What we do with your things

What is stored

The things you save: the address, the title and text of the page, any note you write, the colour you choose, and when you saved or last opened it. Your email address and a scrambled form of your password.

Everything you save is encrypted before it is written to the database. The key is held by our server, which means a stolen copy of the database is unreadable on its own — but it also means we could read your things if we chose to. We would rather say that than imply otherwise.

Your password is stored so that nobody, including us, can read it back. If you add an AI key, it is encrypted too, and it is never shown to you again once saved.

What is sent elsewhere

When you ask a question, the handful of saved things relevant to it is sent to the AI provider whose key you added — Anthropic, OpenAI or Google — under your own account and their terms. Nothing is sent while you are saving, browsing or searching.

When you save a link, our server fetches that page to read its title and picture. That request goes to the site you saved, as your browser would.

Thumbnails are loaded by your browser directly from the site they came from, so those sites can see that a page of theirs was displayed.

Nothing is sold, and nothing is shared with anyone else.

The browser extension

It stores the address of your Attic and an access token, in the browser, so you do not paste them each time. When you press save, it sends that page’s address, and a note or colour if you added one, to your own account.

It reads the current tab only when you click it, and it talks to no host other than your Attic. The token can be revoked in settings at any time without changing your password.

Who else is involved

The site runs on Vercel and the database is Neon, in Singapore. Both can technically access what they host, under their own terms.

Vercel Web Analytics counts page views. It sets no cookie, identifies nobody, and is served from this domain rather than someone else’s. It records which pages were opened, from which country, and on what kind of device — not who opened them. What you type into search, and which thing you opened, are stripped out of the address before anything is counted. There is no advertising and no other third-party script on any page.

How long things are kept

Until you delete them. Deleting a thing removes it; deleting your account removes everything saved with it. Sign-in sessions expire after thirty days, and failed sign-in attempts are forgotten within the hour.