Privacy Policy

Last updated: 2026-08-13

Lostless is a Chrome extension that adds color bookmarks and inline notes to conversations on Claude and ChatGPT. This page explains what data Lostless touches, what it does with it, and what it never does.

What Lostless stores on your device

The extension stores the following in chrome.storage, scoped to your browser profile:

• Bookmark records: the text snippet you bookmarked, the conversation it belongs to, and its color and tag.
• Inline notes: text you wrote, anchored to a specific paragraph.
• Your color palette settings and the color you used last.
• If you buy Pro: your signed license, and the email address the license was issued to.

With sync switched off, which is the default, this is the only copy of your data and it stays in your browser.

Optional sync, and what it sends

Pro adds sync to a cloud account you already own. You choose one of GitHub Gist, Google Drive, OneDrive or Dropbox and connect it yourself. Until you do that, the extension makes no request to any of them.

Three things are true about how that sync works, and they are the reason it exists in this shape:

• The data goes to your account, not to a server we run. We operate no storage backend for your bookmarks and we hold no copy of them.
• The payload is encrypted on your machine with AES-GCM-256 before it is handed to the cloud provider. The provider stores ciphertext.
• The encryption key is derived on your own device from a sync passphrase that you choose. You type the same passphrase on every device you want your bookmarks on; that is what makes the copy in your cloud readable there and unreadable to anyone else, including us. The passphrase itself is never transmitted, so we cannot recover your data for you and cannot let a new device in without it. A device you already set up keeps working, because it holds the key it derived.

Connecting an account uses Chrome's identity API to run that provider's own sign-in flow. The resulting access token is kept on your device and used only to reach the single file Lostless created in your account.

For Google Drive specifically, the extension requests the drive.appdata scope. That scope can only see files this extension itself created, in a hidden application folder. It cannot list, read or modify anything else in your Drive.

What Lostless reads from the page

To anchor bookmarks and notes to specific paragraphs, the extension reads the page contents of claude.ai and chatgpt.com while you have them open. It stores the text of a paragraph only when you explicitly bookmark or note that paragraph.

What Lostless does not do

• No analytics, no telemetry, no usage tracking. The extension contains no analytics SDK of any kind.
• No network request that you did not trigger. Nothing is sent when you install it, when a page loads, or on a background timer.
• No fingerprinting, no profiling, no ad targeting.
• No selling or sharing of your data with anyone.
• No reading or storage of your Claude or ChatGPT account credentials. Lostless sees the rendered page, never the auth layer.

Data retention and deletion

Local data persists until you uninstall the extension or clear browser data. Uninstalling removes the extension's local storage.

If you connected a cloud account, the synced file lives in that account and is yours to delete. You can disconnect sync from the extension's panel at any time, and you can revoke the extension's access from your provider's own security settings.

Permissions

The extension requests these Chrome permissions:

• storage and unlimitedStorage: to keep your bookmarks and notes on your device without hitting a quota once your history gets long.
• identity: used only when you connect a cloud account for sync.
• host_permissions for claude.ai and chatgpt.com: to draw the bookmarking interface into those pages.
• host_permissions for the GitHub, Google, Microsoft and Dropbox APIs: used only by sync, only for the account you connected.

Changes to this policy

If this policy changes, the date at the top changes with it. We will never reduce your privacy without an explicit opt-in.

Contact

Questions, deletion requests, or concerns: [email protected].