Privacy policy
Last updated: 7 November 2026
This policy covers Grdn at grdn.page and the Grdn extension for Chrome (“the extension”). The extension shows your Grdn account in Chrome’s side panel.
What Grdn keeps for your account
Your email address and username. You sign in with a code sent to your email, or with Google.
What you put in Grdn: your gardens and the pages, notes and streams in them, and your chats with the AI tools.
For each page you keep, the text and a copy of the page, when Grdn can fetch them.
Your settings. If you add your own OpenRouter key, Grdn stores it encrypted.
A small record of your use of Grdn (for example, when a session starts), tied to your account. Grdn uses no third-party analytics.
Gardens are private unless you make them public. Anyone, signed in or not, can read a public garden and what is in it.
Grdn sets only the cookies needed to sign you in: your sign-in session, and a short-lived one while you sign in with Google. It sets no advertising or tracking cookies.
What the extension does
It opens grdn.page in Chrome’s side panel, beside the page in your current tab.
It puts a small Grdn strip at the edge of web pages. The strip’s buttons open a panel (such as Keep or Stream), or one of your AI chats, in the side panel.
It works only with a Grdn account. If you are signed out, the panel asks you to sign in to grdn.page.
What data the extension handles, and when
The address and title of the current tab
While the side panel is open, the extension gives the active tab’s address (URL) and title to grdn.page in the panel, so the panel can show Stream, Context, the AI tools and Keep for that page. When you change tabs or go to a new page, it gives the new address and title.
While the side panel is closed, the extension does not send page addresses or titles to grdn.page.
Keep on the strip only opens the side panel on its Keep view. It saves nothing by itself. When you then tap Keep in the panel, grdn.page saves the page’s address and title in your garden. In the panel you can move what you kept to another garden, or undo it.
The extension does not run in Incognito windows.
Page content
The extension does not read the text, forms or any other content of the pages you visit. The strip reads nothing from the page.
To show Context, and when the AI tools read the page, grdn.page may fetch the public text of the page from its address. It does this on its own servers, without your cookies for that site. It keeps this text tied to your account, without the page address (it stores only a one-way code made from the address). The text normally expires after 24 hours, and a daily clean-up then deletes it (a failed clean-up can delay this).
For this, grdn.page does not fetch pages on mail, calendar, document and sign-in sites (for example Gmail, Google Calendar, Google Docs and Drive, Outlook, and sites whose address starts with mail., webmail., accounts., login., auth. or sso.), on IP addresses, or on localhost or private network names. For those sites, Stream makes no search and the AI tools see only the site’s name.
It also does not fetch a page whose address has a query part that fails its safety checks (for example, one that looks like it holds a token). Stream and the AI tools can still use that page’s title and its address without the query part.
In the panel, “Don’t use it” stops Stream, Context and the AI tools using the page until you change tabs, go to another page or move to another garden, or until you choose “Use it”.
Your Grdn session
The side panel shows grdn.page itself, so it uses your normal grdn.page sign-in cookie. The extension also asks grdn.page, with that cookie, for the list of your running AI chats, to show them on the strip; that request carries no page address. The extension never reads, copies or stores the cookie.
Data stored in your browser
The extension keeps short-lived state in Chrome’s extension storage: which panel is open in each window, which garden a grdn.page tab is in, your place in Stream, the list of your AI chats shown on the strip, and the list of panels. Everything except the list of panels is in session storage, which Chrome clears when it closes. The extension syncs nothing to your other devices.
How grdn.page uses the data
To show the panel for the page you are on, to save what you keep, and to answer you in the AI tools.
Stream sends search queries to our web search provider, to find related reading. The queries are made from the page’s title and from short lines about the garden you are in (such as its summary and your Stream rules). Stream does not send the page address. It may also send the title, your garden’s guidance and the results found to our AI model provider, to choose what to show.
The AI tools send your question, the parts of your gardens they use, and the page’s title and address (without its query part) to our AI model provider. They send the page’s text only when the model asks to read the page.
When you keep a page, grdn.page tries to fetch it from its site to save its text and a copy. This can finish later, or fail. This fetch is separate from the one above and does not use its list of excluded sites: you chose to keep the page.
We use these service providers only to run Grdn:
Vercel: hosting, storage for the copies of pages you keep, and a bot check when you sign in.
Neon: the database.
OpenRouter: AI models. Grdn uses your own OpenRouter key if you set one in Settings, and Grdn’s key otherwise.
Exa: web search for Stream.
Resend: sign-in codes and account email.
Google: sign-in, only if you choose to continue with Google.
What we do not do
We do not sell your data.
We do not use or transfer your data for advertising, for credit or lending decisions, or for any purpose not related to the features above.
We do not let people read your data, except with your permission, for security, to follow the law, or when it is combined and anonymous.
The extension runs no remote code: all its code ships in the extension. It does not track you across sites.
This use of data follows the Chrome Web Store User Data Policy, including the Limited Use requirements.
Apps you connect through OAuth
Grdn is adding a way to let AI apps, such as Claude, work in your gardens through OAuth, the standard way for an app to ask for access to your account. It is not switched on yet; this section describes how it will work once it is.
What a connected app can do
A connected app is an AI app, such as Claude or another MCP client, that you let use Grdn’s MCP server as you. The app sends you to Grdn’s consent page at /oauth/consent, where you allow or deny it.
On that page you allow what the app asked for: read, write, or both. If it asked for write, you can untick it. If the app asked for offline access, Grdn grants that too, so the app can stay connected without asking you again.
A connected app can never publish or uproot.
What Grdn stores
The name the app gives itself, which Grdn does not check, its client ID (which can be a web address) and its redirect addresses.
One grant record for each app you connect: the app, its client ID, and the grant’s dates and when it expires. Its id is carried in the app’s tokens, so ending the record ends them all.
Your consent, with the scopes you allowed and when you connected, and the app’s tokens, in the tables of Better Auth, the sign-in library Grdn uses. The tokens are stored as one-way hashes. The reply to each refresh, which contains the new tokens, is also kept, encrypted, so a retried refresh can be answered for a short time. The daily clean-up clears it once that time has passed.
A record of each call the app makes: the tool, the time, the outcome, the units used, and which of your items it acted on. It holds no content the app sent or got back.
An app that no one has allowed is deleted by a daily clean-up after a day. A record that you started connecting an app, but never allowed, is also deleted by the daily clean-up after a day; Settings does not list it.
How long access works
An app’s grant gives it access for 90 days from when you allow it. Allowing it again does not extend this; after 90 days the app must ask you to connect again.
Its refresh tokens work for 30 days each, and each is replaced when it is used.
The grant record and the call log are deleted with your account (see Keeping and deleting below). When a grant expires or you revoke it, the daily clean-up deletes its consent and tokens; the grant record stays until your account is deleted.
The daily clean-up also deletes every token that has expired.
A failed or busy clean-up can delay any of these deletions by a day or more.
Revoking an app
In Settings → Agents, Connected apps lists each app with the name it gave itself, the hosts it redirects to, its scopes, and when it was connected, last used and expires.
Revoke ends the app’s access at once. Grdn then deletes the app’s consent and tokens at once; if this fails, the daily clean-up deletes them later. To use Grdn again, the app must ask you to connect.
Keeping and deleting
What you keep stays in Grdn until you uproot it. Pruning only takes it out of a garden. Uprooting deletes it from Grdn’s database, but the saved copy of the page can stay in file storage.
Page text fetched for Context normally expires after 24 hours, and a daily clean-up then deletes it (a failed clean-up can delay this).
To delete your account and its data, email parijat@getcolex.com from the address on your account. Deleting your account deletes the fetched page text with it. To stop all data handling by the extension, remove it at chrome://extensions.
Changes
We will post changes to this page and update the date above.