Privacy Policy

WebEditor.click app and Chrome extension · last updated 30 September 2026

WebEditor.click passes requests on and does not archive them. A request is created on a page element, goes to your own agent and is not stored permanently. You create no account with us, neither the app nor the extension runs analytics, and nothing from the page you are viewing leaves your device on its own.

Who controls the data

The WebEditor.click app and Chrome extension are published, and the data controlled, by Indigo Studio s.r.o., a company established in the Czech Republic, company ID 14389096. Registered office: Chudenická 1059/30, 102 00 Prague, Czech Republic. Contact: info@indigostudio.cz.

What stays on your device

The app is a browser, and the extension works inside yours. They keep the following locally, and we cannot see any of it:

• the sites you add, their addresses and recently opened pages
• draft requests and lists, until you send them
• attachments and screen crops you attach yourself
• logins and cookies of the sites you open — kept separately per site, and forget site deletes them together with the site's drafts
• settings, including the key that addresses your request list
• a short log of your recent requests for usage measurement — the site's host name, lengths and counts, never page content. It leaves only when you copy it yourself

Deleting the app or removing the extension removes all of the above.

What leaves your device, and only when you send it

Clipboard, zip and share

A request goes wherever you send it — your agent's app, mail, a file. We are not part of that and no copy reaches us. What your agent does with the request is governed by that provider's terms, not ours.

Remote MCP (relay)

Off by default. It is switched on by Send to agent through the server in the app's Connections section, or Send to your agent through the server on the extension's Connection page. Before the first send you are asked again. When you then send a list to your agent, the following — and nothing else — goes to our server (a Cloudflare Worker at mcp.webeditor.click):

• the request text you typed or dictated
• the address and title of the page the request was made on
• the selected element's anchor and selector, the text you marked in it, its styles and surroundings, and a trimmed outline of the page around it
• page speed figures, if you attached them to the request
• the intro for the website that you chose to put in front of your requests
• in the app: a downscaled crop of the selected element and pictures you attached yourself

Your agent also stores data there: the intro it writes for your website when it connects, which the app then shows you to accept or discard, and a note on each request it checks off. When you accept a checked-off request in the app, only its identifier is sent.

No account is created. Every website has its own list and address, with a key generated on your device. Anyone who knows the key can reach that website's list, so treat the address as a secret.

How long we keep it. The whole list — requests, pictures, the agent's intro and notes — disappears one week after the last write. A picture is deleted the moment the agent downloads it, and with the list at the latest. Turning the switch off stops sending and deletes everything held on our side. If the server does not respond at that moment, the deletion is retried later, in the app at its next launch and in the extension once the server is reachable. The link between the key and your subscription (an anonymous number, see Payments) is kept for 30 days after the list is deleted, so that a week without activity does not look to your agent like a lapsed subscription. It is then deleted as well. The link for a paired extension is deleted 30 days after the extension last sent anything. Forgetting a website in the app deletes its list on our side too.

What we do not do with it. We do not read it, do not learn from it, do not pass it on and do not combine it with anything else. The content does not end up in logs or statistics. We measure counts and sizes, not what the request says.

The server runs on Cloudflare, acting as our processor, which sees the technical details of each request — IP address, time, the address of the request and its size. We do not build a profile from them.

Microphone and dictation

Dictation is in the app. You start it yourself. Transcription runs on the device using the system speech recogniser. Audio is not stored and is not sent to us or to anyone else. Only the text remains, visible in the sentence and editable by you.

Photos

The app accesses your photo library only at the moment you attach a picture — the one you pick, or your latest screenshot when you ask for it — and only for that image. Nothing else is read, and the image stays on the device until you send the request.

What the app and extension do not have

• no accounts, no sign-up, no login with us
• no analytics, no third-party SDKs, no advertising identifiers
• no selling or sharing of data with third parties
• no inference on our account — you pay your own agent for the model
• no git integration and no access to your website's source code

Payments

The subscription is purchased through the App Store. Apple handles the payment under its own terms. Your payment details never reach us and we do not see them.

After a purchase, the app sends our server the transaction signed by Apple, and the server checks the subscription with Apple. We keep the purchase number, whether it was made in the App Store or in Apple's test environment, its state, when it ends and whether it renews. No name, no email, no Apple ID. Apple also tells our server when the subscription renews, lapses or is refunded. This check runs whether or not the relay is switched on — it is how the app and the relay know the subscription is valid.

The relay knows your subscription only as an anonymous number derived from the purchase. When you pair the Chrome extension, it shows a code, you confirm it in the app, and the server links to the same number an extension key that is not part of any address you give an agent. The server then uses that key to link your websites' keys to the subscription as well. An unused code expires after 10 minutes.

We keep the purchase record while the subscription lasts and delete it 30 days after it ends. A renewal or a new purchase creates it again.

Children

The editor is a tool for working on websites and is not directed at children. We do not knowingly collect data about children.

Legal basis

• the relay — your consent (Art. 6(1)(a) GDPR). You give it by switching sending on and confirming the first send, and you withdraw it by switching sending off. Without it nothing is sent and the app and the extension keep working through the clipboard
• checking the subscription and pairing the extension — performance of the contract you entered by subscribing (Art. 6(1)(b) GDPR)
• technical details of requests at Cloudflare — our legitimate interest in running the server and keeping it safe (Art. 6(1)(f) GDPR)

Where the data is processed

Our server runs on Cloudflare's global network, so data may be processed outside the EU, including in the United States. Cloudflare processes it on our behalf under its data processing addendum, which includes the EU standard contractual clauses, and it is certified under the EU–U.S. Data Privacy Framework. Apple handles the purchase itself as an independent controller under its own terms.

Your rights

Apart from the subscription record above, we hold nothing about you until you send a request. You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time. In practice:

• the relay — turning sending off deletes everything held on our side at once. We cannot find a list without its key and will never ask you to send us the key. Otherwise, the list is deleted one week after the last write
• the subscription record — write to info@indigostudio.cz with the order ID from Apple's receipt. We will look the purchase up with Apple and tell you what we hold, or delete it. While the subscription runs, the next renewal creates the record again
• complaints — you may lodge a complaint with the Czech Data Protection Authority (uoou.gov.cz) or your local supervisory authority

Changes

If this policy changes, the date above changes with it. A substantive change — above all, anything that would start leaving the device that stays on it today — is stated in the app before it happens.

Contact

info@indigostudio.cz