Privacy Policy

1. Who is responsible

Velab Developer Tools ("we", "us") is the developer of the software. Payments are processed by Creem (Merchant of Record); see section 6. If you are in the European Economic Area, United Kingdom, or Switzerland, our legal basis for the little processing we do is listed in section 8.

2. What our browser extensions never do

TokenPeep and TabToNotion are built so that certain kinds of data collection are physically impossible, not merely promised off:

• No background access to pages. Neither extension requests broad <all_urls> host permissions. Both rely on activeTab + scripting: they can inspect or clip a page solely in the moment after you click the extension icon, in that tab. They cannot read any page before you invoke them, cannot read other tabs, and never monitor your browsing history.
• No telemetry, no analytics. No usage statistics, no crash reporters with payload, no fingerprinting, no ad SDKs. The extensions make no network requests at all, except the two cases in section 4.
• No accounts. We have no user database. There is nothing to breach.
• No selling or sharing of data. We have no data business. There is nothing to sell.

TokenPeep requests activeTab, scripting, and storage, with zero host permissions in its manifest (license checks use standard HTTPS CORS calls to tools.yufo-ai.com). TabToNotion additionally uses sidePanel and host access limited to api.notion.com and tools.yufo-ai.com. You can verify every claim in this section from the permission warnings Chrome shows before installation.

3. Data stored on your device

Settings, free-tier usage counters, license state (product, key, instance id, tier, timestamps), and — for TabToNotion — your Notion Integration token and clip history, are stored in the extension's local storage (chrome.storage.local) or, for SchemaPulse, in your browser's local storage inside the Framer editor. This data stays on the device. Uninstalling the extension (or clearing plugin storage) deletes it permanently. We cannot read it, back it up, or recover it.

4. The only network calls we make

• License activation and validation (all products). When you enter a license key, and at most once per day afterwards, the product sends: the product id, your license key, a random instance identifier (e.g. chrome-9f2a1c8b, generated on your device; for SchemaPulse, the Framer project id), and standard request metadata (IP address, user agent) that any HTTP server sees. These requests go to our license gateway on Cloudflare. The gateway is stateless: it proxies the check to Creem, keeps no database, and writes no request logs. Your IP may be transiently held in memory for per-minute rate limiting and is never persisted or forwarded.
• TabToNotion → Notion. When you clip a page, TabToNotion calls api.notion.com directly from your browser, authenticated with your Integration token. That traffic goes from your device to Notion; our servers are not involved, and we never see your token, your clips, or the page content.

TokenPeep makes no other network requests. SchemaPulse runs entirely inside the Framer editor sandbox on your machine.

5. This website

This site is static: our pages set no cookies and load no ad SDKs or external fonts. Because the domain is served through Cloudflare's edge network, Cloudflare processes standard technical request logs (IP address, requested URL, timestamp) for security and abuse prevention and may automatically inject its own cookie-free edge Web Analytics beacon (cloudflareinsights.com), governed by Cloudflare rather than us.

6. Payments — Creem, Merchant of Record

Checkout, taxes, invoices, and refunds are handled by Creem. When you buy, Creem collects and processes the data needed for payment (name, email, billing address, payment instrument, VAT details) as an independent controller under its own privacy policy. We receive from Creem only the minimum needed to honor your license: your license key's status, and your email address in order details when you contact support about an order. We do not receive your card number or financial data.

7. Emails you send us

If you email support, we keep your message and email address for as long as needed to resolve your request and for reasonable record-keeping, and use them only to reply. We do not add you to any mailing list.

8. Your rights (GDPR / UK GDPR / CCPA)

Depending on your jurisdiction you may have rights to access, correct, delete, or export your personal data, to object to or restrict processing, and to lodge a complaint with a supervisory authority. Because we operate no user accounts and keep almost no personal data (see sections 4–7), most requests are satisfied by uninstalling the product — the remaining data we could hold about you is a support email or a license status record, which you can ask us to delete at any time via the support address below. We do not "sell" or "share" personal information as those terms are defined by the CCPA/CPRA, and we do not process data for targeted advertising. Legal bases: performance of a contract (license validation, order support) and legitimate interest in preventing license abuse (rate limiting).

9. Children

Our products are developer tools and are not directed at children under 16, and we do not knowingly collect data from them.

10. Changes to this policy

If we change this policy we will update the date above and, for material changes, announce them in the product changelog. The changelog for extensions is public on their Chrome Web Store listings.

11. Contact

Privacy questions or data requests: email support. We respond within one business day.