Privacy Policy — Thisbit
Draft — not legal advice. Generated from a declared profile. Read every line: a policy that describes practices you do not follow is a promise you did not know you made. Have a lawyer review it before you rely on it.
Last updated 2026-10-12.
Thisbit (“we”) is run by Conor Livingston, established in California, USA. This policy explains what we collect at thisbit.link, why, and what you can do about it.
What we collect
- your email address and Firebase user identifier — to check your invitation and identify your account
- screenshots, annotations, page titles, source URLs, dimensions and capture timestamps — to provide your library and shared screenshot pages
- necessary sign-in cookies, hashed session tokens and temporary sign-in/extension connection records — to keep your account secure
- technical request and error logs processed by Cloudflare — to operate and troubleshoot the service
We do not sell your information, and we do not use it to advertise to you.
Who else sees it
- Cloudflare — hosting and storage
- Google / Firebase Authentication — sign-in, user accounts and session management
How long we keep it
Unkept screenshots become eligible for removal after 30 days or when they fall outside your newest 500 unkept screenshots. Cleanup runs on your next upload, not on a fixed schedule. Screenshots previously marked Keep remain exempt.
You can delete screenshots yourself. Deletion removes the active share page and stored image objects; it cannot recall copies already downloaded or cached by recipients. Contact us to request account deletion, correction or an export.
Firebase web sessions expire after 5 days; extension sessions after 90 days. Temporary extension connection records expire after 10 minutes. Expired extension credentials are cleaned up during subsequent connection activity. Firebase manages sign-in records under its own retention policies. Account and invitation records remain until removal is requested. Provider logs and backups follow provider retention settings and may outlast deletion from the active application.
Sharing and browser storage
Your library requires sign-in. Individual screenshot pages and images are public to anyone with their unguessable links, including anyone a recipient forwards the link to. Source page titles and URLs can appear on share pages. Capture only what you intend to share.
The Chrome extension captures only when you ask it to. It stores its access token and settings in local extension storage, not Chrome sync, and copies the resulting share link to your clipboard. Existing legacy installations may also store an editing token in the browser’s local storage. New web sessions use HttpOnly cookies. When you request an email sign-in link, your browser stores the email address locally to complete sign-in on the same device; it is removed after successful sign-in. Firebase sends the requested sign-in email. We do not collect continuous browsing history or run advertising analytics.
Your rights
You can ask us to show you what we hold about you, correct it, or delete it. Email conorliv@gmail.com and we will act on it. You do not have to explain why, and we will not make the service worse for you because you asked.
Depending on where you live, you may have these rights under law — including the GDPR in the UK and EU, and the CCPA in California. We honour them regardless of where you live.
Children
This service is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.
Security
We use HTTPS everywhere and keep access to your information limited to what running the service requires. No system is perfectly secure; if something happens that affects you, we will tell you.
Changes
If this policy changes we will update the date above. Continued use after a change means the new version applies.