Privacy Policy

Last updated: August 3, 2026

Local-first by default. Pro AI does not keep your saves.

Noya is a Chrome extension that mirrors your X bookmarks into on-device storage so you can read, tag, and export them. There is no Noya signup for the free product. Your bookmarks are not stored as a Noya cloud archive.

If you subscribe to Noya Pro, AI auto-tag may send save text for analysis during a pass. That content is processed transiently — we do not store post content on our servers. Your Pro subscription is tied to your X account, not a separate Noya username.

  • No Noya account is required to use the free product.
  • Your saves are not kept as a Noya cloud archive.
  • Pro AI auto-tag does not store post content on our servers.
  • No analytics or behavioral telemetry is collected by the extension.
  • No platform password is ever requested — Noya uses your existing X session.

Short version

Stored on your device

Saves (bookmark content and metadata), reading progress, highlights, tags, settings, export records, and the auth/runtime metadata Noya needs to stay connected to your X session.

Sent to X for sync

Authenticated requests to x.com / twitter.com to fetch your bookmarks (and optional unbookmark when you choose). That path does not upload your saves to a Noya cloud archive. If you enable Pro AI auto-tag, truncated text needed for tagging may be sent to the Noya API and model provider; Noya does not keep bookmark bodies as a cloud archive.

Pro: subscription and AI analysis

We may store your X user id, Pro subscription status, and payment references. For AI auto-tag, save text may leave the device for analysis and is not retained as a Noya post archive.

Export is yours

You can export media, one save as a zip, or a full JSON backup. Those files stay where you save them. Noya does not upload them for you. Backup export never includes Noya Pro session tokens.

Noya Pro and AI auto-tag

Pro is optional. Manual tags, reading, and export work without it. This section applies only when you subscribe and use AI auto-tag.

What Pro unlocks

A monthly subscription that unlocks AI auto-tag (derive a personal tag vocabulary from your saves and assign tags to untagged saves). It does not unlock a cloud archive of bookmarks.

Identity: bound to your X account

  • Your Pro subscription is tied to the X account already used to mirror bookmarks (same browser session / identity).
  • There is no separate Noya username/password product for Pro. Purchase and activation are primarily inside the extension.
  • Switching to a different X account does not automatically carry Pro to the new identity.

What we may store for Pro (not your posts)

  • X user id (and related identity needed to match your subscription)
  • Pro status and subscription period
  • Payment references (and fields required by the payment processor; the processor may handle email and card data under its own policy)

We do not store your bookmarks, post bodies, tag content, or export packages on Noya servers.

Transient model processing

  • When you run AI auto-tag, relevant save text may be sent from the extension to Noya-operated services solely to produce tag suggestions or assignments for that pass.
  • That content is processed transiently for the request. We do not retain post content as stored user data after the pass completes.
  • Model providers used to fulfill the pass may process the request under their terms for inference; we design the path so Noya does not keep a durable copy of your saves.

Permissions explained

Each permission maps to a specific feature. These are the permissions Noya declares in its Chrome extension manifest for the current build.

storage

Always on
Why
Noya needs local storage so your reading pool, tags, highlights, and settings work like an on-device app.
What it does
Stores saves, reading state, highlights, tags, settings, and runtime/auth metadata in browser storage on this profile. A Query Handoff with an image keeps its text and image only in in-memory browser session storage while the open destination page receives it.

webRequest

Always on
Why
Noya needs to read the auth headers already present in your own x.com session so it can sync bookmarks without asking for a password.
What it does
Observes your x.com / twitter.com GraphQL requests so Noya can capture authorization, CSRF, and related headers required to load your own bookmarks locally.

cookies

Always on
Why
Noya needs to detect whether you are signed into X and keep CSRF tokens current without asking for your password.
What it does
Reads x.com session cookies (such as auth and CSRF-related cookies) locally so Sync can run against the account already logged into this browser profile.

declarativeNetRequest

Always on
Why
Noya’s extension-initiated X requests need to match the authenticated browser session you already have.
What it does
Applies required Origin / Referer headers when Noya asks x.com for bookmarks (and related GraphQL operations) from the extension service worker.

alarms

Always on
Why
Quiet background refresh can wake periodically so the reading pool stays reasonably current without you managing sync jobs.
What it does
Schedules low-salience background sync nudges. Success is silent; you can also refresh manually from Settings.

downloads

Always on
Why
Reader Export and media download need permission to save files to your machine.
What it does
Writes export zips, backup JSON, or media files you explicitly download. Noya does not upload those files to a Noya server.

scripting

Always on
Why
An optional Query Handoff can carry an image into the Grok tab you explicitly open from Noya.
What it does
Lets Noya run its one-shot attachment helper only in that open Grok page. It does not read other Grok conversations or send content to a Noya server.

clipboardWrite

Always on
Why
Grok can reject an automatic image attachment when its page changes or requires a manual upload.
What it does
Only after an attachment handoff fails, Noya may put the image you just chose onto your clipboard and show an instruction to paste it yourself. It never reads your clipboard.

bookmarks

Optional
Why
When Noya is your New Tab, you may still want your Chrome bookmarks bar. This permission is requested only if you enable that strip in Settings — Today’s read works without it.
What it does
Reads your browser bookmarks bar locally so Noya can show links to open. Noya does not copy browser bookmarks into its on-device collection, does not upload them, and does not edit or delete them. This is separate from mirroring your X bookmarks for reading.

https://x.com/* · https://twitter.com/*

Always on
Why
Noya only works against your own account on X, so it needs permission to talk to those hosts for Sync and session-related operations.
What it does
Lets Noya make authenticated API requests to fetch your bookmarks, observe session-related request metadata, and (when you choose) perform optional unbookmark actions against X Bookmarks.

https://images.unsplash.com/*

Always on
Why
New Tab ambient home can show curated wallpaper photos hosted on Unsplash’s CDN.
What it does
Allows the extension page to load image assets from images.unsplash.com. Noya does not send your saves to Unsplash.

https://gemini.google.com/*

Always on
Why
Optional New Tab Query Handoff can open Gemini with your free-text query. Gemini has no public URL API that auto-starts a chat from query parameters alone.
What it does
When you submit a query with destination Gemini, Noya opens gemini.google.com and a page script prefills the composer (and sends) from the URL you just navigated to. Optional attached images stay in browser session storage for that one handoff and are injected only into the open Gemini tab — not to any Noya server.

https://chatgpt.com/* · https://chat.openai.com/*

Always on
Why
Optional New Tab Query Handoff can open ChatGPT with your free-text query. ChatGPT’s public ?q= handoff is inconsistent across accounts and UI variants, so a small page script is needed as a fallback.
What it does
When you hand off to ChatGPT, Noya opens chatgpt.com with your query in the URL. If the site does not start the chat on its own, a page script prefills the composer and sends once. Optional attached images are staged briefly in the browser session and injected only into that open ChatGPT tab — not uploaded to any Noya server, and not used to read other conversations.

https://grok.com/* · https://*.grok.com/* · https://grok.x.ai/*

Always on
Why
Optional New Tab Query Handoff can open Grok with text and an image you choose. Grok does not provide a public URL interface for carrying an image into a chat.
What it does
For a handoff with an image, Noya briefly holds the selected text and image in browser session storage, opens grok.com, then attempts to attach the image before it fills and sends the prompt. Text-only handoffs use Grok’s ?q= URL, so that text may appear in browser history. The helper runs only for a handoff you initiated, does not read existing Grok conversations, and does not upload anything to a Noya server as a save archive.

chrome_url_overrides → newtab

Always on
Why
Noya’s App Shell can replace the browser New Tab with Today’s read so what you saved stays in view.
What it does
Opens Noya when you open a new tab. You can turn New Tab replacement off in settings and still open Noya from the extension action.

Full policy

What Noya stores on your device

  • chrome.storage.local stores your saves (content and metadata as available), reading state, highlights, tags, and extension settings (for example New Tab preference and onboarding state).
  • The same local store holds runtime and auth metadata needed for Sync — such as captured authorization / CSRF-related headers and GraphQL query identifiers for X Bookmarks — so Noya can keep working with your existing session.
  • Sync metadata (for example last sync timestamps) may also be kept locally.
  • Pro status may be cached locally so the extension knows whether AI auto-tag is available for the current X identity.

What Noya sends over the network

  • Noya sends authenticated API requests to x.com / twitter.com to fetch your bookmarks (and tweet/thread details as supported). Those requests use credentials already present in your browser session.
  • If you use an optional Unbookmark action (remove from X Bookmarks), Noya may send authenticated requests to X to delete that bookmark. Marking a save Done in Noya is local by default and does not unbookmark on X unless you choose that path.
  • With an active Pro subscription, AI auto-tag may send save text to Noya-operated services for transient analysis. Post content is not retained on Noya servers as an archive of your saves. Entitlement checks may send X identity and subscription state to Noya-operated services.
  • Payment is handled by a payment processor. Card and billing details are governed by that processor’s privacy policy; Noya keeps payment references needed to honor the subscription.
  • New Tab wallpapers may request images from images.unsplash.com.
  • To display media and some post content, the extension may load resources from X media CDNs (for example pbs.twimg.com, video.twimg.com) and, when needed for enrichment, public syndication-style hosts used only to complete content you already bookmarked.
  • The extension does not send analytics or behavioral telemetry to a Noya-operated server. Optional Noya Pro may contact api.noya.yilinglabs.com for subscription and AI auto-tag only.
  • Noya does not sell personal save data or share it with advertising or tracking platforms.

X / Twitter session

  • You must already be signed into X in the same Chrome profile. Noya never asks for your X password.
  • Auth headers and cookies are used only so Noya can access your bookmarks and related content, and only while the extension is installed on that profile.
  • The same X identity ties Pro to your account when you subscribe.
  • Session credentials stay in local browser storage on this profile. They are refreshed from live x.com traffic and cookie state as needed.

How long data stays

  • Your saves (reading state, highlights, tags, settings) remain on the device until you clear them, remove the extension, or wipe the browser profile.
  • Captured auth headers and related runtime metadata remain in local storage until session/auth state changes, you clear extension data, or you remove the extension.
  • Pro subscription records (X id, status, payment references) are kept for as long as needed to provide the subscription and meet legal/accounting requirements.
  • Transient AI request payloads are not kept as a Noya post archive after the pass completes.
  • Export packages are ordinary files you save yourself; Noya does not upload them.

Your controls

  • You can remove the extension at any time.
  • You can clear local saves from Noya settings (or by removing the extension).
  • You can export a full backup and import it later — including on another machine or profile where Noya is installed. You can also export media or one save as a zip from the Reader.
  • You can disable New Tab replacement in settings and open Noya from the extension icon instead.
  • You can cancel Pro through the subscription management path shown in the extension (or payment processor) when available.
  • Chrome manages extension permissions. To review or revoke host permissions, use Chrome’s extension details page for Noya.
  • If you use Noya in another browser profile, that profile has its own X login and its own local saves.

This marketing website

  • The public site at noya.yilinglabs.com is separate from the extension’s local data.
  • At launch we aim for privacy-light analytics or none. If site analytics are enabled, they will be disclosed on this page and will not include your extension save contents.
  • Hosting providers may process standard server logs (for example IP address and user-agent) as part of delivering the website.

Children

Noya is not directed at children under 13, and we do not knowingly collect personal information from children. The free product has no Noya account; Pro is tied to the X account you already use.

Changes to this policy

If permissions or data practices change in a material way, we will update this page and the “Last updated” date. Significant changes will also be reflected in the Chrome Web Store listing where required.