ScrollGistPrivacy Policy
1. Who we are
This policy covers the ScrollGist browser extension, the ScrollGist web app at scrollgist.app/app, and the scrollgist.app service that powers them. The data controller is Clarity4Us Dijital Çözümler ve Danışmanlık Anonim Şirketi, registered in Istanbul, Türkiye ("we", "us") — see the contact page for full company details. Questions: privacy@scrollgist.app.
2. What ScrollGist accesses
2a. The extension
ScrollGist only acts on the pages it supports — Instagram, Facebook, and Twitter/X. On a supported post its panel appears on its own so it is there when you want it, but it stays idle: nothing is captured, analyzed, or sent anywhere until you yourself start a transcription, an analysis, or a reading of the text on the video. Merely scrolling contacts no server. When you do act, it may access:
- Video audio of the video you are viewing, to produce a transcript.
- Post text (the caption/body), when you choose to analyze it.
- Still frames of the video you are viewing — a handful of images sampled from it — when you choose to read the text shown on the video. They are never stored.
- The current post's URL, used only as a local cache key on your device.
The extension does not read your messages, your feed at large, your account credentials, your contacts, or your browsing history, and it does nothing on other websites.
2b. The web app
The web app at scrollgist.app/app sends nothing until you choose a file or press "Use this text". It asks for no permissions: no camera, microphone, location, contacts or photo library. It sees only:
- The one file you choose (a screen recording, a saved video or a voice recording). Its sound track is taken out on your phone and turned into a short audio recording: 16 kHz mono, at most the first 6 minutes. Only that audio is sent. The picture and the file itself never leave your phone.
- Text you paste, when you choose to analyze it.
- What you share to the installed app (Android's share menu): a file goes through the same steps as a chosen file. A shared link is never opened, fetched or sent anywhere; the app only explains how to use a recording instead. Any words that came with it are put in the text box, and are sent only if you then choose to analyze them.
3. Two modes, two data flows
3a. ScrollGist mode (default)
Content is sent from your browser to our API (api.scrollgist.app, running on
Cloudflare), which forwards it to an AI provider and returns the result.
| Data | Path | Retention |
|---|---|---|
| Recorded video audio / still video frames / post text / transcripts being analyzed | Your browser → our API → AI provider (currently OpenAI, with Groq as a fallback if it is unavailable; still frames go to OpenAI only) → back to you | None on our side: transit only — never written to disk or logged by us, discarded the moment your result is returned. Neither provider uses it for training. OpenAI may keep API inputs for up to 30 days solely for abuse monitoring, under its own policy. Groq keeps nothing: our Groq account has Zero Data Retention enabled. |
| Anonymous device token (a random identifier generated by the extension or the web app), usage counters, plan/entitlement status | Stored by our API | Kept while you use the service; deleted on request |
| A random id for the video your latest credit is for (made up by the extension or the web app for each post or file, not derived from its address), and how many transcriptions, on-screen readings and analyses have used that credit | Stored by our API, with the device token | Replaced by the next credit; deleted with the device token |
| A salted, one-way hash of your IP address, used only as a rate-limit counter (abuse prevention). Raw IP addresses are never stored. | Stored by our API | Deleted automatically once its rate-limit window ends — within 25 hours at most. Not linked to your device token or to any other data |
The device token is random and is not linked to your name, email, or social accounts. We cannot tell who you are from it, and we cannot see which posts you visit — only how many credits it has used. The video id is random too: it lets more work on the same video use the same credit, and tells us nothing about which video it is.
3b. Bring-your-own-key mode (advanced, optional, extension only)
If you enter your own API key in the extension's Settings, requests go directly from your browser to the provider, authenticated with your key. Nothing touches ScrollGist servers. Data sent this way is handled under that provider's own privacy policy.
- On-screen text (still frames of the video) is read by OpenAI, using your OpenAI key.
- Analyses (summary, explanation, idea map) go to the provider you select: OpenAI, Google (Gemini), Groq, Mistral, Anthropic, OpenRouter, or a local Ollama.
- Audio transcription goes to Groq if you saved a Groq key, otherwise to OpenAI — the only two that offer speech-to-text here. If Groq fails and you also saved an OpenAI key, it is retried with OpenAI.
4. What is stored on your device
| Data | Where | Lifetime |
|---|---|---|
| Preferences (language, mode), the anonymous device token, and — in BYOK mode — your API keys | Your browser's local extension storage, on your device only | Until you change them or uninstall |
A log of the last 30 error codes (for example capture_silent), with times — never content, URLs, or keys |
Your browser's local extension storage, on your device only | Until you uninstall. It leaves your device only if you choose to send it in a "Report a problem" email |
| Transcripts and analyses you generate (cached per post so revisiting is instant) | Your browser's session storage, on your device only | Cleared automatically when you close the browser |
| Web app: the anonymous device token and your two language choices (page and results) | The browser's local storage for scrollgist.app, on your device only | Until you clear this site's data in your browser (or remove the installed app) |
| Web app: a file or text shared to the installed app | The browser's storage for scrollgist.app (IndexedDB), on your device only | Only until the app opens it, a moment later; then deleted |
| Web app: your transcript and results | Only the open page | Gone when you close or reload the page. The web app keeps no copy and works only online: its service worker receives shares and stores nothing else |
BYOK API keys are never sent anywhere except, as credentials, to the provider they belong to.
5. Payments
ScrollGist Pro is sold by Paddle, our merchant of record. Paddle collects your email address, payment details and billing country and handles invoicing and tax under its own privacy policy. We never see your card number, and Paddle does not send us your email address.
On the upgrade page. Nothing from Paddle loads when you open the page. When you press a buy button, the page loads Paddle's checkout scripts, which run under Paddle's privacy policy. These include Paddle's own subscription-measurement script (ProfitWell, part of Paddle Retain), which Paddle loads with every live checkout. It sets no cookies and stores nothing in your browser, and we do not pass it your email or any identifier.
What we store to give you Pro. From Paddle we receive, and keep on our server, a customer reference, a subscription reference, which plan it is, its status and the date the paid period ends, plus a count of the videos you have used this month. These are linked to the anonymous device token(s) of the browser(s) you use Pro on, not to your name or email. We do not store your email: Paddle holds it, and we look it up in Paddle's dashboard only to help you with support or a refund. We keep them while the subscription exists and for 90 days after it is cancelled, then delete them together with the link to your device.
Short-lived helpers. Starting a checkout creates a random one-time code that ties the purchase to your browser; it is deleted when the purchase completes, or after 48 hours. "Move Pro to another device" creates a code that works once and expires after 15 minutes; we store only a hash of it. Paddle's notification ids are kept for 30 days to ignore duplicates.
6. What we never collect
No analytics, no crash or usage telemetry from the extension or the web app, no advertising identifiers, no behavioral tracking, no selling or sharing of data — in either mode. We cannot see which posts you watch or what their content was. When a request fails, our server logs the endpoint, the status code, and the AI provider's error code — never your content — and keeps those logs for up to 7 days. Cloudflare's automatic per-request logging, which would record request details such as IP addresses, is turned off. To notice outages, the server also counts these error codes per hour and emails the counts to us — codes and numbers only, with no content and nothing that identifies you.
7. Sub-processors
- Cloudflare — hosting and network infrastructure for our API and this website.
- OpenAI — AI transcription and analysis in ScrollGist mode.
- Groq — the same, used as a fallback when OpenAI is unavailable.
- Paddle — payments, invoicing and tax as merchant of record; its checkout scripts on the upgrade page.
8. Why the extension asks for each permission
activeTab/tabCapture— to capture the audio of the video in the tab you are viewing, only after you click the toolbar button and then the transcribe button. In the panel that opens inside the page, audio is recorded from the video itself, only after you click its transcribe button.sidePanel— to show the panel where results appear.storage— to keep preferences (and, in BYOK mode, your keys) on your device.- The current post's URL is read through the host access below — the extension does not hold the broad "tabs" permission, so it cannot see any other tab.
clipboardWrite— to let you copy results.- Host access to
instagram.com,facebook.com,twitter.comandx.com— to read the post you are viewing — and toapi.scrollgist.appfor the default mode. No broad "all sites" access is requested. - The AI provider domains are optional: they are requested only if you switch to bring-your-own-key mode, and not granted otherwise.
The web app asks for no permissions at all (section 2b).
9. Your rights and deleting your data
- On your device: uninstalling the extension deletes all of its local and session storage, including any keys. For the web app, clear scrollgist.app's site data in your browser settings (or remove the installed app).
- On our servers: email privacy@scrollgist.app to have your device token and its counters deleted. Since the token is anonymous, include it so we can find the record: it is shown in the extension's Settings, and at the bottom of the web app under "Your device ID".
- If you have Pro: cancel the subscription first, from the link in your Paddle receipt email, or it keeps renewing. A deletion request then also removes the subscription references we hold and their link to your device.
- Payment data: managed through Paddle under its policy; billing-related requests can also be sent to us and we will coordinate.
Depending on where you live (including under GDPR and Turkey's KVKK), you may have rights of access, correction, deletion, and objection. For content we process in transit there is nothing to access or delete — it is not retained. For the counters described above, contact us.
10. Children
ScrollGist is not directed at children under 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal data from children.
11. Changes
If our data practices change, we will update this policy and its effective date before the change ships. Material changes will also be noted in the extension's release notes.
12. Contact
privacy@scrollgist.app — or support@scrollgist.app for general support.