Privacy Policy
What Captorify collects, what it doesn't, what we share with third parties, and how to ask us to delete it. Plain language throughout.
Effective · 30 April 2026
The free-tier privacy invariant
The Captorify browser extension's free-tier code path makes zero network calls to any captorify.com endpoint. No telemetry, no error reporting, no analytics. The published extension binary can be inspected.
If you only use the free extension, Captorify never receives any data about you, your captures, or your browsing.
Public website tools
Public-tool information updated 9 September 2026. The policy effective date above remains unchanged.
The website’s public tools process a PNG, JPG or WebP you choose in the browser. They do not upload your image or extracted text. OCR downloads recognition software and English language data when needed.
These tools do not create an account or a cloud capture. Cloud sync and hosted sharing are separate workflows. Review the exported file before sending it to another service.
Opening these pages makes ordinary website requests. OCR also requests its software and language data from jsDelivr, which receives connection information such as your IP address. Image pixels and extracted text are not included in those requests. Google Analytics and live-chat scripts do not load on the public-tool pages.
What we collect
Pro and Team users opt into cloud features that require us to store data. The categories below are everything we hold; we do not sell it.
Account
Your email address, hashed session tokens, and hashed magic-link nonces.
Captures
Pro/Team only. Capture binary, source URL, dimensions, and capture timestamps.
Billing
Stripe customer ID and invoice history. Card numbers are stored by Stripe, not by us.
Telemetry
None on the free tier. Pro sends operational signals only (rate-limit counters).
How we use information
Sign you in via magic link and keep your session active.
Sync Pro captures across your devices and serve share-link previews.
Process subscriptions, invoices, and renewals via Stripe.
Respond to support requests on Featurebase or Pro live chat.
Investigate suspected abuse and keep service-level audit logs.
Encryption at rest
Cloudflare R2 applies AES-256 encryption to every stored object on disk by default. Captorify holds the decryption keys. This is not end-to-end encryption. Captorify staff with production access, a leaked R2 API key, or a lawful subpoena could decrypt captures.
Users who require stronger guarantees should keep captures in the local-only free tier, which never reaches our servers.
Disclosures to third parties
We share only the minimum necessary for each service. We do not share user data with advertisers.
Stripe
Email and purchase context to process payments and issue invoices.
Cloudflare R2
Capture binaries stored under Cloudflare's standard storage terms.
Resend
Email address and transactional message body for sign-in links and billing alerts.
Authorities
Information legally required by valid court order or law-enforcement request.
Retention & control
Cloud captures are retained until you delete them, close the account, or the unpaid grace period ends.
If a paid subscription is not renewed, cloud captures stay available to the account owner during a 30-day unpaid grace window, then become inaccessible and are queued for deletion.
Deleted captures and expired unpaid captures are purged from active storage within 30 days. Private recovery backups or quarantine copies may remain for up to 90 days to recover from operator or job mistakes.
Account closure disables access and queues captures, share links, and personal data for deletion.
Stripe billing records are retained for 7 years for legal and tax compliance.
To export, correct, or delete your data, contact [email protected].
Changes to this policy
We post material changes at least 30 days before they take effect, both on this page and via email to active accounts. The Effective date at the top of this page reflects the most recent revision.