Privacy Policy

Carry downloads verified compatibility settings from carry.md to support fixes the maintainer explicitly publishes. All executable logic stays in the installed extension. Automatic compatibility updates are on by default; you can turn them off in settings. Requests send no conversation content, files, vault information, license data or installation identifier, and use no cookies or provider credentials. The static host, Vercel, sees ordinary request metadata, including your IP address and User-Agent. Accepted settings and update status are stored in your browser. These checks are separate from license activation.

Automatic: on by defaultCan be turned off in settingsDownloaded data, not code

To see which parts of Carry work and where people get stuck, the extension sends anonymous usage counts to carry.md/api/events, which passes them to Carry's own analytics server (Trail, at trail.holdon.site), Carry's self-hosted Umami and Carry's self-hosted OpenPanel (at stats.holdon.site). Each event is a name from a fixed list — a finished sync, a setup step, a failed license activation, a changed setting, a pressed buy, retry or history button — plus numbers and fixed labels: how many items were saved by kind (conversations, files, artifacts, project files) and how many failed, a short failure category, roughly how many conversations were waiting when you opened the popup, which provider, which setup step, which setting was switched and to what, whether you are on the trial, licensed or expired, the extension version, and your browser's User-Agent. Each batch also carries a few coarse facts about the install: roughly how long ago it was installed, whether it started fresh or as an update and from which minor version, which trial week you are in, whether your folder is connected or needs reconnecting, which providers are connected, and which Chromium browser you use. Once a day it adds a health check in coarse ranges: how many conversations are waiting to retry or need attention, how many automatic syncs ran, and how long since the last save and the last working folder connection. When your folder needs reconnecting, it counts whether you reconnected and roughly how long it had been waiting. Failures carry a short category and the step that failed (listing, fetching, formatting, writing). A random install ID made on your device lets these services count installs; Trail and OpenPanel store that ID with each count. It is not your license label and is never sent to Polar. Usage counts never include conversation content, titles, ids or URLs, project names, file names, vault paths, license keys or error messages. carry.md checks every event against the same fixed list and drops anything else. It replaces your IP address with a private address derived from that random install ID before forwarding events, so these analytics services get no location from your IP; Vercel, which hosts carry.md, still sees ordinary request metadata, including IP address. No cookies are used. Turn off “Share anonymous usage counts” in settings → Privacy and nothing more is sent.

Automatic: on by defaultCan be turned off in settings → PrivacyNumbers and fixed labels, never content

During a manual or scheduled capture, Carry reads conversations from each provider you connected, using the session already open in that browser. Content is held in memory only long enough to write it to your folder, then discarded. It is written to your disk and nowhere else — never uploaded, relayed, cached, or logged off your device.

Written to: your folder onlyUploaded: neverRetained by Carry: no

Carry keeps your theme and capture preferences, a recent-inbox cache (conversation ids, titles, provider, timestamps and state), the full-history backfill cursor, a sanitized license record, and a few small internal flags (a per-install device label, a random install ID for usage counts, and a dismissed-notice flag) in chrome.storage.local. The chosen folder handle and per-conversation/project sync records (including ids, titles, timestamps and local file paths) live in the extension's IndexedDB database. Both stores stay inside your browser profile on this device. Carry deliberately never uses chrome.storage.sync, which would replicate data to your browser vendor's servers.

Lives in: chrome.storage.local + IndexedDBReplicated to any server: never

The permission to write to the folder you picked is granted by you through the browser's File System Access API and held by the browser. Carry uses it only to write capture files into that folder.

Granted by: you, via the browserUsed for: writing captures only

Carry never asks for or stores provider passwords or API keys. It relies on the login cookies already held by your browser; Carry does not read or copy those cookies. ChatGPT's session endpoint supplies a short-lived bearer access token, which Carry holds only in memory for the active provider operation and sends only back to chatgpt.com. It is never written to extension storage, your capture files, Polar, or a Carry server.

Provider passwords & API keys asked for: noneSession credential persisted: never

If you buy a license, pressing activate sends exactly three things to Polar, the payment platform: the license key you typed, Carry's Polar organization id, and a random install label (like carry-chrome-x7k2p9) so you can manage your device activations. It is a label Carry makes up, not a hardware fingerprint. Re-activating an existing license also sends the activation id Polar issued. That is the whole list — it happens only when you press activate; Carry never contacts Polar in the background, and no conversation content, cookies, or browsing data is ever included. Carry stores only a one-way SHA-256 digest of the key, a masked display value, Polar's activation id, and the activation timestamp — all on your device, alongside a first-run trial timestamp and the random install label (kept under its own key). A raw key stored by versions through 0.2.0 is migrated to that sanitized record on first read.

Sent: key + organization id + install labelRaw key stored by Carry: no

Lets Carry read your conversations from a provider you chose to connect (Chrome may word it as “read and change your data”), scoped to that provider's required origins and nothing broader. ChatGPT uses chatgpt.com; Claude uses claude.ai; Grok uses grok.com.

Holds the local-only settings and sync state described above, in chrome.storage.local and IndexedDB. It never uses chrome.storage.sync.

Schedules automatic capture checks while Chrome is open and resumes an in-progress full-history backfill after the extension's background worker sleeps. It does not create system notifications.

Lets Carry skip the scheduled capture check while the browser is idle or locked, and run one catch-up check when you are back. It reads only Chrome's active/idle/locked state and is never used for tracking or notifications.

Requested only if Polar's normal cross-origin response cannot complete after you press activate. It is used solely for the license request described above and is never contacted in the background.

Used only for the tab-bound capture path a provider requires when it blocks background requests (Grok). It runs the capture in that provider's own tab; it does not inject anything into unrelated sites.