Privacy Policy
Effective and last updated: July 27, 2026
Passive Analytics is local-first. Regular analysis data stays in your Chrome browser. Structured data is synchronized to our Supabase backend only when you choose to register, sign in, obtain access to the paid cloud feature, and enable it.
1. Data processed locally
On supported Instagram, TikTok, or Threads pages that you open, the extension passively organizes public account and content data already loaded by the page. This may include account names, public avatar source URLs, follower counts, post or video information, engagement metrics, publishing dates, and capture times. Analysis preferences, reports, favorites, notes, snapshots, comparisons, and small image caches are stored locally in Chrome storage or IndexedDB by default.
2. Optional account and cloud backup
When you create a Passive Analytics account or sign in with Google, Supabase Auth processes your email address, display name, user identifier, and authentication session. Google sign-in requests only basic profile and email information. Google provider tokens and provider refresh tokens are not stored.
Only after you sign in, receive a paid entitlement, and explicitly enable cloud features may the extension synchronize structured workspace records: saved creator accounts, post fields, snapshots, notes, project relationships, and ordinary analysis or report settings. These records support online backup, cross-device restore, and team collaboration. Version 0.8.0 does not upload locally cached avatar or post-thumbnail Blobs.
3. Data we do not collect or upload
- We do not read, store, or upload Instagram, TikTok, or Threads cookies, authorization headers, CSRF tokens, platform sessions, passwords, or other platform credentials.
- We do not construct, call, or replay non-public platform APIs, and we do not upload raw HTML or complete network responses.
- We do not sell personal data or use it for cross-site advertising.
- Cloud sessions are excluded from ordinary settings backups and exports and are not exposed to the page context or content scripts.
4. Service providers and data region
We use Supabase for authentication and PostgreSQL cloud storage. Our cloud project is hosted in the Singapore region. If you use Google sign-in, Google processes the authentication and consent-screen information under its own policies. We do not share data with other third parties except to provide the service, maintain security, or comply with law.
5. Retention, security, and deletion
You control local data and can clear it in the extension settings or remove the extension through Chrome. Cloud data is isolated by workspace permissions and row-level security. After synchronized data is deleted, a deletion marker may be retained for up to 90 days to prevent an offline device from restoring it. Contact us to request deletion of your Passive Analytics cloud account or workspace data. We may retain limited synchronization and audit records when necessary for security, troubleshooting, and replay protection.
6. Your choices
You may continue using local analysis without registering, signing in, or enabling cloud features. You may sign out, disable synchronization, delete local data, or request deletion of your cloud account data. Revoking Google access does not automatically delete data already synchronized to Passive Analytics; contact us if you also want that data deleted.
7. Updates and contact
If our features or data practices materially change, we will update this page and its effective date. For privacy questions or data access and deletion requests, contact weiting@zhenguocool.com.