Privacy policy

Last updated 17 October 2026. This policy covers the historoo browser extension, historoo Pro, and this website, historoo.com, wherever you are in the world.

Who we are

historoo is made by [your legal name, or your company's name and registered number], [postal address] ("we", "us"). For anything about privacy, email privacy@historoo.com.

We're based in Scotland, in the UK, so the main law that applies to us is UK data protection law (the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025), and our regulator is the Information Commissioner's Office (ICO). We give the same protection to everyone, wherever they live.

Under data protection laws such as the UK GDPR and the EU GDPR, we are the "controller" of the little personal data described under Pro and This website. We are not the controller of your browsing history: it never reaches us, and you alone decide what's in it.

The extension

What it saves, and where

As you browse, historoo saves what was on your screen for a second or more, so you can search it later:

• small thumbnails of pictures and videos, with their captions, nearby text and the page they were on;
• page titles and the main headings you read, and the addresses and titles of pages you visit;
• product names, pictures and prices from shops;
• the captions of videos you watch, from what's shown on screen or the caption file the page itself uses;
• words written in pictures, read on your computer (Pro);
• a search index, and labels for what's in each picture (such as "cat" or "sofa"), made on your computer. There are deliberately no labels for people: historoo doesn't recognise faces or describe anyone;
• the collections you make, and what you put in them;
• the last picture you searched with (pasted, dropped, chosen, or right-clicked with "Where have I seen this?"), until the next one replaces it. It isn't added to your history.

All of this is kept in your browser's own storage on that computer. You choose what's saved in Settings, and you can delete any of it, a whole site, or everything, at any time. On the Free plan, anything older than 7 days is deleted. With Pro you choose how long things are kept. Things you put in a collection are kept until you delete them. Settings can also download a copy of everything as a file, made on your computer.

You can lock historoo with a PIN, for a computer other people use. The PIN is kept only in a scrambled (hashed) form, on that computer. The lock hides historoo's pages; it doesn't encrypt what's saved.

What it never saves

• Anything in incognito or private windows.
• Sign-in pages, and any page that shows a password, card number or one-time code field, or whose address looks like sign-in, checkout or payment. If such a field appears after something was saved, what was saved from that page is deleted.
• Banking, health, adult, email and messaging sites, unless you turn them on in Settings.
• Any site you add to your own list.

When the extension connects to anything

• Pictures you looked at are downloaded once more from the site that showed them, to make a small thumbnail. No cookies or sign-in are sent. If a site refuses, the picture is cropped from a screenshot of what was on your screen instead. A picture you right-click and choose Where have I seen this?, or drag in from a web page to search with, is downloaded (or cropped) the same way and compared with your history on your computer.
• A video's caption file is downloaded when the page itself links one. On YouTube nothing is requested: only captions shown on screen while you watch are kept.
• The search models (for finding pictures by what's in them, and for reading words in pictures) are downloaded once, the first time they're needed, from Hugging Face and jsDelivr [or: from our own copy at your-model-host]. Those services see your IP address and that a model was downloaded, nothing about your browsing.
• Your storage (Google Drive or OneDrive), only if you turn on sync. See Sync.
• Our server, only if you sign in to an account. See Pro and accounts.

The extension contacts nothing else. In particular it sends nothing about what you browse, search or save to us or anyone else.

Sync (Pro)

Sync keeps your history the same on all your computers. Before anything leaves your computer it's encrypted (AES-256-GCM) with a key that's locked by a passphrase you choose. The passphrase and the key never leave your computers, so neither we nor your storage provider can read your history. If you forget your passphrase, only the recovery key you saved can open it again: we can't.

The encrypted files go to your own storage: a hidden app folder in Google Drive, or historoo's own app folder in OneDrive. Signing in to your storage is between you and Google or Microsoft; we never see that sign-in. historoo asks for access to its own folder only, never your other files, and reads which account is connected just to show it in Settings on that computer. Your provider's own privacy policy covers what they do with files you keep with them.

The names of your collections are also kept in your storage, encrypted the same way, so your other computers get the same collections. Your storage account and the fact that you use sync are never sent to us.

Pro and accounts

Your account

A historoo account comes with Pro: getting Pro starts by making the account, then the checkout opens for it. You sign in with an email address and password, with a 6-digit code we email you (the first code makes the account), or with Google, Microsoft or Apple. Signing in with Google, Microsoft or Apple joins an existing account with the same email address, and Apple may give us a private relay address instead of your real one. This is separate from connecting your storage for sync. Each computer you sign in on gets its own sign-in, so your subscription and your settings work there with nothing to copy across. The Free plan doesn't need an account. If you buy Pro from a checkout link without an account, we keep the email address Paddle gives us with the subscription, so the account you then make with that address gets it.

Signing in with Google, Microsoft or Apple happens in a small window from our server (on this website, in the tab itself), which uses cookies for that sign-in only; they expire when it's done. The extension and this website use no cookies.

What our server keeps

• your email address, whether you've confirmed it, and when you made the account;
• if you use a password, only a scrambled (hashed) form of it; if you sign in with Google, Microsoft or Apple, that account's id and email address, never your name, picture or contacts, and never their sign-in tokens after you've signed in;
• one entry for each computer you're signed in on, with a name you can change (such as "Chrome on Windows"), so Settings can list them and you can sign any of them out. No IP address or browser details are kept with it;
• Paddle's ids for your subscription and for you as their customer, the email address you gave Paddle, and the subscription's status and dates (renewal, end);
• a note of which emails about Pro ending we've sent, so each is sent only once;
• your settings, so they're the same on all your computers: which kinds of things to save, the finer capture options, how closely picture search matches, how long to keep things, which built-in kinds of site to skip, what the toolbar button opens, and the theme. Never the sites you've added yourself, your collections or your PIN lock;
• short-lived codes for confirming your email address, resetting your password or signing in, deleted when they expire.

That's all about you. No browsing, no history, no searches, no sites you've added to a list by name, no collections, no storage account, no passphrase or keys. When the extension talks to our server, our host (Cloudflare) handles your IP address to deliver the request. To stop people guessing passwords, the server counts recent attempts by IP address for up to an hour, then deletes the count. It also logs errors, which never include what was sent. We don't keep a log of requests.

Email. We email you only about your account and your subscription: to confirm your address, to reset your password, to send a sign-in code when you ask for one, and, if you cancel Pro, to say so and to remind you 3 days before it ends. These are sent through Resend from historoo.com. We don't send marketing emails.

Delete your account (Settings, Plan, Computers and your account) signs out every computer and deletes everything our server holds about you. A paid-up subscription stops renewing and runs to the end of the period you've paid for, with no refund for the rest; one that's past due or paused ends at once. If Paddle can't be reached at that moment, nothing is deleted and you can try again. Your history stays on your computers and in your storage.

Payments

Pro is sold by Paddle (Paddle.com Market Limited), our reseller and merchant of record. Each checkout carries your historoo account's id, so your subscription is matched to your account. Paddle collects your name, email address, billing country or address, payment details and, if you give one, your tax number, and handles payment, tax, invoices, refunds and cancellations. Their privacy policy explains what they do with it. We can see your email address, country and payments in Paddle's dashboard, so we can help if you contact us, but nothing we hold links them to your history or your storage.

Problem reports

"Report a problem with this site" opens an email in your own email app, so you can read everything in it before deciding to send it. It includes the page address only if you tick the box. If you send it, we use it to fix the problem and keep it as long as we need to for that.

This website

• No cookies, no analytics and no tracking. The interactive demo remembers your choices in your browser's own storage, on your device only.
• Fonts and scripts are served from this site. The demo pictures load from Unsplash's image servers, and the checkout page loads Paddle's checkout from Paddle, so those services see your IP address when they load.
• Our website host, Cloudflare, handles your IP address to deliver the pages and may keep short-term technical logs.
• Searching your history on the web is part of Pro. At historoo.com/search/, you sign in to your historoo account first, then to Google Drive, in that browser tab. Our server checks that your account has Pro, so it learns that you signed in there; it never sees your history. The page reads your encrypted backup straight from your Google Drive and unlocks it in the tab with your passphrase. Both sign-ins are kept in that tab only, and are gone when you close it or sign out.

Why we may use it (legal bases)

• To provide Pro you've paid for (your account, sign-in, subscription status, settings sync, emails about your account and about Pro ending, deletion): performance of a contract.
• To keep the service secure and stop abuse (limits on sign-in attempts, technical logs): our legitimate interests.
• Tax and accounting records: legal obligation, mostly met by Paddle as the seller.

We don't use personal data for advertising, profiling or automated decisions about you, and we never sell or share it.

How long it's kept

• Everything the extension saves: on your computer, for as long as you choose (7 days on Free), until you delete it or remove the extension. In your storage, until you delete it there (Settings offers to).
• Your account, its settings and its subscription record: until you delete your account. After a subscription ends we keep its record so you can restart it; delete your account to remove it.
• A computer's sign-in: 90 days, extended while you use it, until you sign it out. Resetting your password signs out every other computer. Signing one computer out leaves the others signed in; Pro stops on the one signed out straight away (it keeps everything it has, and saves nothing new until it signs in again).
• Links for confirming your email: 24 hours. Password reset links: 30 minutes. Emailed sign-in codes: 10 minutes, stored only in a scrambled form. The one-time code that finishes a Google, Microsoft or Apple sign-in: 3 minutes, stored only in a scrambled form.
• Counts of recent sign-in attempts by IP address: up to an hour.
• A subscription bought without an account: its record and the email address Paddle gave us, until an account with that address takes it, or until you ask us to delete it.
• Paddle's records: as Paddle's policy says, which includes keeping invoices as tax law requires.

Where it's handled

Our server runs on Cloudflare's network, which has data centres around the world; its database is kept in the European Union. Paddle and our providers may handle data outside your country. Where data protection law requires it, these transfers are covered by safeguards such as the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Addendum, which these providers offer.

Your rights, wherever you are

Depending on where you live (for example the UK, the EU and EEA, Switzerland, California and other US states, Canada, Brazil, Australia, Japan, South Korea or India), you may have the right to: know what personal data we hold about you and get a copy; have it corrected or deleted; object to or restrict how we use it; take it elsewhere; withdraw consent; and complain to a regulator. We give these rights to everyone, wherever they live.

Signed in, Settings shows your account, and Delete your account removes everything we hold. For anything else, email privacy@historoo.com from the address on your account, and we'll answer within a month (sooner where your law requires).

US residents: we don't sell or share personal information, or use it for targeted advertising, so there's nothing to opt out of, by Global Privacy Control or otherwise. We won't treat you differently for using your rights. You can use an authorised agent.

Complaints: you can complain to your data protection regulator, for example the Information Commissioner's Office in the UK or your country's authority in the EU. We'd appreciate the chance to put things right first: email privacy@historoo.com, and we'll acknowledge your complaint within 30 days and tell you what we're doing about it.

[If you appoint a representative in the EU (GDPR Article 27), name them and their contact details here.]

Children

historoo isn't meant for children under 13, or under the age your country requires for using online services without a parent's consent. Pro can only be bought by someone old enough to make a purchase, as Paddle requires.

Security

Synced history is encrypted end to end. Passwords are kept only in a scrambled (hashed) form. Requests to our server go over HTTPS with a sign-in for that computer, which you can sign out from Settings on any of your computers. The extension's storage is closed to the scripts it runs inside web pages, so websites can't reach your saved history, sign-in or keys. Our server holds nothing that would let anyone read your history.

Google and Chrome Web Store user data

historoo's use of information received from Google APIs (Google Drive, for sync, and Google sign-in, for your account) adheres to the Google API Services User Data Policy, including the Limited Use requirements. Its handling of your browsing complies with the Chrome Web Store Developer Program Policies, including the Limited Use requirements: it's used only to provide historoo's search, on your computer, and is never transferred to us, sold, or used for advertising or any other purpose.

Changes

If we change this policy we'll update the date at the top, and tell you in the extension before any change that affects you takes effect. We'll never start collecting your browsing.