Join the waitlist

Privacy

Privacy policy

Last updated 1 November 2026

This policy covers both parts of KlipVault: this website, klipvault.app, where you can join the waitlist, and the KlipVault app at app.klipvault.app, where your library lives. It says what each one collects, why, who else handles it, and what you can do about it.

Who is responsible

KlipVault is run by SpiderTags, which is responsible for your personal data under this policy:

SpiderTagsNo 85, Sriri Dammathissa Mw, Nelligoda80562 AhungallaSri Lanka

For anything about your data, write to hello@klipvault.app.

This website: the waitlist

If you join the waitlist: your email address, the time you joined, the language of the page you joined on, and, if you came through a friend’s invite link, that link’s code, so the friend can see that someone joined. Nothing else is asked for, and nothing is collected if you only read the site.

What it’s used for

A short confirmation that you’re on the list, then one email when there’s a place for you in KlipVault. Your address isn’t added to a newsletter, sold, or shared for marketing.

What this site doesn’t do

  • It sets one cookie, and only if you choose a language: it remembers that choice, and the KlipVault app reads it too, so its sign-in page matches.
  • It runs no analytics, advertising or tracking scripts.
  • Your light or dark theme choice is kept in your own browser and is never sent to us.
  • Its images and background video are served from this site, not a third party.

Who else sees it

The site is hosted by Vercel, which keeps standard request logs (such as IP address and browser type) to run and protect the service. Waitlist addresses are stored in Supabase, the database KlipVault itself runs on, in a table this website can add to but cannot read. Emails, the waitlist confirmation and a note to KlipVault about each new signup, are sent through KlipVault's own mailbox at Hostinger.

Removing your email

Write to hello@klipvault.app and it will be deleted.

The KlipVault app

Once you’re in, your library lives in the KlipVault app at app.klipvault.app. The rest of this policy is about the app.

Your account

  • Your email address, to sign you in with a link we email you (there are no passwords), with the time you joined and last signed in.
  • What you choose to add: a display name, a profile photo or colour, and your language and light or dark theme.
  • Cookies that keep you signed in and remember your language and how you like the app laid out: the sidebar, each section’s default view and folder-tile size, the section you were last in, and suggestions you’ve put off for a while. None of them track you, and there are no advertising or analytics cookies.
  • A few things kept only in your own browser, such as your theme, a list of what you recently opened from search, and each playlist’s shuffle and loop.
  • Limits against misuse: how many sign-in links are asked for from your network, kept as a scrambled form of its address that can’t be turned back into it (never the address itself), and how many things your account saves in an hour. Both are counts, deleted within a day.

Your library

What you save: each link, its title, caption and creator, a thumbnail’s address, for a Facebook or Instagram post its text and how many pictures it has, and what you add to it — notes, tags, folders, favourites, playlists, which videos you’ve watched, and how far into each one you got, so it can carry on where you stopped. Only your account can read it, unless you share a playlist or a folder (below); the database itself refuses everyone else.

To show a saved link well, the app asks for its details: YouTube’s and Instagram’s preview information, a Facebook post’s or a TikTok video’s page, or, for any other link, the site’s home page, for its logo and colour. It asks again when a thumbnail’s link runs out, so the picture keeps working. Thumbnails and logos then load in your browser straight from where they came from, without saying which page asked. KlipVault never downloads or re-hosts a video.

If you follow a YouTube channel or playlist, KlipVault’s server reads its public YouTube feed, the list of its newest videos anyone can open, about every two hours, and saves the new ones to your library with their title, channel, date and thumbnail address. When you follow a channel, the server also reads the channel’s public page once, for its name and picture. No YouTube account is involved, YouTube sees KlipVault’s server asking, not you, and nothing is sent to YouTube about you. It stops when you unfollow; the videos already saved stay. Following a website works the same way: the server reads the site’s public feed (RSS or Atom) about every two hours and saves its new articles as links, with their title and date; when you follow, it reads the address you gave once to find the feed. The site sees KlipVault’s server asking, not you.

A saved link can have a cover picture you choose: one you upload or paste, a screenshot of a screen or window you pick in your browser (only the part you crop and save leaves your computer), or the site’s own preview picture, which KlipVault’s server reads from the link’s page only when you press for it. With the browser extension you can also tick “Use this page as the cover” when you save, and it sends a picture of the visible page. The cropped picture is stored privately for your account in Supabase, only you can see it, and it is deleted with the link or your account.

No YouTube, Facebook, Instagram or TikTok player loads until you press play. When you do, that platform’s player runs, and the platform sees the visit as it would on its own site. TikTok’s player may first ask whether it may use cookies; that question is TikTok’s, and your answer stays with TikTok. For a Facebook video or an Instagram reel, KlipVault’s server also asks, at that moment, whether it can play outside their site, by reading the same embed page anyone can see; nothing from it is kept. A saved post opens in KlipVault with what the app keeps (its picture from where it came from, its text and who posted it). For a public Facebook post, KlipVault’s server then reads the post as Facebook shows it to anyone (its whole text and up to five pictures) so it can show it to you; Facebook sees KlipVault’s server asking, not you, and nothing it sends is kept. The pictures load straight from Facebook without saying which page asked. Instagram’s own post loads only when you press Show the real post. For a saved Bluesky post, KlipVault’s server reads it from Bluesky’s public service (its text, who posted it and its pictures), on saving and when you open it; for an X post, it reads X’s public embed text (its words, who posted it and when). Bluesky and X see KlipVault’s server asking, not you, and nothing they send is kept beyond the post’s text, author and first picture’s address. X’s own post, with its pictures, loads only when you press Show the real post. For a saved LinkedIn post, KlipVault’s server reads the post’s public page on LinkedIn (its text, who posted it, when, and its picture), on saving and when you open it; LinkedIn sees KlipVault’s server asking, not you, and nothing it sends is kept beyond the post’s text, author, date and picture’s address. No LinkedIn script ever loads.

Sharing with other people

You can share a playlist or a folder with people who use KlipVault. Every account has a @username; you find people by it or by their name and invite them, and they accept or decline in the app. People you share with, and anyone signed in who looks you up, see your display name and @username, never your email address. They also see the picture you chose for your account: one of KlipVault’s illustrations shows to anyone signed in who sees your name, a photo you uploaded only to people you share with or have an open invitation with. Nobody joins without a yes. When you open a playlist or folder shared with you, KlipVault keeps when you last opened it, to show what is new since; the person who shared it sees who has it, each person’s right and since when.

People in a shared playlist see its name, your display name, the other members’ display names, and, for each video, only what’s needed to play it: its title, link, thumbnail, length and who added it. They never see your email address, notes, tags, folders, other playlists or anything AI wrote. Each person’s watched marks are their own.

Anyone in a shared playlist can save a copy of a video, or of the whole playlist, into their own library, or add its videos to a playlist of their own. A copy is theirs and stays after you remove them or delete the playlist; it remembers who shared it, so its details can say whose it was. When you remove someone or delete the playlist, they lose access at once and are told.

On a public page, anyone can ask to join: someone signed in with one press, someone without an account with their name and email address. You see their name, never their address, and answer in the app; they hear your answer there. Sharing sends no emails. If you approve someone new, they sign in on that page with the address they asked with, and their account is made then; until a request is answered, KlipVault keeps that name and address with it. If you ask without an account, the page remembers your request in a cookie on that device.

A folder is shared the same way. People you let in see its name, the folders under it and, for each item filed there, only its title, link, thumbnail, length and who added it. They can save a copy of an item or of the whole folder, or add its videos to a playlist of their own. If you give someone Can add or Can edit, they can add items from their own library: each becomes an item in your library, in that folder, marked with who added it (something you already have stays where you filed it). Can add takes out only what they added, Can edit any item; what they take out goes to your Archive, where you can restore it. Nobody you share with deletes anything of yours or renames your folders.

You can also send one video or link to someone you already share a playlist or folder with. They see your display name, the note you add, and the item’s title, link, thumbnail and length, on their bell and under Shared with you, and can save a copy or dismiss it. There is no way to send to an email address.

You can turn on a public page for a playlist or folder of yours. Anyone with its link can then see its name, your display name and, for each item, its title, link, thumbnail and length, without an account; never your email address, notes, tags or anything AI wrote. The page asks search engines not to list it. Videos play on the page only when someone presses play, which is when that video’s platform first loads; links open on their own site. Turning it off stops the link at once, and turning it on again makes a new one. You can also show it on your own website with its embed code: visitors there see the same titles, links and thumbnails, loaded from KlipVault and from where the thumbnails came from, and each opens on its own site, unless you switch on Play videos here: then a video plays inside your site when a visitor presses it, and only then does that video’s platform load its player there. Turning the public page off empties it there too. If you also let visitors suggest videos, a visitor’s suggestion keeps the link, the name they typed and their note for you, until you add or decline it or delete your account; if they are signed in, their account is noted only to limit how many they send a day, and you never see it.

Ways things come in

  • The browser extension (Chrome, Edge or Brave on a computer): when you use it, it sends the page’s link, title and any text you selected. On a Facebook or Instagram Saved page you opened, Import to KlipVault sends the links and titles of the posts on it, and a post’s text as the page shows it. On a YouTube list you opened, such as Watch later, Liked videos or a playlist, it sends each video’s link and title, in the list’s order. If you turn on bookmark sync, it sends the bookmarks in the folders you choose and keeps them in step. It signs in with a key the app stores only in scrambled form.
  • Your phone: sharing to KlipVault, from the installed app on Android or a Shortcut on iPhone, sends that link.
  • Files and pasted links: the app keeps the links in them, with their titles and folders, not the file itself.
  • YouTube and Chrome bookmarks, through your Google account, and Send to KlipVault, through a Messenger or Instagram chat: see the next sections.

Send to KlipVault (Messenger and Instagram)

If you link a Messenger or Instagram chat to your library, with a one-time code from the app, Meta, which runs both, tells KlipVault when you send something to KlipVault’s account. The app then asks Meta for the post you shared and saves its link and a title taken from the first line of its caption. The rest of your message isn’t kept.

To know which library a message belongs to, the app keeps the ID Meta gives your chat with KlipVault, not your Facebook or Instagram profile. Its replies, such as “Saved”, go back through Meta. You can unlink the chat at any time in the app’s Settings; what it already saved stays until you remove it.

The app and your Google account

If you connect YouTube or Chrome bookmarks in the KlipVault app, it reads from your Google account with your permission — only what each connection needs:

  • YouTube, read-only: the videos you’ve liked and your playlists — for each video its title, channel, a short part of its description, publish date, length and thumbnail — and your channel’s name, to show which account is connected. The app never posts, likes, subscribes or changes anything on YouTube.
  • Chrome bookmarks: Google prepares an export of the bookmarks Chrome keeps in your account. The app reads it when you open the bookmark picker and saves only the bookmarks you choose — their titles, addresses and folders. The export itself isn’t kept.

What you import is stored in your KlipVault library in Supabase, where only your account can read it. The access Google grants is stored encrypted and used only to fetch what you ask for.

Google data travels over HTTPS and is kept in an encrypted database, where the database itself allows each row to be read only by the account it belongs to. Google’s access tokens are encrypted with AES-256-GCM before they are stored, and the key exists only on our servers. Administrators see counts and timestamps, never your titles, links or notes.

Your Google data is used only to fill your own library and for what you ask the app to do with it. It isn’t sold, used for advertising, or used to train AI models, and it isn’t shared, with six exceptions, all only while AI is switched on for you in the app: when you press Suggest with AI or Key points on a YouTube video or a Chrome bookmark, its title and link (for a video also its channel and a short part of its description) and your own note go to OpenRouter, which passes them to Anthropic’s Claude to make that suggestion; and where your account has search by meaning, its title (for a video also its channel and a short part of its description) and your own note go to OpenRouter once, which passes them to OpenAI’s embedding model so the app can find it by meaning, and again only when they change; and when Suggest with AI chooses a folder, or you press Ask in the search box, the names of your folders (which may come from your Chrome bookmarks) go to OpenRouter, which passes them to Anthropic’s Claude to choose a folder or filters; and when you press Sort into folders, for each item it sorts its title (for a video also its channel and a short part of its description), your own note and the folder it is in now go, with the names of your folders, to OpenRouter, which passes them to Anthropic’s Claude to suggest a folder for each; and when you press Group them to group your unfiled items, a few titles from each group (which may be YouTube videos or Chrome bookmarks) and your folder names go to OpenRouter, which passes them to Anthropic’s Claude to suggest folders; and where your account has Rediscover, once a week the titles of a few of your videos from each topic go to OpenRouter, which passes them to Anthropic’s Claude to name the topics. See “AI suggestions in the app” below. Apart from that, other people see a YouTube video or a Chrome bookmark only when you share it yourself, in a shared playlist or folder, by sending it or on a public page, and then only its title, link, thumbnail and length (see “Sharing with other people” above).

KlipVault’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect either service at any time in the app’s Settings: the stored access is deleted and Google is asked to revoke it, while what you already imported stays until you remove it. You can also remove KlipVault’s access in your Google Account. Deleting your KlipVault account (Profile → Delete account) disconnects both first, so Google is asked to revoke the access, then removes everything, every imported item included.

AI suggestions in the app

Where your account has them, AI suggestions run only when you press Suggest with AI, or save something while Suggest on save is turned on. Then that item's title, caption, channel, your note and its link go to OpenRouter, which passes them to Anthropic's Claude, with the names of your tags and folders so it can reuse them. Never the video or the picture. Claude runs on Anthropic's own servers or, when those are unavailable, with another provider that hosts Claude. For search by meaning, each item's title, channel, part of its caption and your note go to OpenRouter once, which passes them to OpenAI's embedding model, and again only when they change. So do the words you type into search. Nothing from a folder you keep AI out of, not even its name. For key points on a link, and Suggest with AI on a link with nothing saved, the app reads the page itself, and its text goes to OpenRouter the same way. When you press Ask in the search box, your words and the names of that section's folders, tags and websites go to OpenRouter, which passes them to Claude, so it can choose filters. When you press Group them, a few titles (or websites) from each group of your unfiled items and the names of your folders go to Claude the same way, to suggest a folder for each group. When you press Sort into folders, each item it looks at in that section or folder (its title, caption, channel and your note, with the folder it is in now) and the names of your folders go to Claude the same way, a batch at a time while you do something else, to suggest where each one belongs. Where your account has Rediscover, once a week the titles of a few videos from each topic go to Claude the same way, to name the topics. OpenRouter is told to pass it only to providers that don't collect it for their own use, such as training. Without search by meaning, Rediscover or a sort you started, nothing is sent while you browse, and you can remove every AI suggestion in the app's Settings.

Feedback and screenshots

When you use Send feedback in the app, it keeps your message, whether it’s an issue or an idea, and a little context so the problem can be found: the kind of page you were on and the kind of thing you last pressed there (never what was on it), your screen size, theme, language and browser. With an issue it also sends the app’s last few errors: only their type, the kind of page and where in KlipVault’s own code, never their text.

A screenshot is optional, and you see it before you send. One the app takes shows the page as you saw it, posters included; you can remove it, or upload a picture instead. Screenshots are stored privately, seen only by the KlipVault team, and deleted 90 days after the report is closed. You can delete a report, and its screenshot, yourself at any time.

Emails

KlipVault emails you only for your account: your sign-in links, an invite when there’s a place for you, a note when an issue you reported is fixed or an idea you sent has shipped, and, if you turn it on, a weekly Rediscover email with a few of your own videos. They are sent through KlipVault’s own mailbox at Hostinger. There is no newsletter and no marketing email.

What the KlipVault team can see

To run the service, KlipVault’s administrators see your email address, display name, when you joined and last signed in, your plan, and how many items, folders and playlists you have — never your titles, links or notes. They also read the feedback you send. Their actions are recorded in a log, which names the account they acted on.

Who handles your data for us

These services process data on KlipVault’s behalf, only to provide what this policy describes:

  • Vercel: hosts the website and the app (the app’s servers run in Frankfurt, Germany).
  • Supabase: the database and file storage for your account and library (Frankfurt, Germany).
  • Hostinger: sends KlipVault’s emails.
  • OpenRouter, with Anthropic and OpenAI: the AI features, only where they are switched on for you (United States).
  • Google: YouTube and Chrome bookmarks, only if you connect them.
  • Meta: Send to KlipVault, only if you link a chat; and Facebook and Instagram, when you play their videos.
  • TikTok: its player, when you play a TikTok video.
  • X: its post, when you press Show the real post on a saved X post.

Some of these services are outside the European Union. Where your data goes there, it is protected by the safeguards the law requires, such as the European Commission’s standard contractual clauses.

How long it’s kept

  • Your account and library: until you delete them. Deleting your account removes everything in it.
  • Your waitlist entry, and the record of an invite: until you ask for removal or delete your account, even after you join.
  • Feedback: until you delete it or your account; screenshots 90 days after the report is closed.
  • Notifications in the app’s bell: once read, 90 days.
  • Codes for linking a chat: 15 minutes. Hosting logs: a short time, to keep the service running.
  • The counts that limit sign-in links and saving: a day.

Your choices and rights

In the app you can export your library at any time (JSON or CSV), edit or delete anything in it, switch AI off, disconnect YouTube or Chrome bookmarks, unlink a chat, and delete your account (Profile → Delete account).

KlipVault uses your data to provide the service you signed up for, with your consent where you connect an account or turn a feature on, and in its legitimate interest in keeping the service secure. You can ask for a copy of your data, to correct it, to delete it, to restrict or object to its use, or to take it with you, and you can withdraw a consent at any time. You can also complain to a data protection authority, for example the one where you live.

Changes

When KlipVault changes what it collects or how, this page changes first, and the date at the top says when.