Privacy Policy

Signing in

Piwora only supports signing in with Google. There is no password-based sign-up.

When you sign in, Google gives us:

• your email address
• your name, as set on your Google account
• your profile picture

We store these on your Piwora profile. We never receive or store your Google password. Authentication is handled by Supabase Auth, which issues the session that keeps you signed in.

Your profile

What other people can see

These parts of your profile are visible to anyone, including people who are not signed in:

• username
• name
• profile picture
• bio
• website and social links
• role
• your interests
• who you follow, and who follows you

What stays private

These are visible only to you, and to Piwora staff for support and administration:

• your email address
• phone number and location, if you add them

You can edit or clear most profile fields at any time in your profile settings.

Collections and links

A collection is either public or private.

• Public collections — the collection, its name, its links and its tags are visible to anyone, signed in or not.
• Private collections — the collection name, its tags and any notes you attach are visible only to you.

Please read this part carefully. The links themselves are not private, even when they sit in a private collection. Any link you save may appear in search results in Piwora’s Curate feature, which is available to anyone who uses it, including visitors who are not signed in. Saved links are also not anonymous: other signed-in Piwora users may be able to see which account saved a given link.

What Curate does not expose: the names of your private collections, and any notes you write.

If you do not want a page to be discoverable by other people, do not save it to Piwora.

Likes and follows

Likes on collections, and your follower and following lists, are readable by anyone. Liking a public collection is a public action.

Link clicks

When a link is opened from Piwora we record the link, a short label for where it was clicked from, the time, and your user ID if you are signed in. Clicks by signed-out visitors are recorded without any user ID. We do not record your IP address or your browser’s user agent with these events.

Collection views

When someone opens a public collection we record the collection, the time, and the viewer’s user ID if they are signed in, so each person is counted at most once per collection per day. For signed-out visitors we instead derive a one-way code from their IP address and browser’s user agent that changes every day; we do not store the IP address or user agent themselves, and we set nothing on the visitor’s device. Views of your own collections are not counted.

Monthly activity

When you use Piwora while signed in, we record which calendar month you were active in: your user ID and the month, at most once per month. We use this only to understand how many people keep using Piwora over time, and we record nothing else with it.

Feature usage

To see which features work, we record a few product events, each with the time and your user ID if you are signed in:

• Create with AI — for each reply: its position in the conversation, the content types searched, how many results came back, how long it took, and whether it failed. We do not record what you typed. When you create a collection from it, we record how many items it has and whether it is public.
• Sharing — which share option you chose and the address of the page you shared, within Piwora.
• Search — the search text you settled on, and how many results it returned.
• Browser extension — whether you saved with the extension in a given month (one entry per month).

Notifications

Piwora creates in-app notifications when someone follows you, likes your collection, publishes a collection, or when one of your saved links stops working. A notification records who it is for, who triggered it, the related collection or link, and whether you have read it. Only you can read your own notifications.

Feedback and bug reports

If you send feedback or report a bug, we store your user ID, the type of report, your title and description, and an optional screenshot. Screenshots go to a private storage area that other users cannot read; only Piwora staff can access them. Please avoid including sensitive information in screenshots.

Browser extension

The Piwora browser extension lets you save a link to a collection without leaving the page you are on. This section applies in addition to the rest of this policy.

What the extension collects, and when

The extension collects information only when you act. Clicking the Piwora toolbar button, or choosing “Save to Piwora” from the right-click menu, sends:

• the address of the page you are on, or of the link you right-clicked
• a note, if you write one
• the collection you choose
• your Piwora sign-in session and the email address on your account

Nothing is collected in the background. The extension uses Chrome’s activeTab permission, which gives it access to a tab only at the moment you invoke it. It does not read your browsing history, does not run on pages you have not asked it to act on, and does not track which sites you visit.

Where information is stored

Saved links, notes and collections are stored in Piwora’s backend, hosted by Supabase. Your sign-in session and a cached copy of your collection list are kept in your browser’s extension storage on your own device, so you do not have to sign in every time. Signing out removes them.

What happens to a link after you save it

To build a preview, Piwora’s servers visit the address you saved and read the page’s title, description and preview image. Information from that page is then sent to third-party services that help categorise it and find related links:

• Google Gemini — classifies the page and generates tags and a description
• Tavily — finds similar sites
• YouTube Data API — finds related videos for tools
• Google’s favicon service — receives the page’s domain to supply its icon

This happens for every link you save, including links you save to a private collection.

What other people can see

The Curate disclosure above applies to links saved through the extension in exactly the same way.

Google API Services

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Who we share information with

We use the service providers below. We do not sell your information, and we do not use it for advertising.

• Supabase — stores all of your data: profile, collections, links, notes, notifications and feedback
• Vercel — hosts the website and processes requests
• Google Sign-In — authenticates you
• Google Gemini — receives content read from pages you save, for classification. We use Gemini’s paid service, under which Google states that it does not use prompts or responses to improve its products. Google logs prompts and responses for a limited period to detect and prevent abuse.
• Google’s favicon service — receives the domain of pages you save and view
• YouTube Data API — receives the name of a saved tool, to find related videos
• Tavily — receives a saved link’s name and address, to find similar sites. Tavily’s handling of that data is governed by its own privacy policy. Tavily does not publish a fixed retention period, states that it keeps query data for as long as needed to provide and improve its services, and may use portions of query data to improve its future results.

These providers may process your information outside your own country, including in the United States. For users in the European Economic Area and the United Kingdom, those transfers rely on the providers’ Standard Contractual Clauses and data processing terms.

Cookies and local storage

Piwora uses cookies to keep you signed in. These are set by Supabase Auth and are necessary for the service to work. While you are signed in, we also set one cookie holding the current month, so that your monthly activity (described above) is recorded only once per month.

We also store your light or dark theme preference in your browser’s local storage. It never leaves your device.

We do not use third-party analytics, advertising or tracking, and we do not run error-monitoring or session-recording tools. The usage records described in this policy are kept by Piwora itself, in our own database.

How long we keep information

We keep your profile, collections, links and notes for as long as your account exists. When you ask us to delete your account, we delete that data.

You can delete individual links and collections at any time, and they are removed when you do.

Usage records (collection views and feature usage) are deleted after 13 months. Search text is removed from them sooner, after 90 days. Monthly activity is kept for as long as your account exists. When your account is deleted, your monthly activity is deleted with it, and your user ID is removed from any usage records that remain.

Your rights and choices

• Access and correction — you can view and edit your profile at any time in your profile settings.
• Deleting content — you can delete individual links and whole collections from within Piwora.
• Deleting your account — Piwora does not currently offer self-service account deletion. Email support@piwora.com and we will remove your account and its data. Deletion is carried out manually and we will confirm when it is done.

If you are in the EEA or the UK

Under the GDPR and UK GDPR, we rely on the following lawful bases:

• Performance of a contract — creating and running your account, storing your collections and links, and showing you your own content.
• Legitimate interests — keeping the service secure and preventing abuse, generating link previews and related-link suggestions, and counting link clicks so we can understand what is useful. We balance these against your rights and use the least information needed.
• Consent — where we ask for it directly, for example when you choose to make a collection public. You can withdraw consent at any time by making the collection private again.
• Legal obligation — where we have to keep or disclose information to comply with the law.

You have the right to:

• access the personal information we hold about you
• have inaccurate information corrected
• have your information erased
• restrict how we process your information
• object to processing based on our legitimate interests
• receive your information in a portable, machine-readable format
• withdraw consent, where processing is based on consent

To exercise any of these, email support@piwora.com. You also have the right to complain to your local supervisory authority.

Children

Piwora is not directed at children. You must be at least 13 years old to use it, or 16 if you are in the European Economic Area. We do not knowingly collect information from children below those ages. If you believe a child has given us information, email support@piwora.com and we will delete it.

Changes to this policy

If we make material changes we will update this page and change the date below.

Last updated: 1 October 2026

Contact

Questions about this policy, or about your information: support@piwora.com