Privacy Policy

Last updated 31 August 2026

Who this is about

Fibrae is made and operated by Shetty Enterprises LLC. “Fibrae”, “we” and “us” below mean Shetty Enterprises LLC. “You” means anyone using the app at usefibrae.vercel.app or this website.

What we store about you

The Google sign-in

Fibrae asks you to sign in with Google once, before the free trial starts. It is worth being precise about why, because “sign in to continue” usually means something else: it is there so that a subscription can be recognised on a device that has never held it. Without it, buying a subscription and then opening Fibrae on a new laptop would leave no honest way for the app to tell you had already paid.

• What Google gives us. Your email address and Google’s own account id for you. Not your password, contacts, calendar, files, or anything else — the sign-in requests no access to your Google account beyond confirming who you are.
• Where it goes. Onto your device, inside a token this deployment signs. The server verifies each sign-in with Google, replies, and writes nothing down. Your email is used once more, at the moment you subscribe or ask “have I already paid?”, to look the subscription up at Stripe.
• It is required. Without it, the 14-day trial only works on that single device, and any subscription you buy cannot follow you to another device. If you want the app to work across devices, this sign-in is mandatory.
• The Android app does not use it at all. Google Play already knows which account is signed in on the device and already attaches the subscription to it.
• Signing out (Settings → Account) removes it from the device. Your canvases are untouched and nothing is cancelled.

Everything you make in Fibrae is written to storage that belongs to your device:

• Browser storage (the default). Canvases, cards, links and images go into IndexedDB, a database built into your browser. It is tied to that browser on that device. Clearing your browsing data deletes it, and we cannot recover it — which is why the app offers an export.
• A folder you choose (optional). If your browser supports the File System Access API and you pick a folder, each canvas becomes a .fibrae.json file in that folder, with images in attachments/. Fibrae can only ever see the folder you explicitly grant, and only while the app is open.
• Settings and preferences. Your theme choice, feature settings and whether you have seen the introduction are kept in localStorage on your device.

The three times something leaves your browser

These are the only cases. Each is triggered by an action you take, and none of them stores what passes through.

1. Reading a link you paste

When you paste a web address, the app needs the page’s title, description and preview image so the card is readable. A browser is not allowed to fetch another website’s page directly, so the address is sent to /api/unfurl — a small function on Fibrae’s own hosting. It fetches that page, reads a handful of meta tags, returns them, and keeps nothing.

• What is sent: the URL you pasted. Nothing else from your canvas.
• What is kept: nothing. The URL is not written to a database or a log by us. The page’s title and description may be cached at the hosting edge for up to 24 hours so that pasting the same link again is instant.
• Who else sees it: the website you linked to sees a request from our server, identified as FibraeBot. It does not see your IP address or anything about you.
• If you skip it: a link that cannot be read still becomes a working card, marked “preview only”.

2. Asking for a draft

Turning a cluster into a draft is the one feature that sends your own content anywhere, and it only happens when you press the button. What is sent is the text of the cards in the single cluster you selected — their titles, summaries and links. Never the rest of the canvas, never your other canvases, never your settings.

Fibrae has no model of its own and no API key of its own. Every model that can write a draft is one you bring, so there is no mode in which your cluster passes through our hosting on its way to a model. You choose in Settings → Drafts:

Mode	Where the cluster goes
Outline only (default)	Nowhere. The outline is built on your device from your own cards. No network request is made at all.
On my computer	To a model running on your own machine, through Ollama at an address you set. The request goes from your browser to your own computer and no further. Nothing reaches us, and nothing reaches Anthropic.
My own key	Straight from your browser to Anthropic, using a key you paste in. It never touches our server. The key itself is kept only in your browser’s local storage.

Under My own key, Anthropic processes the text under its own privacy policy and commercial terms, which state that API inputs are not used to train their models. If you would rather nothing ever left your device, both other modes qualify, and the outline is a real, usable document rather than a degraded one.

3. Fonts, thumbnails and embeds

• Google Fonts. The typefaces load from fonts.googleapis.com and fonts.gstatic.com, which means Google receives your IP address and browser details as part of that request. This applies to this website and the app.
• Video thumbnails and players. If you add a YouTube, Vimeo or Loom link, the thumbnail loads from that service, and pressing play loads their player. From that point their own privacy policy and cookies apply. Nothing loads from them until you add such a link.
• The optional deeper-matching model. If you turn on “Deeper matching” in Settings, the app downloads a language model from Hugging Face’s CDN once and then runs it entirely inside your browser. Your cards are never sent anywhere for this — only the model comes down.

Speaking a card instead of typing it

The capture bar has a microphone button. Pressing it turns on your browser’s own speech recognition and drops what you say into the same box you would otherwise type into.

• Fibrae receives no audio. We do not record, upload or store anything from your microphone, and there is no endpoint of ours involved at any point.
• The transcription belongs to your browser, not to us — and on some browsers, Chrome in particular, that built-in engine does its work in the cloud rather than on the device. That is an arrangement between you and your browser vendor, under their privacy policy, and it is the reason this is a button you press rather than a microphone that listens.
• It is only ever on while you have switched it on. It stops when you press the button again, when the card is added, and when you leave the screen.
• It is entirely optional. Typing does the same job, and the button is simply absent in browsers that have no speech recognition.

Sharing into Fibrae from your phone

Fibrae registers itself in Android’s share sheet, so “Share → Fibrae” on a link drops it straight onto your most recent canvas. This is worth describing on its own, because it is the one case where a link reaches the server by a different route than pasting.

• Fibrae removes the link from the address bar as soon as it has read it, so it is not left in your browser history or carried into later requests. The first request has already happened by then, which is why this section exists.
• Pasting is the quieter route. A link you paste into the app is only ever sent to /api/unfurl, never as a page address. If you would rather a particular link stayed out of the request log, paste it instead of sharing it.
• This applies to the share sheet only. Everything else about a shared link — the card, the title, where it sits on the canvas — is handled exactly as if you had pasted it.

Installing Fibrae to your home screen changes none of this. It is the same app in the same browser engine, storing the same things in the same places on your device.

Paying for Fibrae

Fibrae is free for 14 days and $5.99 a month after that. Who takes the payment depends on where you are using it, and in neither case is it us:

• On the web — by Stripe, on Stripe’s own checkout page. Your card number never passes through Fibrae.
• In the Android app — by Google Play, which Google requires for anything bought inside an app distributed through the Play Store. The subscription is attached to your Google account, and Fibrae is told only whether that account currently owns it. We are not told who you are.

The two are separate. A subscription bought on the web does not carry over to the Android app, and one bought through Play does not carry over to the web. Google requires purchases made inside a Play-distributed app to go through Play, and the two systems have no way to see each other’s records.

Within each of them, though, a subscription does follow you between devices. On Android that is Play’s doing. On the web it is what the Google sign-in is for: your verified email is what lets Fibrae ask Stripe “does this person have a subscription?” from a browser that has never seen one.

We keep no customer records. There is no user table, no database and no mailing list here. Stripe holds your email and billing details because a payment processor has to. What your browser holds is two short signed tokens — one naming your Stripe customer id, one naming your Google account — and when the app checks that your subscription is still live it sends one of them to this deployment, which asks Stripe or Google and forwards the answer. The check is not logged, and neither token carries a name or any card data.

You can see, change or cancel your subscription from Settings → Subscription, which opens whichever of the two holds it — Stripe’s billing portal on the web, or your Google Play subscriptions screen in the app. Deleting the billing records they hold is a matter for Stripe or Google, whose privacy policies are linked above.

Hosting and server logs

This website and the app are hosted on Vercel. Like any web host, Vercel automatically records standard request information — IP address, timestamp, requested path, user agent — for delivery, security and abuse prevention. We do not add analytics on top of that, do not query those logs to profile anyone, and have no way to link them to your canvases, because your canvases never reach the server.

One caveat to that, stated plainly: a link you send through the Android share sheet travels in the requested path, so it is in those logs. It is the only part of your content that ever is. We do not read them, but we would rather say so than let “requested path” quietly cover it.

Cookies

The app uses localStorage and IndexedDB, which are similar technologies but are strictly local: they are never transmitted with requests the way cookies are. Embedded video players from third parties may set their own cookies once you press play.

Children

Fibrae is not directed at children under 13 and collects no personal information from anyone, of any age.

Your rights over your data

Because your work never reaches us, the usual requests — access, correction, deletion, portability — are things you can carry out yourself, immediately, without asking:

• Access and portability: Settings → Backup → Export all, which produces one JSON file containing every canvas.
• Correction: edit any card directly on the canvas.
• Deletion: delete a canvas in the app, or clear the site’s data in your browser settings to remove everything at once. If you use a folder, delete the files.

We hold no copy, so there is nothing for us to delete on your behalf. If you have a question about this, contact us at the address below.

Changes to this policy

If Fibrae ever starts doing something with your data that this page does not describe, this page will be updated before that change ships, and the date at the top will change with it. The project is open about its behaviour precisely so that this document can stay short and literally true.

Contact

Questions about this policy can go to fibrae@shettyenterprises.com.