Cardit Web Clipper — Privacy Policy

Last updated: 30 July 2026

The Cardit Web Clipper is a Chrome extension that lets a signed-in Cardit user save a web page as a card in their Cardit account. This policy explains exactly what the extension accesses, what it stores, and what it never does.

In one line: the extension reads a page only when you explicitly click Save, sends that page’s public metadata to your own Cardit account, and never tracks your browsing or sells any data.

What the extension accesses

Page metadata — only on your action. When you click Save in Cardit (toolbar, right-click menu, or keyboard shortcut) the extension reads the current page’s title, description, main/candidate images, canonical URL, site name and any text you selected. It does not run in the background or read pages you don’t explicitly save.
Your Cardit sign-in. Sign-in uses Chrome’s secure launchWebAuthFlow against Cardit’s existing web login. The extension receives only a short-lived Cardit access token, kept in in-memory session storage and wiped when the browser closes. No password, no long-lived refresh token, and no API key are ever stored in the extension.
Local preferences & offline drafts. Your last-used folder and any clips you make while offline are stored locally in the browser (chrome.storage.local) so drafts can sync automatically when you’re back online. Drafts contain only the card fields you were saving — never credentials.

What the extension does NOT do

It does not monitor, log, or transmit your browsing history.
It does not read pages automatically or inject persistent scripts.
It does not capture form inputs, passwords, or payment information.
It does not track you across sites or build an advertising profile.
It does not sell or share your data with third parties, and it is not used for any purpose unrelated to saving cards to your Cardit account.

How data is used

The metadata you choose to save is sent over HTTPS to Cardit’s API (www.cardition.com) and stored as a card in your Cardit account, exactly as if you had created it in the Cardit app. It is handled under the same terms as the rest of your Cardit data.

Permissions & why they’re needed

activeTab + scripting — read the current page’s metadata only when you click Save.
storage — keep your short-lived session, last-used folder, and offline drafts.
contextMenus — the right-click “Save … in Cardit” actions.
sidePanel — the Save-in-Cardit interface.
identity — the secure sign-in flow.
alarms — periodically retry syncing offline drafts.
Host access is limited to https://www.cardition.com/* (the Cardit API and sign-in bridge). The extension does not request access to all websites.

Data retention & deletion

The session token is discarded when the browser closes or you sign out. You can clear local preferences and drafts at any time by removing the extension. To delete cards or your account, use the Cardit app or web app (Account & Data settings).

Contact

Questions about this policy or your data: info@cardition.com.