Privacy policy
This policy covers the Kurippu browser extension and this product website. The extension keeps note data under your control and contains no advertising or analytics. The website measures visits with Google Analytics only after you agree.
Data attached to a note
A saved note consists of its written content, color, tags, creation and edit times, and the address of the page where you made it. Kurippu also records only the placement details required to restore that note: its page position, a reference to the closest relevant element and a brief sample of that element’s text. It does not retain other material from the websites you browse.
Storage locations
- Your device
- The primary copy lives in storage assigned to Kurippu by your browser. Without sync or backup, it remains on that device.
- Your browser account
- When browser sync is enabled, your browser provider transfers Kurippu data among your signed-in devices. The provider handles that synced copy according to its own privacy policy.
- Your Google Drive
- A backup is placed there only after you enable the optional Drive feature described next.
Optional Drive backups
Kurippu does not activate this feature until you choose it and sign in to Google. The permission it requests is limited to a private app folder, where the extension maintains one backup file. That scope does not allow Kurippu to view, open or modify the rest of your Drive. The extension also obtains the connected account’s email address and ID. It displays the email in settings for account identification and uses the ID when deriving the backup’s encryption key.
Encryption happens locally before the file is uploaded, and the extension communicates with Google without passing data through a Kurippu server. Since the encryption key is based on your Google account, protecting that account protects the backup. We recommend enabling 2-Step Verification.
Kurippu’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Analytics on this website
With your permission, this site uses Google Analytics 4 to learn how people arrive and which parts they use. The information sent to Google includes page views, page addresses, referring pages, selected actions such as Add to Chrome button clicks, and device details such as language, browser, operating system, device type and screen size. Google may also determine an approximate location. Analytics does not produce heatmaps or screen recordings here, and we exclude the text entered in demo notes, your name, your email address and any other custom identifier.
Nothing from Google Analytics is loaded or requested before you select Allow analytics. After consent, it may place first-party cookies including _ga and _ga_<container-id>, which distinguish visitors and sessions. We keep advertising storage, advertising user data, advertising personalization and Google signals switched off.
The site records your decision in this browser’s localStorage as kurippu-site-google-analytics-consent-v1. That entry uses browser storage rather than a cookie. The Analytics settings link in the footer lets you revise the decision whenever you wish. If you decline or later withdraw permission, future pages will not load Google Analytics. Previously created analytics cookies can persist until you remove them or they expire, but this site will neither load Analytics nor read those cookies.
Google is the recipient and processor of analytics information. During collection, it uses IP addresses for functions that include estimating location and securing the service, then says it discards the raw addresses. The default lifetime of _ga cookies is two years. Retention of user-level and event-level information depends on the Analytics property’s configured retention period. Further details are available in Google’s Privacy Policy, its explanation of data use on partner sites and the Google Analytics retention documentation.
Limits on extension data use
- No Kurippu-operated server receives, holds or forwards note data.
- Analytics, tracking pixels and crash-reporting services are absent from the extension.
- Kurippu displays no advertising and does not sell or rent data. The website sends analytics information only to Google under the terms above.
- Kurippu does not compile a browsing history. It retains an address only when you attach a note to that page.
Why the extension asks for access
| Permission | Why |
|---|---|
| Read and change data on websites | Places notes on visited pages and reconnects them to their chosen page elements. |
| Context menus | Provides the “Add sticky note here” option when you right-click. |
| Storage | Keeps note data locally and makes browser sync available. |
| Identity | Connects your Google account after you opt into Drive backup. |
| Alarms | Triggers scheduled backups at the hourly or daily interval you select. |
Managing and deleting your data
Individual notes can be changed or removed at any time. From the options page, you can download the complete collection as Markdown or JSON, or erase every note. Disconnecting Google Drive ends future backups. To delete its existing backup as well, remove Kurippu’s data from Manage apps in Drive settings, then revoke the connection at myaccount.google.com/permissions. Removing the extension clears the Kurippu data held by your browser.
Children
Neither the extension nor this site is intended for anyone younger than 13. We do not knowingly gather information from children in that age group.
Independent verification
The extension is free and open source. Its public repository on GitHub lets you inspect its storage and network behavior directly. Attribution and license information for this website’s fonts and icons appears in the third-party notices.
Policy updates and questions
Revisions will appear on this page with a new effective date. Material changes will also be identified in the extension’s release notes. For questions about this policy, contact hello@yush.dev.