Privacy Policy

Last updated July 11, 2026

This explains what Peekly collects, why, and what you can do about it. The short version: the extension’s core feature, link previews, never touches a Peekly server at all. Buying a license doesn’t require an account — the only data we hold is the email you give us to receive your license key, or an account’s details if you choose to create one.

The browser extension, specifically

The extension runs a small script on pages you visit so it can show preview cards under search results on Google, Bing, DuckDuckGo, and Google Scholar, and open a link’s live preview when you press and hold it. Concretely:

• How previews work: when you preview a link, the extension fetches and reads that page directly from your browser, the same way opening it in a tab would. This never passes through a Peekly server. We don’t see, log, or have any record of the pages you preview or visit.
• What it reads: only the URLs of links that appear in a search results page, or that you press and hold, plus the content of the specific page being previewed (to build the card). It does not read your keystrokes or maintain a browsing history.
• No account required: previews, settings, and the AI assistant all work without signing in to anything. There is no session, cookie, or API key involved in previewing a link.
• Your preferences: theme, fonts, AI provider settings, and your excluded-sites list are stored locally by Chrome (chrome.storage), scoped to your browser profile. They are never sent to Peekly. If you add an AI provider key, it’s stored the same way and used only to call that provider directly from your browser — we never see it or proxy the request.
• Excluded sites: any domain you add to your exclude list is skipped entirely. The extension does nothing on those pages.

We don’t sell browsing data or build ad profiles from it, because we never receive it in the first place.

Buying a license

Buying Plus or Pro does not require creating a Peekly account. Payment is handled entirely by StreamPay — we never see or store your card details. After payment, you give us an email address (on a page separate from checkout) so we can send your license key; that email and your license key are the only data this creates. A license key activates directly on your device(s) from within the extension — no sign-in involved.

If you create an account

Optional, and separate from buying a license — only relevant if you want to sign in to the web dashboard. If you sign up, we collect:

• Account info: your email address, and a salted, hashed password if you use one (magic-link and Google sign-in don’t require a password at all). We never store a plain-text password.
• Technical data: IP address and request metadata for the account endpoints only, kept briefly for abuse prevention.

How we use it

To operate the Service: deliver your license key, authenticate you if you have an account, respond to support requests, and send service-related email. We don’t sell your data, and we don’t use it for advertising.

Cookies

We set one cookie: an httpOnly session token that keeps you signed in, only if you create an account. It isn’t used for tracking or advertising, and isn’t shared with third parties.

Who we share it with

A small number of infrastructure providers process data on our behalf, strictly to run the Service:

• StreamPay: payment processing
• Resend: delivering your license key and sign-in emails
• Our database provider: license and account storage (Postgres)
• Our hosting provider: runs the account/license API and web app

We don’t sell or rent your data to anyone else.

Your rights

You can access and update your account details from the dashboard at any time. Account deletion and full data export aren’t yet self-service features. Email [email protected]and we’ll handle the request manually. We’re working on making both self-service.

Data retention

We keep account data for as long as your account is active, plus a reasonable period afterward in case you return. Deleting your account (by request, until self-service exists) removes your personal data from our primary database; some records may persist briefly in backups before they cycle out.

Security

Passwords are hashed with scrypt and salted per account; we never store them in plain text. Traffic to the Service is encrypted in transit. No system is perfectly secure, and we’ll notify affected users if we ever become aware of a breach involving their data.

Children

The Service isn’t directed at children, and we don’t knowingly collect data from anyone under 13.

Changes

If this policy changes materially, we’ll update the date above and, for significant changes, notify account holders by email.

Contact

Questions about this policy: [email protected].