How Nilon collects, uses, and protects your data.
Last updated · May 23, 2026
The short version: Nilon saves AI outputs you choose to capture, processes them with AI to add tags, and stores them in your private vault. We don't sell your data, we don't train on your content, and you can export or delete everything at any time.
This Privacy Policy explains what information Nilon collects when you use our web application and Chrome extension, how we use that information, and what choices you have. By using Nilon you agree to the practices described here.
Nilon is operated by Lincoln Laylor ("we", "us", "our"). If you have questions, email us at support@nilon.io.
When you create an account we collect:
When you save an AI output via the extension or web app, we collect the following website content and user-generated content:
We collect basic user activity telemetry to operate the service:
We do not collect device fingerprints, keystrokes, web browsing history, or navigation activity on any site. We do not collect any data from web pages you visit other than the specific AI conversation content you explicitly choose to save.
Payment information (card number, billing address) is collected directly by Stripe and never passes through our servers. We store only your Stripe Customer ID to manage your subscription.
| Data | Purpose | Basis |
|---|---|---|
| Email address | Authentication, account security, optional digest emails | Contract performance |
| Saved content (website content) | Storing and displaying your vault; auto-tagging via Haiku | Contract performance |
| Source URL & platform | Displaying provenance on save cards; selector health monitoring | Legitimate interest |
| User activity counters | Enforcing free tier limits (50 saves); billing; product improvement | Contract performance / Legitimate interest |
| Stripe Customer ID | Subscription management, upgrading plan on successful payment | Contract performance |
We never use your saved content to train AI models, build advertising profiles, or share it with third parties for their own commercial purposes.
Your data is stored in Supabase, a managed Postgres database hosted on AWS infrastructure in the US East (N. Virginia) region. All data is encrypted at rest (AES-256) and in transit (TLS 1.2+).
Row-level security (RLS) policies are enforced at the database level — it is architecturally impossible for one user's vault to be read by another user, even if there were a bug in the application layer.
Supabase Auth manages session tokens. The Chrome extension reads your session cookie from nilon.io — it never copies tokens to extension storage. For details, see Chrome extension.
Human access to user data: Nilon staff do not read the content of your saved outputs. Human access to vault content is only permitted in the event of a security investigation, a legal obligation, or with your explicit written consent.
We share your data with the following service providers solely to operate Nilon. We do not sell your personal data, share it for advertising purposes, or disclose it to any party not listed below.
| Service | Data shared | Purpose |
|---|---|---|
| Supabase | Email, saves, tags, auth tokens | Database, authentication, and storage |
| Anthropic | Save content (text only) | Auto-tagging and title generation |
| Stripe | Email, Stripe Customer ID | Payment processing and subscription management |
| Vercel | IP address, user agent, request path | Web app hosting and delivery |
| Sentry | User ID, email (on error only) | Error monitoring and crash reporting |
| PostHog | Pseudonymous user ID, page views, UI events | Product analytics (usage patterns, feature adoption) |
We do not sell your personal data. We do not share your data with advertisers, data brokers, or any third party for their own commercial or marketing purposes.
Database, authentication, and file storage provider. Your saves, account, and auth tokens are stored on Supabase infrastructure. Supabase is SOC 2 Type II certified. Supabase Privacy Policy →
When you save a piece of AI output, the text content is sent to Anthropic's API (Claude Haiku model) to generate tags, a title, and a content type classification. Anthropic does not use data submitted via its API for model training. API usage data is not used to improve Anthropic's models. Anthropic's data handling is governed by their Privacy Policy.
Payment processing for Pro subscriptions. Stripe collects payment card data directly via Stripe Checkout — it never passes through our servers. We receive only a customer ID and subscription status. Stripe is PCI DSS Level 1 certified. Stripe Privacy Policy →
Our web application is deployed on Vercel. Vercel may log request metadata (IP address, user agent, response status) for operational purposes. Vercel Privacy Policy →
We use Sentry for error monitoring in the web application and Chrome extension. When an error occurs, Sentry may receive your user ID and email address alongside the error report to help us diagnose account-specific issues. Error reports are not used for advertising and are not shared with third parties. Data is retained by Sentry for 90 days. Sentry Privacy Policy →
We use PostHog for product analytics in the web application. PostHog collects pseudonymous event data — page views, feature interactions, and general usage patterns — associated with a randomly generated user identifier. If you are logged in, that identifier may be linked to your account for the purpose of understanding feature adoption. PostHog does not receive your saved content, email address (unless you are logged in and we have explicitly identified your session), or payment information. You can opt out of analytics by enabling the "Do Not Track" setting in your browser. PostHog Privacy Policy →
The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.
Data collected via Chrome extension permissions is used solely to provide the core functionality of Nilon — saving, organising, and retrieving your AI outputs. We do not use this data for any secondary purpose.
Specifically, data accessed via extension permissions is:
Human access restriction: Nilon staff do not read the content of your saved outputs. The only circumstances under which a human may access your data are: (1) a security investigation into a suspected breach or abuse, (2) a legal obligation under applicable law, or (3) your explicit written request or consent.
These restrictions apply to raw data, aggregated or anonymised derivatives, and any content accessed via extension host permissions.
The extension operates in two modes. In both cases, data is only collected when you explicitly perform a save action — the extension does not collect data passively or in the background.
When you click the extension icon to save a full conversation, or highlight text and click the clip button, the following data is transmitted to Nilon's servers over HTTPS:
https://chatgpt.com/c/abc123). This lets you return to the original conversation from your vault.Save content is processed by Anthropic's Claude Haiku model to generate tags and a title. See Third-party data sharing for details.
When you open the extension popup, the background service worker makes the following network requests to Nilon's servers:
While the popup is open, if a save is still being processed (tags not yet generated), the popup polls the recent saves endpoint approximately every four seconds until processing completes or three minutes elapses.
The extension stores the following data in chrome.storage.local on your device. This data never leaves your browser unless explicitly noted.
Authentication tokens (your Supabase session) are stored exclusively in first-party cookies on nilon.io. They are never copied to chrome.storage.
The extension's background service worker uses Sentry for error monitoring. If the extension encounters a technical error (such as a failed save or a network issue), Sentry may receive:
Error reports are not used for advertising and are not shared with third parties beyond Sentry's infrastructure. Data is retained by Sentry for 90 days. The extension does not use any other third-party analytics SDK.
The Nilon Chrome extension requests the following permissions. Each is described below with the specific reason it is required.
| Permission | Why it's needed |
|---|---|
| activeTab | Grants access to the URL and content of the currently active tab at the moment you click the extension icon — used to detect which AI platform you are on and to trigger a whole-chat save. |
| scripting | Used to inject content scripts into supported AI platform pages when you trigger a save. The injected scripts read conversation text from the page DOM and transmit it to Nilon's servers over HTTPS. Scripts are only executed at the moment you initiate a save action — they are not active in the background and do not monitor page activity passively. |
| storage | Stores the DOM selector cache, your UI preferences (which buttons are shown), and the saved position of the floating save button — all in chrome.storage.local. No vault content or authentication tokens are stored here. |
| cookies | Reads and refreshes your Supabase authentication session cookie on nilon.io so the extension can make authenticated API calls without requiring a separate login. When Supabase issues a new access token, the extension writes the updated token back to the cookie on your behalf. Only nilon.io cookies are accessed — no cookies from ChatGPT, Claude, Gemini, Perplexity, or any other site are read. |
Host permissionhttps://nilon.io/* | Required to read and refresh the session cookie and to call Nilon's backend APIs (save content, fetch recent saves, check your plan). |
Host permissionschatgpt.com, claude.ai, gemini.google.com, perplexity.ai | Required to inject the content scripts that read conversation text when you trigger a save, and to display the floating save button and clip button on these pages. The extension only reads page content at the moment you explicitly trigger a save action — it does not passively monitor, log, or transmit your activity on these platforms. Your web browsing activity, navigation history, and any content you do not explicitly save is never accessed, collected, or transmitted. |
Your data is retained for as long as your account is active. You may delete individual saves at any time from the vault. You may export your full vault as a JSON file from the Settings page.
To delete your account and all associated data, go to Settings → Danger zone → Delete account. This permanently deletes your saves, tags, action history, and auth credentials within 24 hours. Stripe subscription data is retained by Stripe per their retention policy.
Backups may retain your data for up to 30 days after deletion before being overwritten. During this window the data is inaccessible and will not be restored unless you request it by emailing support@nilon.io.
Regardless of your location, we honour the following rights:
If you are in the European Economic Area (EEA), United Kingdom, or California, you have additional rights under GDPR, UK GDPR, and CCPA respectively. Contact us to exercise them.
Questions about this policy or your data? Email support@nilon.io.
We will respond within 5 business days. For account deletion or data export requests, we encourage you to use the self-service tools in Settings — they are immediate. Email requests are processed within 30 days.
This policy may be updated from time to time. Material changes will be communicated via email to registered users at least 14 days before taking effect.