Privacy
Privacy Policy
Humble Tools makes small, focused Safari extensions. This policy covers the Humble Tools Safari extensions (the "Extensions"): Full Page Screenshot, SuperVideo, Last Login, Autofill Forms, and Site Routes, plus the marketing website at humbletools.app. It is written to be true, not to fill space.
The short version
The Extensions do not track your browsing, do not read your passwords for us, contain no advertising, and send no analytics about the pages you visit. What each tool does happens on your Mac. The only network call an Extension may make for itself is an optional update check (you can turn it off), which asks only "what is the latest version" and tells us, in aggregate, that the app is still installed. The marketing website uses privacy-respecting analytics so we can improve the site. We never join a website visit to how you use an Extension.
Who is responsible
The data controller is Humble Tools, operated by Nicolas Mertens. Questions: [email protected].
What each Extension accesses, and why
To function, browser extensions must be granted access to web pages. Here is exactly what each one touches and why, and what it does NOT do.
- Full Page Screenshot: when you trigger a capture, it reads the visible content of the tab you are on to stitch a full-page image, which is saved to your Downloads folder on your device. The image is never uploaded anywhere.
- SuperVideo: reads video elements on pages you visit so it can change playback speed, fill the window, and toggle captions. Caption auto-translate is performed by the site's own player (for example YouTube), not by us; no caption text or viewing data is sent to us.
- Last Login: reads sign-in form fields on pages you visit to show you which account or method you last used, entirely on your device. It never stores, transmits, or has access to your passwords or credentials on any server.
- Autofill Forms: reads and fills form fields on the page you are on, using a profile you keep on your Mac. Your profile never leaves your device and is not sent anywhere.
- Site Routes: routes the websites you choose through a VPN you already pay for (or choose to buy), while every other site stays direct. It runs a helper on your Mac and talks to that helper only on localhost. Optional host access for a site is used only for the cloak (timezone / WebRTC consistency) on that site. Declining that permission does not stop routing; it only skips the cloak.
Broad site access ("all sites") is requested only where a tool must work on whatever page you choose. Site Routes does not ask for all sites up front; it requests a site when you choose to route that site. Access is used solely for the feature above and for nothing else.
Data we collect
Inside the Extensions (product use): none of your browsing content, form values, passwords, or VPN configs leave your device for us. Settings you choose (for example a default speed, or which sites Site Routes should route) stay in local storage on your Mac and can be removed by uninstalling the Extension or clearing its data.
Optional update check: if "Check for updates" is on (the default), the Extension (or Site Routes via Sparkle) may, at most about once a day, request a public version list from our download host. That request names which app is checking. We store only aggregate counters: app name, UTC day, and coarse country from the network edge. We do not store your IP address, a device id, a cookie, or a full user-agent. Turn the toggle off and the call stops entirely.
Downloads: when you download a tool from get.humbletools.app we count the download the same aggregate way (app, day, referrer hostname only, country). Optional short channel tags on links (for example a post-specific code) are counted in bulk, never as a profile of you.
Setup funnel (aggregate only): to understand where people drop off between
download and a working install, an Extension may fire a few one-time setup beacons
(for example: app opened, extension enabled, VPN connected, first site routed, first-route
coach shown or dismissed). Each step is sent at most once per install, names only the app
and an allow-listed step, and may include an allow-listed VPN provider id (for example
nord) with no country and no credentials. Coarse "how many sites" milestones
(for example routes_1 / routes_3 / routes_10) never list domains. We store only bulk
counters (app, step, day, country). No install id, no page content, no browsing history.
This is not continuous usage analytics.
Affiliate links (VPN providers)
Site Routes does not include a VPN. When we mention a commercial VPN you can buy, we may use a partner link for NordVPN and Proton VPN. If you sign up through those links, we may earn a commission. It does not cost you extra. We never see who signed up: there is no user-level callback to us, only aggregate reporting inside the partner dashboard (clicks, conversions, earnings with no link to your Site Routes install). Mullvad and other providers may be named without an affiliate link.
We do not rank providers by commission. Recommendations and UI order should follow how well a provider works with Site Routes, not what pays us. Affiliate links belong at "I need a VPN" moments, not as a tax on people who already connected one.
The marketing website
humbletools.app is separate from the Extensions. The site uses privacy-oriented analytics (including Cloudflare Web Analytics and Datafa) to understand traffic and which pages help people find the right tool: page views, referrers, and coarse performance. These tools are not used to track you across other companies' sites for advertising. They are not linked to Extension use.
Sharing, selling, tracking
We do not sell your data. We do not run advertising SDKs in the Extensions. Aggregate download and update-check counters are processed on infrastructure we operate (Cloudflare). Site analytics providers process website traffic under their own terms for the purpose of operating those analytics. We do not build a cross-site advertising profile of you.
Retention and deletion
Local Extension settings live only on your Mac under your control. Aggregate counters have no per-person row to delete. Website analytics retention follows the providers' defaults for those products. If you have a privacy question, contact [email protected].
Your rights
EU and EEA users retain their GDPR rights. For Extension product use we do not hold a personal profile on our servers. For website analytics and aggregate counters, contact us and we will help with any request we can fulfill. Write to [email protected].
Children
The Extensions are general-purpose utilities and are not directed at children, and they collect no data from anyone.
Tools still in development
Grocery Verdict is not yet released. It may need to fetch product information over the network when it ships; this policy will be updated with exactly what it accesses and what, if anything, it sends. Site Routes is released and is covered by the statements above (on-device helper, optional per-site cloak, aggregate update and setup counts only).
Changes
If this policy changes, we will update this page and the effective date above.