PRIVACY CENTER

Privacy Policy

Last updated: October 25, 2026

English is the canonical legal text. This page is a translation when another language is selected. Translations have not been independently legally reviewed. Mandatory applicable legal and consumer rights remain unaffected.

1. Who operates iPletch

The data controller is Gabor Foti, an individual developer in Switzerland, at Kapellenweg 9, 3989 Biel (Goms), Switzerland. iPletch is not currently operated by a company. No Data Protection Officer has been appointed.

For privacy requests, contact privacy@ipletch.com. General support: support@ipletch.com. Security reports: security@ipletch.com.

Contact privacy controller

2. Scope and current service

iPletch is a visual information organization service. You can save and organize links in workspaces and folders, view card metadata and previews, import/export links, manage preferences and use optional radio, weather, news and embedded media features. This notice covers the website, accounts, cloud storage and the available Quick Save browser-extension source.

Google account sign-in is available. YouTube and Twitch features exist, with account connection subject to the feature's availability and provider authorization; some integrations are limited to the owner's development account. iPletch Mail provides an optional Gmail client for explicitly allowlisted testing accounts. Yahoo mailbox access is not approved or enabled; Outlook remains planned and unavailable. The Gmail testing disclosure below describes the actual dataflow and controls.

This English text is the canonical notice. Interface links are localized into EN, DE, FR, IT, HU and PT; these do not constitute reviewed translations of the policy.

3. Data and purposes

Account and authentication: email address, account identifiers, authentication/session information and optional display name or avatar are handled to register, authenticate, recover and operate your account. Supabase Auth handles password authentication; Google handles its own sign-in authorization.

Saved content and synchronization: URLs, titles, descriptions, tags, folders, workspaces, favorites, Pletches, ordering, card metadata and preview/favicon images are processed to save, organize, find, display and synchronize your collection. User uploads include avatars and workspace backgrounds. Your selected country/region, language, timezone, weather locations and other display preferences are processed where you set them.

Optional content: radio favorites and recent station history support listening; weather searches send place names and selected coordinates to weather/location services; news requests fetch your chosen feeds. YouTube/Twitch connections may read permitted account/channel/video information. Providers receive connection or playback requests when those features are used.

Operations and security: authenticated presence heartbeats, account login/confirmation events, country codes, login counts and last-seen times support protected administrator operational reporting. Technical error categories and administrator audit records support security and troubleshooting. Hosting and backend providers also handle network requests and may keep operational logs, including IP addresses and request metadata. Application presence reporting records country codes rather than storing a raw IP address in the presence records.

Optional technical reports: If enabled, send at most one small report per day to the site owner: version/build, browser family, online state and technical code/time only. No links, messages, passwords or tokens. You can disable it at any time. Off by default; manual sending remains available. Internally linked to your account, visible only to you and the site owner. At most 12 codes; available for 30 days; expired reports are deleted on the next submission. No screenshots, raw logs or free text. Choice and last-send time are stored in this browser for this account.

4. GDPR legal bases where applicable

Processing necessary to provide the account, user-requested saving/synchronization and associated functionality relies on performance of the service contract (Article 6(1)(b)). Proportionate security, fraud prevention, availability monitoring and troubleshooting rely on legitimate interests in protecting users and operating the service (Article 6(1)(f)), subject to your rights and interests. Where processing is required by a specific legal obligation, Article 6(1)(c) applies.

Optional provider connections require a separate affirmative user action and provider authorization. Where consent is the applicable legal basis, Article 6(1)(a) applies, and consent can be withdrawn without affecting earlier lawful processing. A provider permission is not blanket consent to unrelated uses. Providing required account/authentication data is necessary to use an account; optional profile information and connectors are not required to register. This notice does not authorize materially new optional processing merely through an update.

The scope of non-essential analytics, embedding consent requirements and any additional obligations for EU users remain under review. The existence of this notice is not a certification of GDPR compliance.

5. Service providers and other recipients

Supabase provides authentication, PostgreSQL database and private file storage. The configured project region is Central Europe (Zurich), Switzerland. This identifies the project region, not every support, logging or subprocessor location.

OpenAI ChatGPT Sites hosts and serves the web application; the deployment uses Cloudflare Worker infrastructure and content delivery. These services process requests and operational data needed to deliver, maintain and secure the website. The domain is registered through Whois.com. The authoritative DNS operator has not yet been verified; the registrar is not assumed to be the host or CDN.

Google supplies optional Google sign-in and YouTube authorization/playback; Twitch supplies optional stream/account/chat features. Those providers may act under their own privacy terms for their services, not solely as iPletch processors. External service requests also involve MET Norway for forecasts, OpenStreetMap Nominatim for place searches, Radio Browser and selected radio station/metadata hosts, selected RSS publishers, and websites/image hosts from which previews and favicons are requested. Loading third-party media can disclose your IP address, browser details and the requested content to its provider. A saved URL containing personal information can itself disclose that information when fetched for a preview.

The repository also includes a link-media screenshot fallback using Thum.io. Where this path is used, the target page URL, including its query string, is sent to that screenshot service. Credentials and URL fragments are removed, but a query string can contain personal information. The activation status and processor/retention arrangements for this fallback remain under review; do not put secrets or sensitive personal information in saved URLs.

Authorized infrastructure providers receive data needed for their functions. We may also disclose information where required by law or necessary to address lawful requests and protect rights. iPletch does not sell personal data, run advertising or use saved or connected-service content for advertising targeting. A commercial service is planned; selling personal data or monetizing Yahoo message contents is not part of that plan.

When you explicitly request web-data recovery or a scan, iPletch may send bounded searches containing the public merchant/domain, product identifiers, title/model and explicit language/country preferences to configured DataForSEO and/or Brave Search. No cookies, login sessions, browser history, private account tokens or entire page content are transferred to these search services. A configured API key controls provider availability; search results are validated before persistence. Avoid putting secrets or sensitive personal information in URLs or card titles.

6. International processing — verification outstanding

The Supabase project region is Zurich. We cannot state that all personal data remains in Switzerland, the EU or the EEA. Hosting, support, provider connections and subprocessors may process data internationally. ChatGPT Sites does not provide a verified Swiss/EU-only residency guarantee for this deployment.

OWNER INPUT REQUIRED: the controller must document the applicable OpenAI/Sites and Supabase processing agreements, relevant processing countries and transfer safeguards, including any applicable adequacy decisions or standard contractual clauses and Swiss adaptations. Public provider terms are available below, but we have not verified the controller's complete contractual/transfer arrangements. This part of the transparency and compliance review is incomplete; contact the privacy address for available information.

7. Browser storage, cookies and embeds

iPletch uses localStorage for persistent authentication sessions and functional settings, IndexedDB for cached link/media/background data, and sessionStorage for temporary Twitch authorization state and its short-lived access token. YouTube access tokens are held in the current page's memory; connection preferences may be remembered separately. These are different from Yahoo token storage, which does not exist.

No advertising cookie or independent marketing analytics SDK was identified in the inspected application. Internal presence/country reporting does exist. Connected providers and embedded players can have their own cookies, storage and tracking practices. No new consent banner was added; the legal assessment of non-essential provider storage and automatic embed loading is outstanding.

You can clear site data through browser controls, which removes local settings and caches and may sign you out. Clearing a browser cache does not delete your cloud account or cloud records. Signing out is not guaranteed to erase every cached file. Keep this in mind on a shared device.

8. Retention and deletion — policy decisions outstanding

Account data, preferences and saved content are stored for ongoing account use; no automatic maximum retention period for an inactive account was identified. User-requested link changes/deletions alter the current saved collection. Removing a link must not be assumed to remove every associated cached or stored image immediately.

Some image replacement/removal paths delete the superseded file, but complete orphan-file cleanup, account-wide Storage cleanup and backup deletion timelines have not been established. Local copies can remain until cleared by browser controls. No fixed retention or purge schedule for application errors, admin audit records, country aggregates, hosting logs or deleted-account remnants was verified. RETENTION POLICY REQUIRED: the controller must set and document these schedules and the backup/deletion lifecycle.

There is currently no verified self-service account-deletion workflow. Request account or personal-data deletion at the privacy contact address. Identity may need to be verified before action. Database relationships delete many account-owned rows when the authentication account is deleted, but some error records are de-identified instead and an administrator audit relationship can prevent deletion of an audit actor. Storage objects, external provider access, backups and local caches are not proven to be covered by a complete account erasure procedure. We therefore do not promise immediate or complete automatic permanent deletion. These operational gaps require resolution.

9. Connected email services / iPletch Mail

Email connections are optional and separate from registration. Allowlisted Gmail test users can authorize on-demand lists, search and message reading; optional sending needs separate consent. See the Gmail testing disclosure below for scopes, data, server handling, retention and disconnect. Yahoo and Microsoft/Outlook remain unavailable.

The connection panel identifies the provider and requested use, links to this notice and requires an explicit Connect action followed by provider consent. There is no full-mailbox download, continuous polling, attachment indexing or AI email analysis. Only explicitly requested mail operations run.

10. Yahoo Mail integration — planned, not active

Yahoo mail-r developer approval is pending and production mailbox access is unavailable. The requested interface is read-only IMAP using Yahoo OAuth authorization and TLS. iPletch does not request or store your Yahoo password. The current callback rejects unsolicited authorization responses; it is not a completed OAuth connection.

If you connect Yahoo Mail once the integration is available, access will be explicitly initiated by you to provide on-demand Inbox lists and message opening. Intended data categories are account email/identifiers, mailbox/message identifiers, sender/recipient information, subjects, timestamps, requested message bodies and attachment metadata. Attachment content would be retrieved only when explicitly needed for a requested feature. On-demand access and pagination are intended; these are not represented as already implemented.

Yahoo Mail data will not be sold, monetized, used for advertising targeting or unrelated advertising profiles, sent to AI/LLM services in V1, or used to train AI models. The current preparation sends no private Yahoo message content to any such service.

YAHOO TOKEN STORAGE — BLOCKED / NOT IMPLEMENTED. Before activation, client secrets must remain server-only, tokens must be protected and bound to the correct account, and disconnect must remove/revoke access and clean up stored connection data according to a documented workflow. Those controls and cleanup are requirements for activation, not claims about current functionality. No permanent mail/attachment-copy retention is intended merely because a mailbox is connected; the actual implementation and retention rules must be verified before release.

11. Connected-provider controls and security

The site is served over HTTPS. The inspected account-owned database tables have row-level security enabled with owner restrictions for core account content, and preview/background/avatar Storage buckets are private. Signed file URLs and restricted server-side operations are used. These controls reduce risk but do not guarantee that a breach cannot occur.

You can revoke Google/YouTube authorization in your Google account. The current YouTube access token is page-memory only; an app-wide durable disconnect/revocation workflow has not been established. The Twitch disconnect control clears the local session token and requests provider revocation; successful remote revocation is not guaranteed on a network failure. Revoke access directly in your Twitch account if needed. Yahoo cannot currently be connected, so there are no Yahoo tokens to disconnect or delete.

The inspected preview path extracts public website metadata without an application LLM call. No private-mail AI processing exists. This is not a general guarantee about hosting-provider content moderation or every future feature. Any future AI feature needs a separate accurate disclosure and appropriate authorization.

12. Browser extension

iPletch Quick Save connects to your iPletch account through an explicit approval flow. Toolbar and context-menu saving send the HTTP(S) URL and title you choose to iPletch for storage in your account. If you enable optional current-page metadata, a one-time extraction may also send the canonical URL, site name, favicon URL and preview image/title. Saving does not require opening a new capture tab. The extension stores a revocable, account-bound capture grant locally; it does not receive your website password, Supabase user JWT or refresh token.

Bookmark import requests optional browser bookmarks permission only when you invoke it. After your confirmation, supported bookmark URLs, titles and folder structure are sent to iPletch for import into a new workspace. Saving a window to a Pletch requests optional tabs permission and offers up to 30 supported tab URLs and titles for review and confirmation. These actions do not enable browser-history access, continuous browsing monitoring or automatic saving of visited pages. Disconnecting revokes the extension connection; content you already saved remains in your account until you remove it under the controls described in this notice. Website content, selected URLs, bookmark data and connection credentials are disclosed as Firefox data categories; the categories do not mean that the extension reads passwords or uploads your complete browser history.

13. Your rights and contact

Depending on the applicable law and circumstances, you may request information/access, correction, deletion, restriction, objection, data delivery/portability and withdrawal of consent. Rights can be subject to legal conditions and exceptions. Contact privacy@ipletch.com to exercise them; we may request proportionate identity verification. You can edit available profile/preferences and manage saved content in the app, and use its export option for supported saved-link data. This export is not necessarily a complete copy of all account or technical records.

You may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), or, where GDPR applies, the competent EU/EEA supervisory authority, for example in your habitual residence, place of work or place of the alleged infringement. Applicable Swiss rights and GDPR rights are not identical. No DPO is appointed; whether an EU representative or other jurisdiction-specific arrangement is required remains a controller legal-review item.

14. Age and policy changes

iPletch is intended for people aged 16 or over and is not directed at children under 16. Users must be at least 16 to create or use an account. The current signup flow does not independently verify age. If you believe an under-16 person has supplied account data, contact the privacy address so the controller can investigate and act; this notice does not assert that children's data is knowingly collected.

We will update this notice when functionality, providers, legal requirements or processing practices change. The last-updated date reflects this notice's actual update. A revised policy alone is not consent to materially new optional processing. Incomplete transfer, retention, erasure and consent-review items are disclosed above and must be resolved before claiming full compliance or Yahoo application readiness.

Internal Admin Mail

Updated 18 October 2026. The owner-only Google Workspace connection accesses the iPletch business mailbox on demand, separately from sign-in and user Gmail. Inbox metadata loads in pages of at most 25 messages; bodies are fetched only on explicit opening. Ordinary attachments show metadata only; bounded MIME body parts and up to eight inline raster images (500 kB each, 2 MB total hydration budget) may be fetched with the opened message. The isolated, sanitized reader loads validated external HTTPS images without a referrer; image hosts may observe the request and your IP address. Active HTML/scripts remain blocked. Opening a message requests removal of UNREAD using the existing gmail.modify grant; the UI changes only after provider confirmation. Mail content remains temporary in the active page/server request, never persistently copied to the database or browser storage, logged, used for advertising/analytics or sent to AI/LLM services. Credentials remain in the encrypted server-only vault. Disconnect attempts Google revocation and deletes the local credential.

Gmail — limited testing

Updated 17 October 2026. Gmail is available only to explicitly allowlisted iPletch test accounts and Google consent test users. Public Gmail rollout is disabled. Google sign-in and Internal Admin Mail are separate connections. Yahoo and Outlook remain unavailable.

After you choose Connect, Gmail authorization requests gmail.readonly for on-demand mailbox lists, provider-side search and message reading. Enabling sending additionally requests gmail.send; a new message or reply is sent only when you explicitly press Send. We process your mailbox address, message/thread identifiers, sender/recipient information, subjects, timestamps, snippets and requested message bodies. Gmail lists contain at most50 messages per page; the shared search queries the entire connected mailbox, including Spam/Trash and unloaded messages; bodies are fetched when opened or after a350ms hover/focus dwell in the active mailbox view. Attachment metadata is displayed; received-attachment download remains unavailable. When you choose files in a Gmail reply/new message, their names, MIME types and bytes (up to10files/5MiB total) are held in page memory and sent through iPletch to Gmail only after you press Send. Optional Cc/Bcc recipients and sanitized rich text are included in that message. The sent message and attachments are retained by Gmail under your mailbox settings; iPletch does not persist them. There is no background mailbox sync or message AI processing. External images are blocked in thumbnails and closed readers; explicitly opening the right-side reader enables them without a separate image-load switch; see the mail update below.

Google requests pass through the iPletch server on ChatGPT Sites/Cloudflare. Supabase stores account-bound encrypted access/refresh tokens, mailbox identity, granted scopes, expiring connection proofs and send-attempt markers. These providers process data to operate the requested connection; the processor and transfer-review limitations elsewhere in this notice still apply. Message bodies, attachments and drafts are not persistently copied into the application database or browser storage. They are temporarily held in the active page and server request; closing, logout or account switch clears page state.

Disconnect erases stored token ciphertext and attempts Google revocation. Failed remote revocation does not retain usable local credentials; you can also revoke access in your Google account. A revoked mailbox/lifecycle record remains; deleting the iPletch account cascades these private connection records. Expired OAuth proofs are cleaned on the next connection/disconnect or account deletion. Send-attempt markers older than 7 days are cleaned on the next send, not by a scheduled task. General account/backup retention and erasure gaps elsewhere remain disclosed. For access or deletion assistance contact privacy@ipletch.com.

iPletch limits use and transfer of Google API data to the requested, user-facing mail functions in accordance with the Google API Services User Data Policy, including Limited Use requirements. Mail data is not sold, used for advertising/profiling or model training, sent to AI/LLM services, or exposed to an admin mailbox reader. Google public verification and any required security assessment have not been established; testing is not evidence of approval.

Mail update, 17 October 2026: the connected mailbox and provider folders/labels are shown in the sidebar. Previously saved card presentation preferences remain in the private account; the card appearance editor has been removed; message bodies and drafts are still not persistently copied. Bounded inline raster images can be fetched with an opened message or a350ms hover/focus preview. Public sender-website icons are requested through the existing bounded iPletch proxy using only the website hostname, never the email address or body. Explicitly opening the right-side reader displays validated external HTTPS images without a referrer; there is no separate image-load switch; the image host may observe the request and your IP address. Copy/move requires separate gmail.modify consent and reconnect, and is available to configured test accounts after explicit reconnection. Copy/label adds destination label membership; move also removes the selected source label. Trash moves a message to Gmail Trash after confirmation, never permanently deletes it. The sidebar displays the provider UNREAD-label count. After a click, scroll gesture or reading key inside an explicitly opened reader, we remove UNREAD using separately granted gmail.modify permission; hovering or loading the body does not mark it read. Cards and counts update only after provider confirmation; no message code is enabled. Original message content remains unchanged. Preview thumbnails are sanitized, sandboxed and memory-only; external message images remain blocked in card thumbnails and closed readers.