Your data. Yours.

1. Who runs Poof

Poof is an independent product. Questions or requests related to this policy should go to support@poof.works.

2. What Poof collects

2a. Account information (only if you sign in)

When you create a Poof account or sign in, the extension stores:

• Your email address
• A hashed password (handled by Supabase; Poof never sees the plaintext)
• An authentication session token, kept locally so you stay signed in

You can use the extension without signing in for local-only functionality; sync features require an account.

2b. Content you create in the extension

If you are signed in, the following items sync to your account so they're available on your other devices:

• Snippets — the shortcut and expanded content you define
• Constants — named values you use inside snippets (e.g. {{name}})
• Settings — your Poof preferences (toggles, menu trigger, command names, etc.)
• Sticky notes — text content, color, position, size
• Notes — the notes you create in the Notes panel
• Clip slots — text you save into numbered clipboard slots
• Recent clipboard captures — text you copied from a web page while the extension is running (only when the "Clipboard capture" setting is on; can be turned off or cleared at any time)
• Placeholder history — recent values you've used for snippet placeholders (e.g. recent names / emails you filled in)
• Usage statistics — counts of how often you use each snippet and each Poof tool or helper (per day for the last 90 days, plus lifetime totals), a weekday-and-hour activity grid, and a running total of the typing time Poof has saved you. These are numbers only: they never include the text you typed, the pages you were on, or any URL. They are shown only to you, in the Analytics page.

2c. Device-only state (never leaves your computer)

Some data is kept in chrome.storage.local and is never sent to a server:

• Which floating panels are open and where they are positioned
• Cached copies of your settings for fast startup
• Session flags used by the extension UI

3. What Poof does NOT collect

Poof has broad "runs on all sites" permission because it watches for the shortcut you type in text fields on any page. To be explicit about what that does not involve:

• No browsing history. Poof does not read, log, or transmit the URLs of pages you visit.
• No page content. Poof does not read the text of pages you're viewing. It only looks at the word you are actively typing into an input field so it can replace that word when it matches a shortcut.
• No analytics or telemetry sent to us or anyone else. Poof does not send usage data to the developer or to any third party, and does not record clicks, error reports, or device fingerprints. The usage statistics described in 2b live in your own account and are shown only to you.
• No advertising. Poof does not show ads and does not integrate with any advertising networks.
• No third-party trackers. Poof does not load third-party scripts.

4. How Poof uses your data

Data is used only to provide the features you see in the extension:

• Sign you in and keep your session alive
• Sync your snippets and other content across your devices
• Personalize the UI according to your settings
• Restore your notes and stickies when you reopen the extension

Under GDPR, this processing rests on two legal bases:

• Contract performance (Art. 6(1)(b)) — processing necessary to give you the functionality you signed up for: authentication, cloud sync, account management.
• Legitimate interest (Art. 6(1)(f)) — keeping the extension secure and operational (rate limiting, abuse prevention, error recovery). You can object to this at any time by emailing support.

Poof does not use your data for anything beyond the above. It is never sold, rented, or shared with third parties for marketing.

5. Where Poof stores your data

Account data and synced content is stored by our single subprocessor:

• Supabase, Inc. — managed PostgreSQL + authentication, with row-level security enabled so the database only returns rows belonging to the signed-in user. See Supabase's privacy policy.

No other third party receives your data. All network traffic between the extension and Supabase uses HTTPS. If legally compelled (e.g. a valid subpoena), we may disclose relevant information to authorities.

5a. International data transfers

Supabase operates data centres in multiple regions. Depending on where your account was provisioned, your data may be processed in the European Union, United States, or other regions covered by Supabase's infrastructure. For transfers outside the EEA / UK, Supabase relies on the European Commission's Standard Contractual Clauses (SCCs) and equivalent safeguards. Contact us if you need the specific region your data lives in.

6. Browser permissions Poof uses

Chrome requires extensions to declare their permissions. Here's what Poof asks for and why each is needed:

• Read and change data on websites you visit (<all_urls>) — needed because Poof expands shortcuts inside input fields on any site. Without this, Poof wouldn't work on the sites where you actually type. Poof only reads the word you're actively typing; it does not read page content or URLs.
• Storage — used to keep your snippets, constants, settings, and other content on your device and synced to your account.
• Clipboard (read / write) — used only when you explicitly invoke clipboard commands (e.g. saving into a clip slot or copying a snippet). Poof does not read the clipboard in the background.
• Active tab — used to show the extension popup in the context of the current tab.
• Notifications — used only by the timer feature so it can alert you when finished. Can be disabled in the extension settings.

7. Cookies and similar technologies

Poof sets no advertising, analytics, or fingerprinting cookies. The extension uses chrome.storage and localStorage only to store the items listed in §2.

8. Data retention and deletion

Your data is retained for as long as your Poof account exists.

• Signing out does not delete your data — it just removes the session from the current device.
• Delete your account yourself from the extension: Options → Settings → Reset → Delete my account. The action permanently removes your account row and every piece of data tied to it (snippets, constants, settings, sticky notes, notes, clip slots, placeholder history) through database-level cascade. It is immediate and irreversible.
• If you can't access the extension for any reason, email support@poof.works with the email address you signed up with. We'll permanently erase it within 30 days.
• Local-only data (positions, cached settings) can be cleared at any time by removing the extension or clearing Chrome site data for it.
• Encrypted backups may retain deleted data for up to 60 days beyond deletion, after which they are rotated out.

9. Security and data breach notification

Passwords are hashed server-side by Supabase. All communication with the backend uses HTTPS. Row-level security restricts database access so one user can never read another user's data.

If we become aware of a security incident affecting personal data, we will notify affected users by email within 72 hours of discovery, in line with GDPR Article 33 / 34.

No system is perfectly secure. If you believe your account may be compromised, change your password and email support@poof.works.

10. Your rights

You have the right to:

• Access — everything you put into Poof is visible in the extension itself.
• Export (portability) — snippets can be exported as CSV from the options page; other data can be provided on request in a machine-readable format.
• Correct (rectification) — edit or delete any item directly inside the extension.
• Delete (erasure) — see §8.
• Restrict or object to processing — email us and we'll pause or stop processing as required by law.
• Withdraw consent — uninstall the extension at any time; signed-in users can additionally delete their account.

EU / EEA / UK residents have these rights under GDPR / UK GDPR. California residents have equivalent rights under the CCPA (see §11). To exercise any of them, email support@poof.works. We respond within 30 days.

10a. Right to complain to a supervisory authority

If you live in the EU / EEA / UK and believe Poof has handled your personal data in a way that breaches GDPR, you can lodge a complaint with your national data protection authority. A directory of EU DPAs is maintained by the European Data Protection Board: edpb.europa.eu/members. UK residents can contact the ICO at ico.org.uk.

11. California residents (CCPA)

If you are a California resident, you have the right under the CCPA to:

• Know what personal information we collect about you (see §2).
• Request deletion of your personal information (see §8).
• Opt out of the sale or sharing of your personal information.
• Not be discriminated against for exercising any of these rights.

We do not sell or share personal information. Poof has no advertising relationships and no revenue model that depends on selling data.

12. Do Not Track and Global Privacy Control

Poof does not track users across websites or services, and it doesn't advertise to them — so there is nothing to opt out of. Poof honors both Do Not Track (DNT) and Global Privacy Control (GPC) signals in the sense that its behavior never changes based on them (it doesn't profile or track you either way).

13. Automated decision-making and profiling

Poof does not perform automated decision-making, profiling, or scoring of users. No decisions that produce legal or similarly significant effects on you are made by the extension.

14. Children

Poof is not directed to children under 13 and does not knowingly collect data from them. If you believe we have inadvertently collected data from a child, please email us so we can delete it.

15. Changes to this policy

If this policy changes in a way that affects you, the "Last updated" date above will change and — for material changes — you'll be informed via the extension options page the next time you open it.

16. Contact

Questions, bug reports, feature requests, or anything else — we read every message.

• General support & feedback: support@poof.works
• Privacy / data requests (access, deletion, correction, GDPR / CCPA rights): the same address — support@poof.works — subject line Privacy request speeds things up.
• Security disclosures: support@poof.works with subject line Security. Please do not file public issues for suspected vulnerabilities.

Response time: we aim to reply within 2 business days. Privacy requests are answered within 30 days as required by GDPR / CCPA; most are handled much sooner.

What to include in a bug report to save a round-trip:

• What you were trying to do
• What happened vs. what you expected
• Your browser + OS (e.g. Chrome 131 on macOS 14)
• The Poof version (shown in Settings → About, or chrome://extensions)
• Any console errors if you're comfortable grabbing them

Office hours: Poof is run by a small independent team in Europe (UTC+2 / UTC+3). Replies tend to arrive during European working hours.