Privacy Policy
Last updated: 2026-10-13
laiki saves groups of links as short pages you can share. This page describes what the laiki website (laiki.cc) and the laiki Chrome extension actually do with your data. Everything here was checked against the code. If you find anything laiki does that this page doesn't say, that's a bug. Please tell us.
What we collect
When you sign in with Google
laiki uses Google sign-in and asks for only the basic scopes: openid,
email and profile. We do not read your Gmail, your Google Drive or your
contacts.
Our sign-in provider (Supabase Auth) stores what Google returns: your email address, your name, your profile picture URL and your Google account ID. It also keeps standard sign-in records, such as when you signed in and from which IP address, for security.
laiki itself keeps a profile with:
- your username, which is public and appears in your page address
(
laiki.cc/@username) - your display name, which is also public
- the date your account was created
Your email address is never shown on any page.
What you save
- Collections: title, description, visibility, and an archived flag
- Links: title, URL and their order
- Groups and sections: how you organize your collections and links
Edit keys
You can give a collection an edit key (a password). We store only a bcrypt hash of it. The password itself is never stored and cannot be recovered from the hash. We also count failed attempts and temporarily lock the key after too many, to stop guessing.
Who can see your collections
Every collection has one of three visibility settings. Here is what each one really means:
- Public: anyone can see it. It is listed on your user page and may be indexed by search engines.
- Unlisted: not listed on your user page, but not secret. Anyone who has the link can open it. Unlisted collections and their links can also be read through laiki's public API without a link. Don't put anything in an unlisted collection that you wouldn't want a stranger to read.
- Private: only you can see it, when signed in. This is enforced in the database, not just hidden in the interface.
Edit keys are for editing, not viewing. If a collection has an edit key, anyone who knows that key can add, change and delete its links without signing in. Share an edit key only with people you'd trust to change the collection.
The Chrome extension's permissions
| Permission | What it's used for | What it doesn't do |
|---|---|---|
tabs | Reads the titles and addresses of tabs in your current window so you can pick which ones to save, and checks whether a link is already open so it can switch to that tab instead of opening a duplicate. | Only runs when you open the popup or side panel. Your browsing history is never recorded or uploaded. Only the tabs you choose to save are sent to laiki. |
bookmarks | Bookmark import: lists your bookmark folders so you can pick one. | Your bookmarks are read on your device to build that list. Only the links in the folder you choose are uploaded. |
identity | Google sign-in. | — |
storage | Keeps three things on your device: your sign-in session, a cache of your collections so the side panel opens instantly, and interface state such as which folders are expanded. | All of this stays on your device. |
sidePanel | Shows laiki in Chrome's side panel. | — |
The extension talks to only one server: laiki's database at Supabase.
Cookies and local storage on the website
- Sign-in cookies from Supabase Auth keep you signed in.
- Local storage remembers two preferences on your device: light or dark theme, and how your dashboard is laid out.
Neither is used for tracking.
What we don't do
- No analytics or tracking. laiki has no Google Analytics, no tracking pixels, no session recording and no error-reporting service.
- No ads. We don't sell your data or share it with anyone for advertising.
- No browsing history. We store only the links you choose to save.
Where your data lives
laiki relies on these services to run:
- Supabase: database and sign-in. Your data
is stored in AWS's Tokyo region (
ap-northeast-1). - Vercel: hosts the website.
- Google: sign-in only.
- Cloudflare: forwards email
sent to
privacy@laiki.cc.
Like any web host, Supabase and Vercel process your IP address when you connect.
Keeping and deleting your data
- You can delete any link or collection, or remove an edit key, at any time from your dashboard.
- Deleting your account isn't self-service yet. Email privacy@laiki.cc from the address you signed in with, and we'll delete your account within 30 days.
- Deleting an account deletes everything attached to it: your profile, collections, links, groups, sections and edit keys. The database removes them together, so nothing is left behind.
Changes
When this policy changes, we'll update this page and the date at the top.
Contact
Questions or requests: privacy@laiki.cc