Privacy Policy

What StumbleU is

StumbleU is a web discovery service delivered as a browser extension and web app. It surfaces interesting, non-obvious pages from a curated corpus so you can discover the web beyond your usual feeds and searches.

What we collect

Account data. If you create an account, we store your email address and a hashed password (via Supabase Auth). We do not collect your name, phone number, or payment details directly — payment is handled by Paddle, which has its own privacy policy.

Usage events. We record when you stumble to a page and when you use the Think feature, along with the URL and timestamp. This is used to enforce daily usage limits, reset them at midnight, and to improve the corpus ranking.

Saved pages and history. Pages you save or have stumbled to are stored in your account so they sync across devices. Guests store this data locally in the extension only.

Interests and settings. Category preferences and app settings are stored locally in the extension and, if you are signed in, synced to your account.

Submitted URLs. If you use "Suggest a site," we store the URL, optional note, and your user ID for review.

What we do not collect

We do not track your general browsing activity. The extension only records pages you explicitly navigate to via the Stumble button. We do not read, store, or transmit the content of pages you visit outside of StumbleU. We do not sell your data to third parties.

Browser extension permissions

The extension requests the following permissions:

• storage — to save your history, saved pages, interests, and settings locally.
• tabs — to open stumbled pages and the dashboard in a new tab.
• activeTab — to read the URL of the current page when you use the Think or Save actions on it.
• scripting — to inject a lightweight content script that listens for the keyboard shortcut to open the popup.

AI / Think feature

When you use Think, the URL and a brief page excerpt are sent to a third-party AI provider to generate an insight. No personally identifiable information is attached to these requests. Responses are cached so repeated Think requests on the same page do not re-send the content.

Third-party services

• Supabase — authentication, account data, and usage events are stored in Supabase (supabase.com). EU data residency is available on their platform.
• Paddle — payment processing for Pro subscriptions. Paddle is the merchant of record; billing data is governed by Paddle's privacy policy.
• AI provider — page content is sent to an AI API for Think analysis. Requests are not linked to your account.

Cookies and sessions

We set a secure, HTTP-only session cookie (stu_access_token) when you sign in. This cookie is used solely to authenticate your requests to the StumbleU API. It is not used for cross-site tracking.

Data retention

Usage events and stumble history are retained for as long as your account is active. You can clear your local history at any time from the extension's History tab. To delete your account and all associated data, contact us at the address below.

Your rights

You may request a copy of your data, correction of inaccurate data, or deletion of your account and data at any time. Depending on your jurisdiction, additional rights may apply (e.g. GDPR for EU residents, CCPA for California residents). To exercise these rights, contact us at the address below.

Changes to this policy

We may update this policy from time to time. Significant changes will be announced in the extension or via email to registered users. The "last updated" date at the top of this page reflects the most recent revision.

Related policies

Terms of Use · Refund Policy

Contact

Questions about this policy: stumbleuext@gmail.com