Privacy

Privacy Policy

The short version: Carry has no server, no account, and no analytics. Your conversations never leave your machine. This page explains exactly how, and why that is true by construction rather than by promise.

Last updated: July 25, 2026Applies to the Carry extension and carry.md

The one-sentence policy

Carry does not collect, transmit, sell, or share your conversations. There is no Carry server for it to send them to. License activation separately sends limited license metadata to Polar, the payment platform, only when you press activate —see exactly what it sends.

Carry is a Chrome (and Chromium browser) extension that captures your ChatGPT, Claude, and Grok conversations and writes them into a local folder you choose — a plain folder or your Obsidian vault — as Markdown files. It runs entirely on your own device.

Where your data goes

One sync, traced end to end. Every hop happens inside your browser, on your machine — and there is no fourth stop.

Their server

The provider

chatgpt.com · claude.ai · grok.com — read through the session you're already logged into. No password, no API key.

Your browser

Carry

Held in memory for one sync — long enough to write the file, then discarded. Never stored, never logged.

Your disk

Your folder

Plain Markdown files, in a folder you own. The only place your data lands.

postgres-query-plan.md✓

What Carry touches, and where it goes

Five kinds of data, five one-glance answers. Expand each for the full detail.

Your conversationsmemory → your disk

During a manual or scheduled capture, Carry reads conversations from each provider you connected, using the session already open in that browser. Content is held in memory only long enough to write it to your folder, then discarded. It is written to your disk and nowhere else — never uploaded, relayed, cached, or logged off your device.

Written to: your folder onlyUploaded: neverRetained by Carry: no

Your settings & sync statebrowser storage on your device

Carry keeps your theme and capture preferences, a recent-inbox cache (conversation ids, titles, provider, timestamps and state), the full-history backfill cursor, a sanitized license record, and a few small internal flags (a per-install device label and a dismissed-notice flag) in chrome.storage.local. The chosen folder handle and per-conversation/project sync records (including ids, titles, timestamps and local file paths) live in the extension's IndexedDB database. Both stores stay inside your browser profile on this device. Carry deliberately never uses chrome.storage.sync, which would replicate data to your browser vendor's servers.

Lives in: chrome.storage.local + IndexedDBReplicated to any server: never

Your folder handleheld by your browser

The permission to write to the folder you picked is granted by you through the browser's File System Access API and held by the browser. Carry uses it only to write capture files into that folder.

Granted by: you, via the browserUsed for: writing captures only

Your provider sessionin memory, provider-bound

Carry never asks for or stores provider passwords or API keys. It relies on the login cookies already held by your browser; Carry does not read or copy those cookies. ChatGPT's session endpoint supplies a short-lived bearer access token, which Carry holds only in memory for the active provider operation and sends only back to chatgpt.com. It is never written to extension storage, your capture files, Polar, or a Carry server.

Provider passwords & API keys asked for: noneSession credential persisted: never

Your license keyyou → Polar, at activation

If you buy a license, pressing activate sends exactly three things to Polar, the payment platform: the license key you typed, Carry's Polar organization id, and a random install label (like carry-chrome-x7k2p9) so you can manage your device activations. It is a label Carry makes up, not a hardware fingerprint. Re-activating an existing license also sends the activation id Polar issued. That is the whole list — it happens only when you press activate; Carry never contacts Polar in the background, and no conversation content, cookies, or browsing data is ever included. Carry stores only a one-way SHA-256 digest of the key, a masked display value, Polar's activation id, and the activation timestamp — all on your device, alongside a first-run trial timestamp and the random install label (kept under its own key). A raw key stored by versions through 0.2.0 is migrated to that sanitized record on first read.

Sent: key + organization id + install labelRaw key stored by Carry: no

Every permission, explained

Carry requests the smallest possible permission set, and it requests access to a provider's required sites only when you click Connect for that provider — not at install. Connect only Claude and Carry can access only claude.ai and Claude's file/artifact host.

Each line appears only when you connect that provider, and it is scoped to that provider's required origins and nothing broader.

Per-provider site accessrequested at connect time

Lets Carry read your conversations from a provider you chose to connect (Chrome may word it as “read and change your data”), scoped to that provider's required origins and nothing broader. ChatGPT uses chatgpt.com; Claude uses claude.aiplus *.frame.claudeusercontent.com for files and Artifacts; Grok uses grok.com.

storagelocal-only settings

Holds the local-only settings and sync state described above, in chrome.storage.local and IndexedDB. It never uses chrome.storage.sync.

alarmsscheduled capture & backfill

Schedules automatic capture checks while Chrome is open and resumes an in-progress full-history backfill after the extension's background worker sleeps. It does not create system notifications.

idleskips capture while you're away

Lets Carry skip the scheduled capture check while the browser is idle or locked, and run one catch-up check when you are back. It reads only Chrome's active/idle/locked state and is never used for tracking or notifications.

api.polar.shoptional, at activate only

Requested only if Polar's normal cross-origin response cannot complete after you press activate. It is used solely for the license request described above and is never contacted in the background.

scriptingGrok's tab-bound capture only

Used only for the tab-bound capture path a provider requires when it blocks background requests (Grok). It runs the capture in that provider's own tab; it does not inject anything into unrelated sites.

Carry requests nocookiestabshistory<all_urls>access.

What Carry does not do

  • No account, sign-up, or login to Carry itself.
  • No Carry server or backend — there is nothing to receive your data. (License activation talks to Polar, the payment platform — see “Your license key” above.)
  • No analytics, telemetry, tracking, cookies, or fingerprinting.
  • No advertising, and no sale or sharing of data with third parties.
  • No use of your data for advertising, creditworthiness, lending, or any purpose unrelated to capture and license operation. Conversation content is never transferred; license metadata goes only to Polar when you press activate.

Don't take our word for it

A policy is a promise; architecture is a fact. Every claim on this page is checkable in a few minutes.

  1. 1

    Inspect its site access

    Open chrome://extensions → Carry → Details. Under “Site access” you'll see only the providers you connected (plus api.polar.sh if you've activated a license) — nothing else.

  2. 2

    Watch the network

    Open DevTools on the extension while you sync. Requests go only to the connected providers' listed origins. Pressing activate additionally makes the disclosed request to api.polar.sh. There is no Carry endpoint to find.

The fine print

This website

This site (carry.md) is a static marketing and documentation site. It sets no tracking cookies and runs no third-party analytics. Standard, non-identifying web server request logs may be kept by whichever static host serves the site, purely to operate and secure it.

Licensing

Carry's paid license is sold through Polar, the merchant of record. Checkout happens on Polar's own pages — Carry never sees your payment details, your name, or your email. When you activate a license, the extension sends Polar the license key you typed, Carry's Polar organization id, and a random install label; re-activating also sends the activation id Polar issued. That request happens only when you press activate — the api.polar.sh permission is itself optional and requested at that click — and it never carries any conversation content. The purchase itself is covered by Polar's privacy policy.

Retention and deletion

Local settings and sync records remain in the extension's browser storage until you clear extension data or uninstall Carry. Uninstalling removes that browser-held state; Markdown and downloaded files already written to your chosen folder remain there until you delete them. Polar retains purchase and activation records under its own policy; device activations can be managed through Carry's linked Polar customer portal.

Chrome Web Store Limited Use

Carry's use and transfer of information received from provider APIs adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. Provider content is used only to perform the user-facing capture and local file-writing features described on this page.

Children

Carry is not directed to children.

Changes to this policy

If Carry's behavior changes in a way that affects this policy — for example, an optional automatic-capture feature — this page will be updated and the “last updated” date above will change. Any such change will preserve the core promise: your conversations stay on your device.