Privacy Policy

Who we are

Boilerpod is run by Akora Cloud Inc. (business number 774479547). Questions about this policy or your data: support@boilerpod.com.

What we collect, and why

• Your account. Your email address, and the name you give us if you give one. Your password is never stored, only a salted scrypt hash of it. If you sign in with Google, Microsoft or Apple, that provider tells us its own id for your account, your email address, whether it has verified that address, and your name. We record which version of the Terms of Service and this policy you agreed to, and when. We keep your plan, your trial's end date, and your subscription's status.
• Your library. Everything you put in it: the addresses you save with their titles, descriptions, site icons and cover pictures; the text and pictures of the pages, read by our server, and the pages the extension sends; the files you upload; your notes, highlights, tags, boards, rules and saved views; how far you have read; your conversations with the assistant and the summaries it writes; and the audio made when you have an item read aloud. This is what the service is, and we use it to provide it to you.
• Signed-in devices. For each browser signed in to your account, its browser description (user agent) and when it was last used; for each extension or API key, its name and when it was last used. Settings lists them, so you can see where you are signed in and sign a device out.
• The activity log. A record of what was done to your account — a sign-in, a password or email change, a key issued or revoked, a plan change — with the IP address and browser description of the request that did it. You can read it in Settings → Security.
• When you were last here. When you last signed in, and when each signed-in browser and each key was last used.
• What the AI features cost. One line for each request our AI features make for you: which feature, which model, the item it was about, how much text went in and came out, and what it cost — so the monthly allowance can be kept. Settings shows your total.
• Limits. To slow down abuse, requests are counted in short windows: when you are signed in, against your account; when you are not, against your IP address. Signing in and asking for a sign-in link are also counted against the email address typed, whether or not an account has it. A count is deleted a day after its window began.
• What you write to us. A support message is stored with your email address and emailed to the Boilerpod team. A feature request or reply on the feedback board is seen by other Boilerpod users, under the name on your account (or “A Boilerpod user” when it has none) — never your email address.
• Mail you send to your Boilerpod address. Bookmarks and Reader accounts have an address that saves the links in mail sent to it; on Reader, newsletters delivered to it as well. We keep the links and issues that mail brings.

What we do not collect. The app and the extension contain no analytics, no advertising and no third-party trackers. The app's fonts are served from our own server, not from a font service.

We collect and use this information with your consent, given when you create your account and when you choose to use a feature, and only for the purposes above: to provide the service you asked for (your account, your library and the features you use), to keep it secure (the activity log, signed-in devices and limits), and to bill you if you pay for a plan. You can withdraw your consent for a feature by switching it off or no longer using it, and for everything by deleting your account; we then keep only what this policy says is kept, for as long as it says.

The browser extension

The extension sends nothing until you connect it to your account, and then it sends your Boilerpod account only what follows.

• When you connect it: This browser's name (Chrome, Edge, Firefox or Safari), so the key it is given carries that name in Boilerpod's settings, and the one-time codes that turn your approval in the Boilerpod tab into that key.
• When you open its popup: Opening it saves the page you are on to your Inbox. Whether it is saved already is decided in this browser, from its copy of your saved addresses; only if the copy says so does its address go, to ask where it is saved, and then nothing new is saved and what it holds is asked for. If not, its address and title go, and — when the page reads as an Article — the page as your browser is showing it, including one you are signed in to, from which Boilerpod keeps the readable article; any other page is saved as a Link, with only what the page says about itself: its title, description, picture and icon. When that article is one page of a longer one, the extension then reads the article's other pages itself, in this tab, from the site you are on, with your own sign-in, as your browser would load them — asking only the addresses Boilerpod names as the article's next pages, and only on that site — and sends them the same way. It also asks your library for your boards and your plan, and for the page's highlights, to draw them on it, and for the page's picture once Boilerpod has kept one, to draw beside its title: only a picture Boilerpod itself holds, never one from another site. The tabs list and the page card also draw each tab's own icon, which your browser loads from the address the tab's site names for it — which may be another host, or a picture written into the page — and which Boilerpod never sees. On a tab that is a picture of its own (a blob: or data: address) the popup keeps the picture instead: the page draws it and its pixels go as an upload, counted against your monthly upload allowance, with the page's site where it has one. What you change in the popup is sent as you change it: the title, the board, the tags, the note, and how the page is kept — Article and Full page send the page again, Link sends only what it says about itself and Boilerpod drops what it kept of the page — and Remove moves it to Trash. When the popup closes it tells Boilerpod so, and your Inbox's rules run on the page then. Where the browser does not let the extension read the page — the browser's extension store, a PDF — Boilerpod's server fetches the address instead.
• While the side panel is open: Nothing about the pages you switch to or load: whether one is saved is decided in this browser, from its copy of your saved addresses. The address of the page in front of you goes only when you press Show where, to ask where it is saved, or when you save it; and the words you type in its search box, and a request for your newest saves. Once Show where has found the page, it also asks for that item, and it asks your library for the pictures of the items it lists and of that item, to draw beside them: only pictures Boilerpod itself holds, never one from another site.
• When you save a page with Save to Inbox in the side panel, or Save tab to Boilerpod on a tab's own menu: Its address and title, and, as the popup sends them: when the page reads as an Article, the page as your browser is showing it, including one you are signed in to, from which Boilerpod keeps the readable article, and — when it is one page of a longer article — the article's other pages, read in that tab from the site you are on, with your own sign-in, and sent the same way; any other page as a Link, with only what the page says about itself — its title, description, picture and icon. A page too big to send goes as a Link. Where the browser does not let the extension read the page — the browser's extension store, a PDF, and often from the side panel — Boilerpod's server fetches the address instead. A tab that is a picture of its own (a blob: or data: address) is kept as the picture, as the right-click menu keeps one: its pixels go as an upload, counted against your monthly upload allowance.
• When you save a thread on X (Reader), from a page on x.com or twitter.com that you are signed in to: In place of the page, the thread as that page shows it: the name and handle of its author, and for each of their posts in the thread its words, the time it shows and the addresses of its pictures. Boilerpod keeps it as an Article. Nothing is sent about the other posts on the page, such as replies from other people, and the extension never contacts X itself. On a post on X it first asks your library for your plan, since threads are part of Reader; for any other plan, and where it finds no thread, the page is saved as any page is.
• When you save open tabs: The address and title of each tab you leave ticked, and the board you chose or the name of the new one. This needs tab access, which your browser describes as reading your browsing history; it is not asked for when you install, only when you first save open tabs or switch it on in settings, and you can take it back at any time. While you allow it, the extension also reads the address of the tab in front of you so the toolbar button and the side panel can show whether it is saved on every page, not only after you click it; that address is checked in this browser, against its copy of your saved addresses, and is not sent.
• When you take a screenshot — with the Screenshot buttons in the popup, or Screenshot to Boilerpod or Full-page screenshot to Boilerpod on the right-click menu: A picture of the part of the page you can see, of the area you drew a box around, or of the whole page from top to bottom, as your browser is showing it — a page you are signed in to included. For the whole page the extension scrolls it for you and sends what it photographed once it has finished; a very long page is sent as several pictures, kept as one item. It is kept in your library as a file of its own, counted against your monthly upload allowance, with the page's title and address; from the popup it goes to the board you chose, from the right-click menu to your Inbox. Nothing is sent while you are drawing the box or while the page is being scrolled.
• When you choose Save link, Save picture or Save selection on the right-click menu: For a link, its address and its words where the browser gives them, or else the text you have selected; for a picture, its address — or, for one built into the page (a blob: or data: address), the picture itself, drawn by the page and sent as an upload counted against your monthly upload allowance, with the page's site where it has one, kept as a still picture; for selected text, the page's address and title, and the selection as a highlight with a few words either side of it. The page itself is not sent: Boilerpod's server fetches the address.
• When you pick a colour for text you selected, on a page where the extension is showing your highlights: The passage with a few words either side of it, its colour, and the page's address. A page that is not saved yet is saved to your Inbox first, with its address and title, and Boilerpod's server fetches the page. Recolouring or removing a highlight sends which one, and the colour.
• With highlights drawn as pages load (off until you switch it on, for every site or one site at a time): When a page that is already in your library loads, its address is sent, with a request for its highlights. Whether it is in your library is decided in this browser, from its copy of your saved addresses, so nothing is sent for this about a page you have not saved.
• When you press Import this browser's bookmarks: Your bookmarks, once, as the browser holds them — their addresses, titles and folders, when each was added and, where the browser records it, when it was last opened, and the ids and positions the browser keeps for them — and this browser's name. They are read once, on that press, and the permission to read them is given back: your browser's bookmarks are not changed, and nothing reads them again unless you press Import again. While that import waits for you in Boilerpod, the settings page asks Boilerpod whether it has started.
• Now and then: A request for the list of your saved addresses — when the browser starts, when the popup or side panel opens, and from time to time as you switch tabs. It is kept in this browser, so the toolbar button can show whether a page is saved without sending the page's address. And, when the popup, the side panel or the settings page opens, a request for the language your account speaks, so the extension speaks it too.

In your browser, the extension keeps its key to your account, your server's address, and the email address and name of the account it is connected to; your settings — the board you last saved to, whether highlights are drawn as pages load, that you have seen what it sends, and that you have seen its notice about drawing highlights as pages load; its copy of your saved addresses; and, while a connection by pasted code is unfinished — until the code is pasted, Connect is pressed again or the browser restarts — the secret that code will be checked against. Until the browser closes it also keeps what Boilerpod said about where the pages it looked up in the minute before it last asked Boilerpod about a page are saved, the address of the page whose highlights were last drawn as it loaded in each tab, and the address of the last right-click save, page or screenshot that did not go through, with the reason. Each browser has its own key, which you can revoke in Settings.

Who else receives your data

These companies process data for us, each only for the part of the service named.

• netcup hosts the server that runs Boilerpod and its database, in Vienna, Austria.
• Cloudflare carries every request to and from app.boilerpod.com, stores your uploaded files and the audio of items read aloud (Cloudflare R2, in a bucket we asked Cloudflare to place in Western Europe), and sends the email Boilerpod sends you.
• OpenRouter routes the requests of our AI features to the models that answer them:
  • The assistant (summaries, questions about an item or your library, quick lookups; Reader, only when you ask): the text of the item or passages from your library, and your question. These requests go to OpenAI's model hosted by Microsoft Azure, and — for questions and lookups when that fails — to DeepSeek's model; every one tells OpenRouter to use only hosts that keep no copy of it and do not collect it. An item on a PIN-locked board is sent only after you have unlocked it, and a question about your library never draws on Trash or on a locked board.
  • Smart Inbox (Bookmarks and Reader, on unless you switch it off in Settings; it files and tags new links): a link's address, title, description, site name and keywords, to TypeSafe's Jev model. This includes a page saved with the extension: only those details are sent, never the page itself. Never sent: notes, uploaded files, anything on a PIN-locked board, or the saved text of any page.
  • Reading aloud (only when you ask): the words being read, with no account or item id, to the Kokoro voice model.
• Stripe, if you pay for a plan: your email address, name and account number. You enter your card details on Stripe's page, not ours; we never receive them.
• Google, Microsoft and Apple, only if you choose to sign in with one: you are sent to them to sign in, and they send us what is listed under Your account.
• The sites you save, and the feeds you follow. Our server fetches the pages you save, reads the feeds you follow, later checks that saved links still work, and — when the extension sends a page as a copy (Full page, or a page that already has a kept copy) — fetches that copy's pictures and stores them with it. It does this from our server's address, naming itself as Boilerpod, so your IP address is not sent. For YouTube and Reddit links it asks YouTube's and Reddit's own services for the title. Pictures we store — those of a copy the extension sent, and any you upload — are served to you by us. Everything else shown with a saved page — its site icon, its cover picture, the pictures inside its article, and the pictures of a copy kept from the app with Keep a permanent copy, which keeps the page's text and layout but not its pictures — is loaded by your browser from the site that hosts it, so that site sees your IP address when it is shown.
• [PO: the inbound-mail provider that receives mail sent to Boilerpod addresses]

We do not sell your personal information, and we do not use it, or let anyone else use it, for advertising. We disclose it to a government, a court or the police only when the law requires us to — a warrant, a court order or another legal obligation — and then only what is required.

Where your data is kept

Your account and library are in a database on our server in Vienna, Austria; your files are in Cloudflare R2. The database is copied every night; the copies are kept for 14 days on that server and for 90 days on a second machine, in Edmonton, Canada, operated by Akora Cloud Inc..

Boilerpod is run from Canada, but your data is stored and processed outside it: our server is in Austria, your files are in Cloudflare R2 in Western Europe, and Cloudflare, OpenRouter and the model hosts it routes to, Stripe, and Google, Microsoft or Apple when you sign in with them, may process it in other countries, including the United States. While it is there it is subject to that country's laws, and may be accessed by its courts and authorities. We use these companies only for the parts of the service named above, and remain responsible for your data when they process it for us.

Cookies and storage in your browser

• boilerpod_session keeps you signed in: 30 days, or until the browser closes if you untick Keep me signed in.
• boilerpod_tz holds your time zone, so dates are shown in yours: one year.
• boilerpod_sso exists for up to ten minutes while you sign in with Google, Microsoft or Apple.

The app also keeps in your browser's storage your display choices (layouts, sort orders, panel sizes), changes you made while offline until they can be sent, and copies of pages you have opened so they work offline; those copies are cleared when you sign out. There are no other cookies, and none from anyone else.

Getting your data out, and deleting it

You can download your whole library at any time from Import & export — as a bookmarks file (HTML), a full backup (JSON), a spreadsheet (CSV), or everything with your files (ZIP). Items on PIN-locked boards are included when you have unlocked them.

Deleting your account (Settings → Account) removes at once your account and everything in it, and cancels any subscription. Afterwards:

• your uploaded files are removed from storage by the cleanup the server runs every ten minutes;
• the activity log keeps that its events happened, but no longer says whose they were, and loses your IP address, browser description and email address;
• feature requests and replies you posted stay on the feedback board, no longer under your name;
• support messages you sent are kept in Boilerpod, with the email address they came from, until we no longer need them to answer you or to keep a record of what we were asked; write to us and we will delete them from Boilerpod sooner. That covers only what Boilerpod stores: the copy of each message emailed to our team when you sent it is not deleted with them;
• the nightly database copies hold your data until they age out, after at most 90 days;
• Stripe keeps its own records of any payments.

Our server's logs are deleted after 30 days.

You have the right to see the personal information we hold about you, to have it corrected, and to withdraw your consent to our using it. Most of this you can do yourself: Settings shows your account, devices, keys and activity log; you can edit anything in your library, and export or delete it. For anything else, write to support@boilerpod.com from the email address on your account; we answer within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Alberta, to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca).

Children

Boilerpod is for people 18 or older. We do not knowingly collect information from anyone younger; if we learn that an account belongs to someone under 18, we delete it.

Chrome Web Store

The use of information the Boilerpod extension receives from your browser adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. That information is what The browser extension above lists: the pages you save, their addresses and titles, your selections and highlights, screenshots, the bookmarks you choose to import, and the addresses it looks up to show whether a page is saved.

• Use. We use it only to provide and improve the extension's single purpose, saving what you choose to your Boilerpod library and showing it back to you, and its user-facing features described on this page. We do not use it for anything else.
• Transfer. We transfer it to others only where that is necessary to provide or improve those features (the companies named under Who else receives your data, each for the part of the service named there), to comply with applicable law, or for security purposes, such as investigating abuse. We do not sell it.
• Advertising. We never use or transfer it to serve personalized, re-targeted or interest-based advertisements.
• Human access. We do not let people read it, except where you give your consent to read specific data (for example, a support message you send us), where it is necessary for security purposes, or to comply with applicable law.

Changes to this policy

Each version of this policy and of the Terms of Service has its own version date, and your account records the version you agreed to.

When we change this policy, we publish the new version on this page with its version date and the date it takes effect, and we email the address on your account about every new version at least 30 days before it takes effect. The new version applies from that date.