Chrome extension privacy

Updated November 11, 2026

This notice describes the Puppetto Chrome extension. It supplements the Puppetto Privacy Policy for the account, website, and organization asset service.

What the extension handles

When you collect an image, the extension stores its image URL, the source page URL, its title or alternative text, and a collection timestamp in a local browser inbox. When you choose to clip a page, it stores the selected page’s URL and title, and may extract page, product, or campaign metadata for that clip. It does not automatically send every page you visit or every image on a page to Puppetto.

Sign-in and organization access

Signing in uses Puppetto’s Google and Supabase authentication flow. The extension receives account identifiers, your email address, organization names and memberships, session tokens, and a short-lived token scoped to your selected organization. These are used to authenticate requests and choose where your work is saved. Credentials are kept in storage restricted to the extension’s trusted contexts. On browsers without local-storage access restrictions, credentials use trusted session storage and are cleared on browser or extension restart.

When images leave your browser

Collecting an image URL is separate from uploading its file. When you choose Save to organization, Upload image, or Save look to organization, the extension sends the image bytes, image name, selected character assignment, and available source URLs to Puppetto. Saved looks also include layer asset IDs and layout settings. These records use Puppetto’s existing organization database and asset storage, including its Supabase and Amazon Web Services infrastructure.

Saved images and looks become organization assets and are available according to Puppetto’s organization and asset-sharing rules. Treat uploading a reference as adding it to that organization’s library; the local inbox is not a private cloud vault.

Image downloads and browser permissions

The extension reads page images and page metadata to support your explicit collection and clipping actions. It requests image-host access when you save or export an image that must be downloaded. Direct image downloads omit the website’s cookies. The image host still receives the normal network request needed to deliver its image. It may prevent downloading; you can use local file upload instead.

Storage keeps settings, the inbox, saved clips, draft layouts, and authentication state. Identity opens the sign-in flow. The side panel hosts the studio. Context menus provide right-click collection and clipping. Active-tab and tab access identify the current page for the picker and clipper. Alarms maintain authentication, and notifications report the result of a clipping action.

Drafts and deletion

Unsaved look layouts are stored locally by account, organization, and character. Remove from inbox deletes a local reference; it does not delete an already uploaded asset. Clearing local data in extension Settings removes browser-local extension data and credentials. To manage or delete uploaded images and looks, open your organization’s asset library in Puppetto. Removing the extension clears its browser storage, while assets already uploaded to Puppetto remain subject to the service’s retention and deletion rules.

Advertising and executable code

The extension does not include advertising, tracking pixels, or an extension analytics SDK, and does not sell collected references or use them for advertising. Its executable code is bundled with the extension. Images and assets loaded from websites and Puppetto are content used by the studio.

Contact

For questions about the extension or your saved data, contact michael@lootgod.com. For account and service privacy requests, also see the Puppetto Privacy Policy.