Privacy Policy

Last updated 15 October 2026

What Grablet processes, and where

Media detection

Grablet looks at the addresses and types of files that pages you visit have already loaded, so it can list them for you. For a streamed video it reads the site’s playlist once, without your cookies, to tell you which qualities exist. When you click Save, the file (or the stream’s fragments) is fetched from the website’s own servers to your computer. Nothing is sent anywhere else, and all of this happens on your device.

Downloads

When you click Save, your browser downloads the file directly from the website’s own servers to your Downloads folder. The file never passes through us. We do not operate servers that could receive it.

Saving to your own cloud (Pro, optional)

If you connect a cloud account such as OneDrive from the Pro panel, Grablet can save a file into a folder of that account instead of your Downloads folder. You sign in on the provider’s own page; Grablet asks only for its own app folder and can read nothing else in your drive. The sign-in token is stored in the extension on this device, is sent only to that provider with each upload, and is deleted when you disconnect. The file goes from your browser to your cloud provider directly. No server of ours is involved, so nothing about the file, the account or the upload passes through us or is visible to us. Share links are created by the provider, on your request, and are yours to manage there. Grablet also keeps a copy of your library in that same folder, as a small file named library.json: the page, the post, the title and the media address of each item in your library, which is everything you saved, to the cloud or to Downloads, and everything you bookmarked, with any tags and notes you added. It is written after each cloud save and when you press Sync, goes only to your own account, and is deleted with the folder.

Evidence mode (Pro, optional)

With evidence mode on, every save gets a small record beside it: the source address, the page, the time, the size and a checksum of the file, and, for a photo that carries them, the camera’s own tags. A picture of the visible page at the moment of the save is stored beside the file too. All of this is written to your Downloads folder and nowhere else. One further option, off unless you turn it on, asks the Internet Archive to keep a copy of the source page; that sends the page’s address to archive.org, and the archive’s copy is noted in the record. Nothing else in evidence mode leaves your computer.

Settings

Your preferences are kept in your browser’s synced storage. If you have your browser’s own sync turned on, the browser carries them to your other devices through its own account; nothing about them is sent to us. Your licence key, your trial date, the Terms you accepted and any cloud sign-in stay on the one device.

Requests Grablet makes beyond the page you are on

Everything the extension sends anywhere other than the website you are viewing. Saving to your own cloud, above, including the library file it keeps there, is the one other case, and that goes to your own account.

• grablet.app/welcome, opened as a tab once, on a fresh install and never on an update. An ordinary page: it carries nothing but the fact that an install happened.
• grablet.app/goodbye?v=version, opened by your browser when you uninstall. It carries the version you removed and nothing else. The extension is gone by then and sends nothing itself. The page asks why you removed Grablet; answering is up to you, and what an answer sends is described below.
• grablet.app/denylist.json, read only while a licence key is stored: when the key is pasted, and at most once a day after that. It is a static file of revoked-key hashes. The request carries no cookies, no key and no identifier; your key is hashed on your device and compared on your device. If the file cannot be reached, your key keeps working.
• web.archive.org/save/page address, only while “Also ask the Internet Archive to keep a copy” is switched on in Settings. It is off until you turn it on, your browser asks for permission for web.archive.org at that moment, and a save then sends the address of the page you are saving to the Internet Archive.
• Send to phone, only when you click it on an item. Grablet prepares the file as for a save and hands it to your own WhatsApp Web or Telegram Web tab, opening web.whatsapp.com or web.telegram.org in a new tab if neither is open. The file waits there until you open a chat and press Attach; WhatsApp or Telegram then shows its preview, and nothing goes anywhere until you press send, to whoever you choose.
• Batch download, only for links you select and approve. Grablet requests each selected link’s page, and the file host it points to, with your browser’s cookies for those sites and the address of the page you selected them on as the referrer, to find and save the media. Each new site asks your browser’s permission first.
• Search this image, only when you click it on an image. It opens the engine you chose in Settings (Google Lens unless you change it; Bing, TinEye and Yandex are the others) in a new tab, with the image’s address in the query string. Grablet uploads nothing; the engine fetches the image from that address itself.

That is the whole list. The extension has no analytics or telemetry of any kind: no SDK, no counters, no error reporting, no pings.

What Grablet never does

• Collect, transmit, sell or share any personal data or browsing history
• Track you with analytics, cookies or identifiers
• Change the pages you visit, beyond adding its own Save controls
• Download anything you did not explicitly ask for

Download-click protection, scoped to enabled sites, closes a window that a download click opened without being asked. It does not change page content.

Permissions, and why they are needed

• Access to websites At install, only the sites Grablet supports by name. Any other site is off until you enable it from the popup, and you can take that back at any time. On those sites Grablet reads what the page has loaded, fetches from the site’s own servers only when you click Save, and sends nothing anywhere.
• Downloads To save the file you clicked into your Downloads folder.
• Storage To hold the list of media found in the current tab, and your per-site settings. No browsing history is retained.
• Tabs To match found media to the tab it came from.
• Web request To see the type and size of files the page loads. Passive only. Nothing is blocked, redirected or changed.
• Web navigation To clear a tab’s list when you leave the page, and for download-click protection, scoped to enabled sites. If clicking a player opens a window nobody asked for, Grablet closes it. It never runs on the sites Grablet supports by name, acts only on clear evidence, and can be switched off per site from the popup.
• Offscreen document (Chrome and Edge) Where Pro assembles a stream into an MP4, because the extension’s background process cannot create the file on its own.
• Scripting To add Grablet’s detection and Save button to a site you have enabled from the popup. Nothing is registered until you do, and no code is ever loaded from the internet.

Children

Grablet is not directed at children under 13. The extension collects no data, and the optional count on the goodbye page keeps nothing about who answered, so we do not knowingly collect personal information from anyone, children included.

If you email us, tell us why you left, or buy Pro

The extension collects nothing. If you email us, we hold what you sent, your address and your message, for as long as it takes to answer.

If you pick a reason on the goodbye page, our licence server adds one to a daily count for that reason, the site you named if you named one, the Grablet version, your browser family (Chrome, Edge, Firefox or other) and your operating-system family (Windows, macOS, ChromeOS, Linux, Android, iOS, which includes iPadOS, or other), and stores nothing else: no address, no IP, no browser or system version, nothing that identifies you. The page works out both families itself and puts only the family names in what it sends. Your browser adds its usual request headers, as it does for any web page, and the server keeps none of them. Nothing is sent until you pick one.

If you buy a Pro licence, Stripe handles the payment on its own checkout page, under Stripe’s privacy policy, and we never see your card details. Stripe tells our licence server your email address, your name if you gave one, and the payment and subscription ids, and the server uses them to mint your key and email it to you through our email provider, Resend. Stripe then sends your browser back to grablet.app/pro with the checkout’s reference in the address, and the page uses that reference to ask the licence server for your key and show it to you, for 24 hours after it was issued; after that the server answers only with a shortened form of the address the key was emailed to. It keeps your email address, the key it issued and the payment record Stripe sent (the ids, the amount and the currency) in our licence database, so the key can be reissued if you lose it. None of it is shared or used for anything else.

Changes to this policy

If a future feature ever needs to send anything off your device, this policy will be updated before that feature ships, the data involved will be the minimum required, and your media files and browsing history will remain off limits permanently.

Everything the extension sends today is listed under Requests Grablet makes beyond the page you are on. A licence key itself is verified on your device against a public key built into the extension; the one request Pro adds is the revoked-key list described there.

Who we are, and how to reach us

Grablet is published by MYLABS AI SOLUTIONS (OPC) PRIVATE LIMITED, Puducherry, India. The personal data we hold is what you send us by email and, if you buy Pro, the licence record described above. You can ask us to delete either at any time; without the licence record we can no longer reissue that key.

Questions about this policy: support@grablet.app