactions, leaving a "deleted" placeholder in each chat. It also removes you from every group and chat, withdraws the saves you shared, and hands each group or chat you ran to its earliest remaining member. Chats with nobody left are deleted. Copies of a shared save that others saved to their own library stay with them. Links you published stay with their chat until they expire or are revoked. Reports you filed stay as moderation records, but without your account or the words you wrote; records of moderation actions keep identifiers only. Erasure at Stream can take a little time: the app tells you deletion was requested and finishes it in the background.

Encrypted backups are retained on a limited lifecycle for disaster recovery. Deleted active data may remain in backups until that lifecycle expires, and restored environments must reconcile deleted accounts before becoming user-accessible.

Contact

For privacy questions or data deletion requests, contact: will@resave.ai

To report a safety problem in Social, use Report in the app or on the web. You can also email will@resave.ai.