Privacy Policy

Highlighty is made by Webmind Technologies Ltd (“Highlighty”, “we”, “us”), a company registered in the United Kingdom (company number 16668049). We operate the Highlighty browser extension and the www.highlighty.app website.

This policy explains what information the extension and the website handle, where it is kept, who it is shared with and how you can delete it. It applies to the extension in every browser it is offered for, and to our website.

In short

You don’t need an account to use the free plan. Your search terms, lists, settings, the pages you search and the PDFs you open are processed on your device and are not sent to us.
An account is optional. It is needed only for the PRO trial and a PRO subscription, and holds your email address, your trial dates and your subscription details.
Payments are handled by Paddle, our merchant of record. We never receive your card details.
The extension contains no advertising, analytics or tracking code. Our website uses Simple Analytics, a cookie-free analytics service.
We do not sell user data or use it for advertising.
You can delete your account at any time from the extension.

Chrome Web Store User Data Policy

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

We do not sell user data or use it for advertising. In particular, we:

do not sell or rent your data to anyone;
do not use or transfer your data to show advertising, including personalized advertising, and we work with no ad networks;
do not use or transfer your data to determine creditworthiness or for lending purposes;
do not use or transfer your data for any purpose unrelated to Highlighty’s single purpose: finding, highlighting and navigating text on web pages and in PDFs;
do not let anyone at Highlighty read your data, except with your permission (for example, when you send us a support request), when it is necessary for security (such as investigating abuse), or to comply with the law.

Information that stays on your device

The extension does its work inside your browser. The following is processed and stored only on your device and is never sent to us:

your search terms, term lists, colors, settings, website rules and the recent searches in the Find bar;
the text of the pages you visit, which the extension reads to find and highlight your terms, including text you type into text boxes (password fields are always skipped);
PDFs you open in PDF Search, the text extracted from them and the results of text recognition (OCR). OCR runs on your device using language data bundled with the extension; nothing is uploaded.

This data is kept in the extension’s storage in your browser (extension storage and IndexedDB). PDF Search keeps the PDFs you added from your computer, and the web addresses of PDFs you opened by link, so it can restore your workspace.

Two other small items are stored in your browser. A record of when Highlighty was first set up (and of any trial tied to that installation) is kept in the browser’s extension sync storage; if you have browser sync turned on, your browser copies it to your other devices through your browser account. And an on/off setting for the Find bar is saved in each website’s own local storage so the bar can start instantly; it records only whether the Find bar is on and whether you excluded that website. Neither contains your search terms or personal details.

You can remove all of this at any time by clearing it in the extension or by uninstalling the extension. Backup files you export are saved where you choose and stay under your control.

Optional features that use page addresses

Match history (the Analytics tab)

Match history is off by default. If you switch it on, the extension records, for pages where your terms matched, the page address (URL), the time of your visit, and which of your terms matched and how many times. Only the 50 most recent entries are kept. You can export them as a CSV file or clear them at any time. Match history stays on your device and is never sent to us.

Find in all open tabs

When you search all open tabs, the extension searches your other open tabs inside your browser and shows each tab’s title, address, number of matches and a short text snippet. This happens only when you start such a search, and the results are not sent anywhere.

Opening PDFs from the web

When you open a PDF from a web address in PDF Search, the extension downloads that PDF directly from the website that hosts it. This is the same kind of request your browser makes when you open the file yourself, and it uses your existing sign-in to that website so protected PDFs can open. We do not receive the file or its address.

What the extension receives from our servers

Public settings and short system messages, such as the current trial offer and in-app notices. These requests contain no personal data.
Your subscription status, only when you are signed in. This request identifies your account (your account ID and sign-in token) so we can return your plan, trial or license status.

The extension contains no analytics, telemetry, crash-reporting or advertising code, and it does not report which pages you visit or what you search for.

If you create an account

An account is optional. It is needed only to start the PRO trial or to subscribe to PRO. You sign up with an email address and a password; we don’t offer sign-in with Google or other third-party accounts.

Sign-in: your email address and password are handled by Google Firebase Authentication. Firebase stores your password only in hashed form; we never see or store it in readable form. Firebase also records when your account was created and when you last signed in, and sends your verification and password-reset emails.
Your account record, kept in Google Cloud Firestore: your email address; when your PRO trial started and ends, and how it was granted (for example, through your organization); and, if you subscribe, the subscription details Paddle sends us: your Paddle customer ID, the email address used at checkout, the subscription status, the latest subscription event and its time, the next billing or cancellation date, links to update your payment details or cancel, and links to your receipts.
Organization licenses: if your organization has licensed Highlighty for its email domain, we keep a seat record for your account with your email address, when you first used the license and when you were last seen (updated at most every six hours), so we can count seats and bill your organization. If your organization arranged Highlighty access for you by email address, we also hold your email address as part of that arrangement.
On your device: the extension keeps your signed-in session, email address and plan status in its storage so it can show your account without asking you to sign in each time.

Your account record is stored in Google Cloud Firestore in the European Union (Warsaw, Poland). Our server functions run on Google Cloud in the United States (Iowa), and Firebase Authentication is operated by Google, so your account data may also be processed in the United States.

Our server logs record technical events such as errors, identified by an account ID (and, in a few payment-error cases, by an email address). They do not record your IP address and are deleted automatically after 30 days. Like any online service, our hosting providers necessarily receive your IP address when your browser connects to them.

Payments

Paid plans are sold by Paddle (Paddle.com Market Ltd), our merchant of record. Paddle collects and processes your payment details, billing information and tax information under its own privacy policy. We never receive your card number or other payment details.

To link a purchase to your account, the extension opens our checkout page on highlighty.app with your account email address and account ID included (encoded) in the page address. The page passes them to Paddle’s checkout, and Paddle then sends our server the subscription details listed above.

Our website

Hosting: highlighty.app is hosted by Netlify, which receives your IP address and standard request details (such as your browser type and the page requested) in order to deliver the site.
Analytics: we use Simple Analytics, a privacy-friendly analytics service that does not use cookies or track you across websites. It gives us aggregate numbers such as page views, referring websites and clicks on buttons like the install button. There are no analytics in the extension.
Videos: some pages embed our tutorial videos from YouTube. A video player loads only when you scroll to it; when it loads, YouTube (Google) may set cookies and receive your IP address under Google’s privacy policy.
Checkout: the checkout page loads Paddle’s checkout, which may set cookies needed to take your payment.
Cookies: highlighty.app sets no cookies of its own and uses no advertising or tracking cookies. You can block or delete cookies in your browser settings.

How we use information

to provide your account, trial, subscription or organization license and the PRO features they unlock;
to verify your email address and let you reset your password;
to process payments through Paddle and show your subscription status, receipts and management links;
to count seats and bill organizations that license Highlighty;
to answer your support requests;
to keep the service secure and prevent abuse, for example to give each email address only one free trial;
to understand, in aggregate, how our website is used;
to comply with legal obligations.

Who we share information with

We share information only with the service providers that run Highlighty for us, and only what each of them needs:

Google (Firebase Authentication, Cloud Firestore, Cloud Functions and Cloud Logging): accounts and our server;
Paddle (Paddle.com Market Ltd): checkout, payments, invoices and tax;
Netlify: hosting for highlighty.app;
Simple Analytics: website statistics;
YouTube (Google): tutorial videos embedded on our website.

Google, Netlify and Simple Analytics process information on our behalf and may not use it for any other purpose. Paddle, as merchant of record, and YouTube, for embedded videos, handle information under their own privacy policies. We may also disclose information when the law requires it. We do not share your data with anyone else.

How long we keep data

On your device: until you delete it or uninstall the extension. Match history keeps at most 50 entries.
Your account: until you delete it. If your account has no activity for 6 months, we delete it automatically. Signing in counts as activity, and so does using the extension while you are signed in. We don’t delete it while you have an active subscription or while your organization’s license covers your verified work email, or in the 6 months after either one ends.
Organization seat records: for as long as your organization’s license and its billing need them. If you delete your account, your email address is removed from the record.
Server logs: 30 days.
After you delete your account: only the items listed under “Deleting your account” below.
Paddle keeps its own billing records as merchant of record, under its own policy.

We may keep limited information longer when it is needed to resolve disputes, enforce our agreements, or meet legal, tax or accounting obligations.

Deleting your account

In Highlighty 2.5.1 and later, open the extension, go to settings → Account, choose Delete account and type DELETE to confirm. Deletion takes effect immediately. If you have a subscription that can still bill you, the extension asks you to cancel it first and shows a link to do so. In earlier versions, email hey@highlighty.app from the address on your account and we will delete your account within 30 days.

Deleting your account removes your sign-in, your account record, your trial and subscription details and your receipt links from our servers. We keep only:

a record of the deletion date under an anonymous internal account ID (it holds no email address or other personal details);
if you used the free PRO trial, a one-way, keyed hash of your email address, so the same address does not receive another trial;
if your organization licenses Highlighty, its seat record for your account with your email address removed (only an internal account ID and the dates remain);
if your organization arranged Highlighty access for you by email address, that entry, which stays with your organization’s arrangement;
the billing records that Paddle keeps as merchant of record.

Your search terms, settings, match history and PDFs are stored only in your browser and are not affected; remove them by uninstalling the extension. Signing out does not delete your account.

Your data protection rights

You have the right to:

access – request a copy of the personal data we hold about you;
rectification – ask us to correct data you believe is inaccurate or to complete data you believe is incomplete;
erasure – ask us to delete your personal data, under certain conditions (you can delete your account yourself from the extension’s Account tab);
restrict processing – ask us to restrict how we process your personal data, under certain conditions;
object to processing – object to our processing of your personal data, under certain conditions;
data portability – ask us to transfer the data we collected to another organization, or directly to you, under certain conditions.

To exercise any of these rights, contact us at hey@highlighty.app. We respond within one month.

Security

Data travelling between the extension, our website and our servers uses encrypted (HTTPS) connections, passwords are handled by Firebase Authentication, and deleting an account requires your current signed-in session. No method of transmission over the internet or of electronic storage is 100% secure, so we cannot guarantee absolute security, but we use commercially reasonable means to protect your information.

Children's Privacy

Our Services do not address anyone under the age of 13. We do not knowingly collect personal identifiable information from children under 13. In the case we discover that a child under 13 has provided us with personal information, we immediately delete this from our servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us so that we will be able to do necessary actions.

Links to Other Sites

Our website and extension may contain links to other sites that we do not operate. If you follow such a link, that site’s own privacy policy applies. We have no control over, and assume no responsibility for, the content, privacy policies or practices of any third-party sites or services.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post any changes on this page and update the date below. Changes are effective as soon as they are posted.

Contact Us

If you have any questions, concerns or requests about your personal data or this Privacy Policy, email us at hey@highlighty.app or write to Webmind Technologies Ltd, Hova House, 1 Hova Villas, Brighton & Hove, England BN3 3DH, United Kingdom.

Last updated: October 16, 2026